[WaRe]

Widnows 2000
All updates
amd xp 1800
abit kr7a raid
3x 40 gig hds
gefore3 ti 500
1gig of ddr ram


For some reasont he last week my internet explorer keeps locking up in the middle of a webpage. When all these damn pop ups come up or anything. I ran scnadisk/defrage/antivirus and everything a few times thinking just a glitch but i ran out of ideas.

Any ideas??

Thanks
Dennis

[Styxx]

Internet Explorer 5.x/6.x comes with a repair tool. To use it, go to the Add/Remove Programs Control Panel; Scroll and click to highlight 'Microsoft Internet Explorer 5.x' in the Install/Uninstall window; Then click on the Add/Remove button; Select 'Repair' the current installation of Internet Explorer radio button; Click on OK.

***

*** Mandatory (get a firewall of any brand) - Get free Zone Alarm personal firewall anti-hacker countermeasure from http://www.zonelabs.com. (not the ZA Pro demo) 'Don't let anything out to the Internet you don't know what it is.' Or, get free Sygate personal firewall from http://www.pcworld.com/Downloads. Go to the Utilities' Security Section. Also please see http://www.firewallguide.com/ for more information on why all on-line home computers should be firewall enabled.

I apologise for stating something you already know.

[edsod]

Try also a pop-up stopper and opt out here:
http://www.technoerotica.net/mylog/optouts.html

[WaRe]

Did not work, the internet repair. It keeps locking up non stop and is getting frustrating...

I have tried to rerun my anti virus's and defrags.

I do use a firewall, Zonealarm, also i use popup killer too but some things just lock up regardless.

Any other ideas??

[Rollin' Rog]

Let's see what you have loading at startup. Start>Run, enter msinfo32 and click on Software Environment and Startup Programs. Then click Edit>Select All>Edit>copy and paste the copied text in a reply.

Hold da' phone, I spy...

1gig of ddr ram


http://support.microsoft.com/support.../Q253/9/12.ASP

[WaRe]

System Information report written at: 06/08/2002 09:54:04 PM
[Startup Programs]

Program Command User Name Location
ctfmon.exe ctfmon.exe DENNIS\Dennis HKU\S-1-5-21-789336058-2111687655-1343024091-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
5-2-104-20 c:\windows\5-2-104-20.exe -m DENNIS\Dennis HKU\S-1-5-21-789336058-2111687655-1343024091-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Synchronization Manager mobsync.exe /logon All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NvCplDaemon rundll32.exe nvqtwk,nvcpldaemon initialize All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTStartup c:\program files\creative\splash screen\cteaxspl.exe /run All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Jet Detection c:\program files\creative\sbaudigy\program\adgjdet.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV Agent d:\programs\norton~1\navapw32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NeroCheck c:\windows\system32\nerocheck.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CriticalUpdate c:\windows\system32\wucrtupd.exe -startup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdaptecDirectCD "c:\program files\adaptec\easy cd creator 5\directcd\directcd.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TPP Auto Loader c:\windows\tppaldr.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DownloadWare "c:\program files\downloadware\dw.exe" /h All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPDJ Taskbar Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winregsrv c:\windows\system32\winregsrv.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win Server c:\windows\winserv.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CMESys "c:\program files\common files\cmeii\cmesys.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nwiz nwiz.exe /install All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
InstantAccess c:\progra~1\textbr~1.0\bin\instan~1.exe /h All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RegisterDropHandler c:\progra~1\textbr~1.0\bin\regist~1.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SaveNow c:\program files\savenow\savenow.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MediaLoads Installer "c:\program files\downloadware\dw.exe" /h All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
New.net Startup rundll32 c:\progra~1\newdot~1\newdot~1.dll,newdotnetstartup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win Server Updt c:\windows\wupdt.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

[WaRe]

Here is a simple picture of it

[Rollin' Rog]

Lordie no wonder you are freezing up. I don't know why NAV is sleeping on the job, but you definitely have a trojan...



winregsrv c:\windows\system32\winregsrv.exe All Users

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win Server c:\windows\winserv.exe All Users

As well as a slew of advertising and spy ware.

1 -- Let's start with the basics. {editremoved instructions concerning msconfig, you don't have that in 2k} Go to Add/Remove programs and remove, one at a time, rebooting after each removal

New.net
SaveNow

2 -- Then install and run Ad-Aware following these directions:

Installing and Running Ad-Aware
http://www.lavasoft.nu/

1. Download to a convenient folder the installation file:

http://www.wyvernworks.com/Lavasoft/aaw.exe

2. Download the Refupdate installation file:

http://www.jamcomputerservices.com/l.../refupdate.exe

3. Run the Ad-Aware setup file (aaw.exe) to install Ad-aware and reboot.

4. Run the refupdate.exe installation file. Go to Start Menu>Programs and find the Lavasoft Refupdate entry and run it. It will want a connection to the internet to check and update the current signature file. When that is complete. Run Ad-aware itself.

5. Configure Ad-aware to scan all drives on which you have installed programs, memory and registry. When the scan is complete, check all entries it finds, click "Backup" and then "Finish". Reboot afterwards.

===========

3 -- Install and run the 30 day trial of Moosoft Cleaner

http://www.moosoft.com/thecleaner/

4 -- edit I see you are running Win2k and posting in the wrong forum, so the Startup Log file that I wanted you to run will not work. But give me another look at your msinfo32 list of startups after you have finished the cleaning.

Also, if Moosoft doesn't pick up that Winserv infection, try Panda's online scan:

http://www.pandasoftware.com/activescan/

It seems to have worked for this guy:

http://forums.techguy.org/t82597/s.html

[WaRe]

System Information report written at: 06/09/2002 10:55:37 AM
[Startup Programs]

Program Command User Name Location
ctfmon.exe ctfmon.exe DENNIS\Dennis HKU\S-1-5-21-789336058-2111687655-1343024091-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
5-2-104-20 c:\windows\5-2-104-20.exe -m DENNIS\Dennis HKU\S-1-5-21-789336058-2111687655-1343024091-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Synchronization Manager mobsync.exe /logon All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NvCplDaemon rundll32.exe nvqtwk,nvcpldaemon initialize All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTStartup c:\program files\creative\splash screen\cteaxspl.exe /run All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Jet Detection c:\program files\creative\sbaudigy\program\adgjdet.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV Agent d:\programs\norton~1\navapw32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NeroCheck c:\windows\system32\nerocheck.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CriticalUpdate c:\windows\system32\wucrtupd.exe -startup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdaptecDirectCD "c:\program files\adaptec\easy cd creator 5\directcd\directcd.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TPP Auto Loader c:\windows\tppaldr.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPDJ Taskbar Utility c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winregsrv c:\windows\system32\winregsrv.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nwiz nwiz.exe /install All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
InstantAccess c:\progra~1\textbr~1.0\bin\instan~1.exe /h All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RegisterDropHandler c:\progra~1\textbr~1.0\bin\regist~1.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
New.net Startup rundll32 c:\progra~1\newdot~1\newdot~1.dll,newdotnetstartup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run








The cleaner did find a trojan. It was DBD i think.a client/server one. I am re running both those programs to just make sure. See naything else possibly wrong??

Is their a win2000 msconfig program out there?? because i know i got those stuff starting up that i dont want them to.

Well thank you alot rollin, you saved my livlly hood.


Dennis

[WaRe]

Here is a picture of it in short

[Rollin' Rog]

Well that does look a lot better. You still have New.net though and that should be removed through Add/Remove programs

Just so you know what it is...

http://www.cexx.org/newnet.htm

And this suspicious entry remains:

winregsrv c:\windows\system32\winregsrv.exe All Users

I can't find any info on winregsrv

Can you do a Find Files search for it, then right click and select Properties>Version? Is there any copyright info?

You might check out this program and see if it fits your needs. I don't really have much experience helping Win2k folkes, there might be better stuff around.

http://www.mlin.net/StartupCPL.shtml

[Dr Dave]

When these things started happening did you think to resort to your "System Restore" to correct the problem or "GoBack" or
what ever system you use to revert your hardrive?

[Dr Dave]

Let "Panda" scan your computer and try to fix your problem, you don't have to register. Let me know what it found and what it fixed. Have a good day.
http://www.pandasoftware.com/activescan/com/

[WaRe]

winregsrv.exe info:

Version: 1.0.0.0
Internal Name: Update2
Original Filename: Update2.exe


That help??


It is located in c:\windows\sytem32

[WaRe]

That startup program is exactly what i was looking for. Works perfect and lets me take off all that other crap i dont need.

Here is an update on waht my startup looks like



System Information report written at: 06/09/2002 01:56:14 PM
[Startup Programs]

Program Command User Name Location
ctfmon.exe ctfmon.exe DENNIS\Dennis HKU\S-1-5-21-789336058-2111687655-1343024091-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Synchronization Manager mobsync.exe /logon All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV Agent d:\programs\norton~1\navapw32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdaptecDirectCD "c:\program files\adaptec\easy cd creator 5\directcd\directcd.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run





Thanks agian Rolling and Every one for helping me..



Dennis