Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Still about:blank. Explorer.exe?


  • Please log in to reply
24 replies to this topic

#1 Mr Mint

Mr Mint

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 07 March 2005 - 12:26 PM

There's Windows 98 on drive C: and XP on drive D: in my laptop. XP is working, but it's too slow in this laptop. 98 is otherwise working fine, but the internet connection is not working (XP connection works). I have IE and Mozilla, but neither one is working. I only get the result "page cannot be displayed", and using the IE there's "C:/Windows.000/system/shdoclc.dll dnserror". I think my computer is actually trying to go to that address, all the time. Whatever I write in the address bar, it says that the page cannot be displayed, and there's the same error.

Mozilla don't give that error, but it says that the page is not found. When using Mozilla, I asked the source code (my system is in Finnish, so I'm not sure if this is correct English) of the page, and it said:

about:blank
<!Doctype html Public "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><title></title></head><body></body></html>

Does it make any sense to you?

I have used all kinds of anti-spyware methods, and followed the directions I have found from the reliable forums, what to delete and what not to. I used Hijack This, SpyBot, CWShredder etc. They don't find anything. (I can still post you the logs if you want.) I have also used LSPfix, WinsockFix, Win98Fix, DLLCompare, and StartDrecker and they all do their thing without giving failures. The last thing I tried was Pandasoftware's Active Scan: it took more than 14 hours, and still wasn't quite finished. However, it found something the others didn't. I removed these objects using the D: drive. (I don't know if it was ok or not to do that.)

But the Active Scan gave news about D:\Windows\system\explorer.exe. However, this was in the "disinfected" section.

Somehow I got interested in this explorer.exe. I realized that it's always running when I'm using the 98. I couldn't disconnect it when I tried. The I found information in the net that it can also be a virus in disguise. Though I know that there's supposed to be one explorer.exe in the windows folder.

So I ran a search on explorer.exe. Results:

EXPLORER.EXE C:\WINDOWS.000
Explorer.exe D:\WINDOWS
Explorer.exe D:\Win98\Win98_40.cab
EXPLORER.EXE-02121B1A.pf D:\WINDOWS\Prefetch
EXPLORER.EXE-2FDD75C9.pf D:\WINDOWS\Prefetch

Do you think they all should be there?

I think at this point it would be easiest to reinstall. In this case, should I reinstall both drives? Can the D: affect the C:?

I tried to use MSinfo32 to see, if the Winsock was corrupted or not. This didn't work, because I tried to find "protocol" after expanding "components" and "network", but there was only "winsock" there, and there wasn't any sections inside it (MSAFD [TCP/IP] etc.]. Could I find them somewhere else? But note, that at least WinsockFix didn't say that something was wrong.

Also, I tried to run IPconfig/release and renew, but then the computer said that the path is incorrect or some part is missing. Same thing happened, when I tried to run: netsh int ip reset C:\resetlog.txt. It COULD be that I managed to delete something important right at the start of my cleaning project. In this case, is there any other chance than to reinstall? When I tried to fix the IE, it did it and said that nothing was wrong. BUT, it's giving the same page as always, and so is Mozilla.

My theory is that this Explorer.exe has something to do with this. I could try to run Active Scan once more, but it could take something like 24 hours. And some extra information: Pandasoftware scan found also these, which I think are playing a crucial role in this:

Operating system: Vorofer.A (Which is a Trojan. How to remove this? Manually?)

Windows Registry: Powerscan (Or this? Manually?)

C:Windows.000\Downloaded program files\CON... (Istbar. I had it before. Could this be one of those unknown activeclass-components in the folder? There were two of those, according to the Active Scan. Removal? Manually?)

C:Windows.000\Downloaded program files\Eve (I-search.us. Same questions as above.)

There's one more very suspicious thing/folder in the registry. It's called "sais", and when I opened it it was justa weird red and blue symbols.

Ah, and one more thing: when I used StartDrecker, there was this one running process "rundll32 in c:\windows.000\vihjest.txt dllgetclassobject." I changed its name, and it fixed many problems, except the connection.

If you think I'd better give up, please tell me. But please, tell me also everything you know about this first.

If someone knows at least something, please tell me. Convince me that it's beyond my reach, so I can reinstall!

Thanks! I can tell you it's been quite crazy for me for over a week now!

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 08 March 2005 - 01:09 PM

All those explorer.exe's are fine. You are right that \windows\system\explorer.exe is not valid though and should be removed, but that does not seem to exist. If you want, post a HJT log and I will take a quick look at it and see if anything pops up.

#3 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 08 March 2005 - 05:57 PM

Thanks for answering!

I have done many things after I posted the first message. I ran the Housecall scan, and followed their advice deleting lots of stuff from e.g. the registry. My XP IE stopped working: it opens, says that it has to be closed, and then it closes. Note that there are "files missing". However, I moved Mozilla Firefox from the C: drive, and it's working perfectly! There ain't any pop-ups or ads, but of course I'm not sure if everything's fixed. Well, definitely not, since the IE is not working! There's an Armor2Net firewall trial version now on C: What could be the best free software firewall for bot the C: and D:?

And right when I ran Hijack This on C:, I saw that there's this thing called TPP Autolauncher, which may be the root of all my persisting problems. I did a search on Google, and it was said that it is Spyware. And what is that 02 BHO (no name) thing? It has been there all the time. Too bad, I'm quite sure that I've already caused some irreparable damage to this computer. Still, it would be great, if you could take a look at these, and probably teach me a lesson.

Here are my two Hijack This logs, first for D: and XP, second for C: and 98:

1)

Logfile of HijackThis v1.99.1
Scan saved at 5:40:49, on 8.3.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
C:\Ohjelmatiedostot\Mozilla Firefox\firefox.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Documents and Settings\Jenni\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {DB92BAA3-E66C-4D15-916E-B1FC016360ED} - D:\WINDOWS\System32\epnecba.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell.dll /c /set
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: ThinkPad Modem Copyright.lnk = D:\WINDOWS\MWW32\manager\mwcpyrt.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O19 - User stylesheet: (file missing)
O20 - AppInit_DLLs: d:\windows\system32\ctldgg.dll
O23 - Service: ThinkPad Modem Service (ThinkPadModemService) - IBM Corporation - D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE


2)

Logfile of HijackThis v1.99.1
Scan saved at 14:19:46, on 8.3.2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMA32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMB32.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\WINDOWS.000\SYSTEM\IRMON.EXE
C:\WINDOWS.000\TPPALDR.EXE
C:\OHJELMATIEDOSTOT\IOMEGA HOTBURN\AUTOLAUNCH.EXE
C:\WINDOWS.000\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\GRISOFT\AVG FREE\AVGCC.EXE
C:\OHJELMATIEDOSTOT\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSM32.EXE
C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\ARMOR2NET.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS.000\TYöPöYTä\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\ohjelmatiedostot\google\googletoolbar2.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: A2NPopUpKiller Class - {8A321C7D-9CED-45A8-870D-DAE843A45FD0} - C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\POPUPKILLER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\ohjelmatiedostot\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS.000\TPPALDR.EXE
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Ohjelmatiedostot\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [UW3TgsZ] C:\TQQWNU.EXE
O4 - HKLM\..\Run: [SpyHunter] C:\OHJELMATIEDOSTOT\ENIGMA SOFTWARE GROUP\SPYHUNTER\SPYHUNTER.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS.000\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\OHJELM~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\OHJELM~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [ARMOR2NET] C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\Armor2net.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSMA32.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: PowerReg SchedulerV2.exe
O8 - Extra context menu item: &Google Search - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm

#4 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 09 March 2005 - 01:15 AM

For the first log:

Print out these instructions and then close all windows including Internet Explorer.

Then I want you to fix some of those entries. Please do the following:

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:


O19 - User stylesheet: (file missing)
O20 - AppInit_DLLs: d:\windows\system32\ctldgg.dll

Reboot your computer into Safe Mode

Then delete these files or directories (Do not be concerned if they do not exist)


d:\windows\system32\ctldgg.dll

Reboot your computer to go back to normal mode and post a new log.


For the second log:

Print out these instructions and then close all windows including Internet Explorer.

Then I want you to fix some of those entries. Please do the following:

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:

O4 - HKLM\..\Run: [UW3TgsZ] C:\TQQWNU.EXE
O4 - Startup: PowerReg SchedulerV2.exe

Reboot your computer into Safe Mode

Then delete these files or directories (Do not be concerned if they do not exist)

C:\TQQWNU.EXE


Reboot your computer to go back to normal mode and post a new log.

#5 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 09 March 2005 - 08:11 PM

Here are the logs!

1)

Logfile of HijackThis v1.99.1
Scan saved at 16:58:05, on 9.3.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
D:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Documents and Settings\Jenni\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {DB92BAA3-E66C-4D15-916E-B1FC016360ED} - D:\WINDOWS\System32\epnecba.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell.dll /c /set
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: ThinkPad Modem Copyright.lnk = D:\WINDOWS\MWW32\manager\mwcpyrt.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1110291134200
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: NavLogon - D:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - D:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: ThinkPad Modem Service (ThinkPadModemService) - IBM Corporation - D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE


2)

Logfile of HijackThis v1.99.1
Scan saved at 16:48:20, on 9.3.2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMA32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMB32.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\WINDOWS.000\SYSTEM\IRMON.EXE
C:\WINDOWS.000\TPPALDR.EXE
C:\OHJELMATIEDOSTOT\IOMEGA HOTBURN\AUTOLAUNCH.EXE
C:\WINDOWS.000\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\GRISOFT\AVG FREE\AVGCC.EXE
C:\OHJELMATIEDOSTOT\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSM32.EXE
C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\ARMOR2NET.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS.000\TYöPöYTä\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\ohjelmatiedostot\google\googletoolbar2.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: A2NPopUpKiller Class - {8A321C7D-9CED-45A8-870D-DAE843A45FD0} - C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\POPUPKILLER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\ohjelmatiedostot\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS.000\TPPALDR.EXE
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Ohjelmatiedostot\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\OHJELMATIEDOSTOT\ENIGMA SOFTWARE GROUP\SPYHUNTER\SPYHUNTER.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS.000\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\OHJELM~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\OHJELM~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [ARMOR2NET] C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\Armor2net.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSMA32.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &Google Search - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm


I installed Symantec to drive D:.

There was a problem when scanning the D: It said "Invalid procedure call or argument", when fixing the 020 - AppInit_DLLs. It's not there anymore, though. And I couldn't find those dll.files you asked anymore. Good thing?

I didn't try to start IE yet, just in case that would have screwed up something.

If you still have time to help, it's well appreciated here!

What about this TPP Autoloader?

#6 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 09 March 2005 - 11:19 PM

Heres info on the TPP Auto oader.

Second log is fine so no more from that quarter.

Do the following for the first log:

Download cwshredder 2.12 from here:

http://cwshredder.net/bin/CWShredder.exe

Run the file after it is downloaded and click on the fix button. Let it do its thing and when its done, even if it crashes.

When its done run hijackthis again post a new log

#7 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 10 March 2005 - 06:58 AM

Second log:

Logfile of HijackThis v1.99.1
Scan saved at 3:51:50, on 10.3.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
D:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
D:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
D:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Documents and Settings\Jenni\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {DB92BAA3-E66C-4D15-916E-B1FC016360ED} - D:\WINDOWS\System32\epnecba.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: ThinkPad Modem Copyright.lnk = D:\WINDOWS\MWW32\manager\mwcpyrt.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1110291134200
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: NavLogon - D:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - D:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: ThinkPad Modem Service (ThinkPadModemService) - IBM Corporation - D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE


CWShredder found and removed the following:

CWS.Loadbat



About the 98 Mozilla: it didn't work yet...I couldn't resist trying! I didn't try IE.

What do you have in store for me next? Thanks for helping!

#8 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 10 March 2005 - 04:01 PM

Fix these:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated)
O2 - BHO: (no name) - {DB92BAA3-E66C-4D15-916E-B1FC016360ED} - D:\WINDOWS\System32\epnecba.dll (file missing)

#9 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 10 March 2005 - 07:04 PM

Awesome! XP's IE is working! However, I think I'll use this Firefox instead from now on... But do you think my XP is now clean Aand safe to use? Million thanks anyway!

So what about the 98? The net connection is not working yet. Do you think there's still something going on there?

At this point, if I have to reinstall, is it safe to reinstall 98 only? Is it okay to transfer data from C: to D: before the reinstall, and then back afterwards?

If you think, there's no need to reinstall, I'm all ears.

Just in case, Hijack This log for C:

Logfile of HijackThis v1.99.1
Scan saved at 15:40:47, on 10.3.2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMA32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMB32.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\WINDOWS.000\SYSTEM\IRMON.EXE
C:\WINDOWS.000\TPPALDR.EXE
C:\OHJELMATIEDOSTOT\IOMEGA HOTBURN\AUTOLAUNCH.EXE
C:\WINDOWS.000\SYSTEM\QTTASK.EXE
C:\OHJELMATIEDOSTOT\GRISOFT\AVG FREE\AVGCC.EXE
C:\OHJELMATIEDOSTOT\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSM32.EXE
C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\ARMOR2NET.EXE
C:\OHJELMATIEDOSTOT\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS.000\TYöPöYTä\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\ohjelmatiedostot\google\googletoolbar2.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmatiedostot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: A2NPopUpKiller Class - {8A321C7D-9CED-45A8-870D-DAE843A45FD0} - C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\POPUPKILLER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\ohjelmatiedostot\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS.000\TPPALDR.EXE
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Ohjelmatiedostot\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\OHJELMATIEDOSTOT\ENIGMA SOFTWARE GROUP\SPYHUNTER\SPYHUNTER.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS.000\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\OHJELM~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\OHJELM~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [ARMOR2NET] C:\OHJELMATIEDOSTOT\ARMOR2NET\ARMOR2NET PERSONAL FIREWALL\Armor2net.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSMA32.EXE
O4 - Startup: Officen käynnistys.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &Google Search - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm


Thanks always!

#10 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 10 March 2005 - 11:52 PM

I wasnt done with the Win 98 machine yet :thumbsup: I just wanted to get rid of all the malware first.

Now please Download LSPFix from:

LSP-Fix

Run the program and check immediately press the finish button.

Then Reboot.

To see a tutorial on how to use this program click the link below:

Using LSP-Fix to remove LSP Spyware & Hijackers

Let us know if its better now (I know you tried it, but humor me )

#11 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 11 March 2005 - 07:56 AM

Cool!

Okay, I ran it, but it only said "repairs complete". I rebooted, but it didn't help. I mean, there were only zeros. Nothing was changed by it. When I tried it earlier, like earlier this week, it did something.

Edited by Mr Mint, 11 March 2005 - 11:51 AM.


#12 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 11 March 2005 - 12:32 PM

On the win98 box do this:

Open Internet Explorer. When it is open click on Tools and then Internet Options. Then click on the Connections tab and then press the Lan Settings button. Do you have it set to use a proxy server?

#13 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 12 March 2005 - 08:10 AM

Let's continue this tomorrow evening!

Thank you.

I checked out those settings. Only the uppermost box was checked, "automatically detected settings". Should it be?

Could it be that simple?

Unfortunately, now I have to run.

Edited by Mr Mint, 12 March 2005 - 08:42 AM.


#14 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:54 AM

Posted 12 March 2005 - 04:03 PM

I doubt its that, but you want to turn it off anyway

#15 Mr Mint

Mr Mint
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:54 AM

Posted 13 March 2005 - 05:48 PM

I turned off "automatically detected settings". It wasn't that.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users