BeeCeeBee

Good morning This probably be 2 seperate threads but these are the issues. 1 I was doing some basic research using google and got redirected to one of those sites that just don't want to go away. My immediate reaction was to switch off my network connection physically and I did. I then deleted all temporary internet files. Was this the best way to handle this type of issue as I do not need any further problems. 2 After the deletion of the files I received a notice that seemed to be internal telling me my cache settings were to high and it was being reduced to 1024. My snderstaning is that microsoft actually recommends much lower setting. Can someone either expalin what that all means and what the effect is or perhaps direct me and article or thread that will dummy it down for me. Thanks

Yipee. It worked and the bubble is gone and the updates installed. Thanks!!!!!!!!

In trying to find a simple solution on the microsoft website I went to google and found this. I did the first part because it seemed simple enought but but do not want to venture into taking advice from unkown sites. I ony trust you guys now. But this is it. Go here and see if it works http://www.microsoft.com/genuine/ fix any issues, then validate it. If it still doesn't work try this Re-register the Windows Update DLL with the commands below Click Start, click Run, type cmd, and then click OK. Type the following commands. Press ENTER after each command. regsvr32 wuapi.dll regsvr32 wuaueng.dll regsvr32 wuaueng1.dll regsvr32 wucltui.dll regsvr32 wups.dll regsvr32 wups2.dll regsvr32 wuweb.dll Attempt to run Windows Update Now what do you get? Does this sound reasonable to you?? Could it be dangerous?

Congradulate me I no longer have 1 update that will not install I now have 2 I suppose this now rises above the level of an annoyance. Should I uninstall service pack 3 and try again? Perhaps I should just shoot myself!

I set it for everyday at 5: PM which I assume is excessive but it should try today.

no but I will now

Nothing worked Bob but I have a thought. I think the bubble first appeared while I was downloading updates. When I was done it was still there so I downloaded. Is it possible that it is already in the computer and if I search for updated it may disappear??

I tried that and it still will not install. Am I stupid because I typed an * where he had an * or does that stand for something else?

Actually I download everything it tells me to I just rarely leave my computer on and usually wait to download when I am not doing anything else. No other reason really. By the way, for some reason this thread seems twice as large as the window. Not true with the other. Have I done something with the site? I will now go to the link you provided.

Done Ill bet you wish I would just go away> :o Anyhow here I am again and this is the result Diagnostic Report (1.7.0095.0): ----------------------------------------- WGA Data--> Validation Status: Genuine Validation Code: 0 Online Validation Code: N/A Cached Validation Code: N/A Windows Product Key: *****-*****-W3R3K-J2VF4-JFP8W Windows Product Key Hash: XPfxGkd+SaYWqIyXYZav/kIic8c= Windows Product ID: 76477-OEM-2111907-00111 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 5.1.2600.2.00010300.3.0.hom CSVLK Server: N/A CSVLK PID: N/A ID: {4286C48C-1CD7-49C0-8C23-5DB834FFA7A9}(3) Is Admin: Yes TestCab: 0x0 WGA Version: Registered, 1.7.69.2 Signed By: Microsoft Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: 025D1FF3-171-1 Resolution Status: N/A WgaER Data--> ThreatID(s): N/A Version: N/A WGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 WGATray.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 109 N/A OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-171-1 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32) Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> Other data--> Office Details: <GenuineResults><MachineData><UGUID> {4286C48C-1CD7-49C0-8C23-5DB834FFA7A9}</UGUID> <Version>1.7.0095.0</Version><OS>5.1.2600.2.00010300.3.0.hom</OS><Architecture>x32</Architecture> <PKey>*****-*****-*****-*****-JFP8W</PKey><PID>76477-OEM-2111907-00111</PID> <PIDType>2</PIDType><SID>S-1-5-21-2357625619-172785741-2210592064</SID><SYSTEM><Manufacturer>TOSHIBA </Manufacturer><Model>EQUIUM M40X</Model></SYSTEM><BIOS><Manufacturer>TOSHIBA</Manufacturer><Version>V1.20</Version><SMBIOSVersion major="2" minor="34"/> <Date>20050331000000.000000+000</Date><SLPBIOS>TOSHIBA,TOSHIBA</SLPBIOS></BIOS><HWID>C18F3F07018400D2< /HWID><UserLCID>0409</UserLCID> <SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>2</stat><msppid></msppid><name>TOSHIBA </name><model>Personal Computer</model></SBID><OEM/><BRT/></MachineData><Software><Office><Result>109</Result><Products/> <Applications/></Office></Software></GenuineResults>

Hello Again. I have just reformatted everything (Windows XP home) and everything is working fine thanks very much to the crew right here. I downloaded Critical updates, everything installed and still working fine. I immediately got a bubble saying that updates are ready to be downloaded so In followed instructions and downloaded KB951978. I then clicked to install and got a message that the installation failed. No reason shown but I keep getting the warning bubble to download. How can I get the update or at least stop the bubble without eliminating my ability to get notified of updates. I have my settings to notify but not install. Thanks in advance

You win!!! I have given up on trying to find reasons to hope you are wrong. I understand that a lot of people do not install software but just play off the net. BUT I am not going to try that either without your comments.

Thanks Goku. I have a Toshiba Laptop Equium M40X - 189 I am putting poker on the long finger until I have every safety advantage I can get.

MANY THANKS!!! :):):):):) etc. Thank you all!! I would like to create a recovery disc(s) and would be grateful if you can direct me where to look or who to ask. I have decided to stay away from any .exe files on portable and just use Wolfey's security recommendations and download from scratch. I would like to go back to Party Poker with the following observations. 1. I am not a gambler and you are not encouraging me to become one. Just harmless fun at what they call micro tables. 2. I know there are many disreputable sited out there but I am convinced this one isn't. 3. I just need to know if there is a safe way to do this. Right now I am just leaving it alone until I know I am safe and until I get recovery discs made. Again thanks for your help and for putting up with me. Barry :D

Good Morning Clearly you were right. I have reformatted reinstalled etc. I have also installed Avira and did a scan with the bundled norton disabled. I then removed norton using the above tool. I have done nothing else. Reinstalled my router of course or I would not be here. I am now using IE6. I have not done any critical updates as yet. To the extent that the poor Irish broadband allows I having no problems at all. The following are things that I must do and safely. 1. Reinstall Office direct from original discs. 2. Put the bulk of my documents back into the Computer. They are now on portable hard drive. 3. Set up Outlook express and import old email from portable HD. There are no malware programs installed. I have the .exe files on portable but do know whether I should use them or download fresh if at all. Should I allow updates which I assume will include IE7 and SP3?

Well you said it was a long shot. Maybe a slight difference but Maybe Im just counting faster. Before I start all over again (and I'm sick of this today so not now) I know that it will install the same older version of Norton. I updated it and used it briefly but If I was going to pay for an AV program it wouldn't be that one. Are there basic instructions for getting rid of all that without messing up. Obviously other than uninstall. Maybe by deleting related files I messed things up. Also I assume that it had IÊ6 installed. I know I downloaded 7 plus service packs etc. Are we all sure that uninstalling IE7 wont help?? I would imagine I should scan the portable hard drive with Avira before I reinstall any documents or email files. I feel like a little kid about to throw a temper tantrum because I really do not want to do this. oh well!!

Thanks would have missed it. Ill try and let you know.

OK AVG is Gone and Avira is in. I scanned and it found what may be DrMediaBack D. Found in System Value Inf A0002924.exe and Quaranteened. Also wartned that 3 files could not be opened. This is a paste of what seems relevent to me Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP8\A0002924.exe [0] Archive type: HIDDEN --> FIL\\\?\C:\System Volume Information\_restore{95C8BA23-7DEC-40CD-A7C2-1ABB11423E47}\RP8\A0002924.exe [DETECTION] Contains recognition pattern of the DR/MediaBack.D dropper [NOTE] The file was moved to '4920ae0f.qua'! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! It seems to me that the problem relates to actually finding the website. Once it is found the page seems to open fairly quickly with more complicated sites a bit slower to add pics etc. Even this page which is bookmarked and obviously used often takes forever to find. I can go through this site pretty quickly once I am here. I keep looking at all those registry entries relating to IE and wonder if they are fighting each other. Does any of that make sense??

Hi Goku Tried optimizer. Nothing happened. 3 questions' 1. Could Randy's reference to a proxy over ride have anything to do with this?? If so how should I change it, 2. Where are these RECYCLER files? I could not find anything using internet explorer and search came up with nothing. 3. Is there any point in uninstalling IE7 considering that firefox etc. were no better when installed? Thanks

OK I ran everything again and did get a result but I may have blown it. The malware found nothing but a few cookies (5) the ESET scan found 3 trojans. Apparently it removed 1 and reported an error in deleting the other 2. In trying to copy and paste I inadvertantly lost the information. However they all related to something called Recyclers C:/Windows/RECYCLERS ??? I ran the same scan again and nothing came up. I have restarted but do see any change. Regarding Randy's Question I have no idea why there is a proxy over ride or even what it does. Also I had a to do list when I re-formatted etc. After reinstalling my broadband service I updated windows and probably installed IE7 at that time. The disc must have had IE6. I just get the feeling that whatever happened happened then or when I was downloading thie #$%& AVG> As for leeching I tried looking for unaccounted for network activity while I was doing nothing and all I could find was a minimal amount of activity on the little icon. I opened the network connection status, the task manager and noticed that it was very minimal. I opened the connection to my router (through IE7 I guess) and noticed that each time there waas a little activity the page refreshed. I really want to get rid of AVG what I do not know is whether I should keep it running while I either redownload Avast or get Avira. Or should I just wait until this is all sorted?

I will run all the malware tools again now.

Sorry, I am running the normal windows firewall and a router firewall (netopia) set at medium as anything higher will block internet traffic and limit to local network. I was using Spybot with teatimer but disabled it. Probably should uninstall? I have Kept the SUPERantispyware but it has found nothing.

Yes and No Bob. The answer is I had no reason to when I loaded them they worked fine for a long time. (although PP did just do a big update.) I did not even know this site existed before and had no reason to look. If I knew that my car was going to die after I started it I would call a mechanic. Before my prior disaster I had a perfecly (from my point of view)operating laptop. Spybot was a program that seemed to be ok. It is not running now and Part Poker has been uninstalled. Believe me had I known this was going to happen I would have found you sooner.

Hi everyone. I had an earlier thread that was closed over issues that have been resolved but the problem remains. I began after I had to reinstall everything with a rescue disc that completely wiped the hard drive and reinstalled XP I then added all critical updates. My problem is simple but finding the cause is not. I am using IE7 on XP. Getting pages to open in even a reasonable time is impossible. For example it takes 15 seconds to open basic Google as a home page and almost 45 seconds to get from there to here as a fully loaded page. I can navigate through here and most sites pretty quickly once there but if I click on a link or even go to a different bookmarked page I get the same slow browser speed. A lot of the time seems to be used searching for the page. In all other respects the PC actually a 3 year old Toshiba laptop, is working fine. In order to save time I am going to list what I know not to be the problem or solution. There is no malware or virus based upon 3 different malware scans (2 suggested here) and at various times 4 different virus scans. I tried both Firefox and Safari and got the same results. I have uninstalled both. It acts the same way in safe mode I have reset IE7 I have played with startup programs and applications per various suggestions with no improvement but probably missed something important that I just didn’t understand. I can download a program at very acceptable speed. For example the The ATF Cleaner downloaded quickly once I actually got to the download page. Fixing this has now become a crusade and I am far to old for crusades. Any suggestions will be gratefully received. Thanks PS current Hijack this log below. Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Apoint2K\Apoint.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\system32\ZoomingHook.exe C:\WINDOWS\system32\TPSMain.exe C:\Program Files\Toshiba\Tvs\TvsTray.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\system32\hkcmd.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Apoint2K\Apntex.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\TPSBattM.exe C:\WINDOWS\system32\RAMASST.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.254/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [sVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe O4 - HKLM\..\Run: [TPSMain] TPSMain.exe O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6987 bytes

Thanks Goku. One last question. I am comfortable downloading avast again but is there any advantage to avira? Should I do this before or after I follow the instructions. I am going to follow the detailed instructions given yesterday. In my defence the first thing I did after getting online was update the Norton. I then used it to scan the files on the portable hard drive. I also have come to realise that there are reputable torrent providers whose torrents I have downloaded before without problems and there is also the occaisional jerk who must take pleasure in making others miserable. I should have realised that torrent just didnt look right. Also I never steal music or movies or games from anyone. Just the plain old ordinary free to air programs that don't get broadcast over here. I have already dumped party Poker but do want to download it again. There is an internet version and a program download. I suppose I could stick to just the internet if you think it may pose a problem. Many thanks and if there is nothing further to add in the next while or so I will get started.