1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Can't get on the Internet

Discussion in 'Earlier Versions of Windows' started by 0101, Apr 21, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. 0101

    0101 Thread Starter

    Joined:
    Apr 20, 2004
    Messages:
    3
    From last few days, I haven't been able to get on the internet.

    I have HP-8580C PC and Windows 98 Operating system. The following message comes after I get on the internet.

    "This program is set to run in MS-DOS mode and cannot run while other programs are runnning. All other programs will close if you choose to continue." Then a pop-up window asks if I want to continue and I enter yes.

    When I enter yes, nothing happens. This problems only happens if I get on the internet and not from any other applications running on the PC.

    Please let me know how I can fix my PC?
     
  2. Pacalis

    Pacalis

    Joined:
    Sep 8, 2003
    Messages:
    1,457
    Hi there 0101 ; This is a new one for me ?? But try this; go to your "SYSTEM TOOLS" and in "SYSTEM CONFIGURATION" click on the "TOOLS" tab. You will see Internet Exployer , click this , then click "REPAIR" . You will need to Re-boot after this is done.
    What type of Internet connection do you use ??
    Good Luck !!
     
  3. starwaves77

    starwaves77

    Joined:
    Feb 16, 2002
    Messages:
    540
    New for me too,

    A program running in DOS is controlling the outcome of your windows internet connection, and it's unkown?

    Post a Hijack log to see if there is a trojan/virus operating here. Download this Hijack This, double click Hijackthis.exe to run, then click on 'scan'. After the scan, click on 'Save Log' , copy and paste that info in the forum, don't fix anything until it's reviewed first,

    Also see if this applies to any programs your running: Dos Error Message

    :)
     
  4. 0101

    0101 Thread Starter

    Joined:
    Apr 20, 2004
    Messages:
    3
    I tried the above, since did not see how to attach the above generated file, I am copying its contents below, please help

    Logfile of HijackThis v1.97.7
    Scan saved at 11:43:16 PM, on 4/21/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
    C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WEBSCANX.EXE
    C:\WINDOWS\SYSTEM\MSGLOOP.EXE
    C:\WINDOWS\SYSTEM\MSG32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\WJVIEW.EXE
    C:\WINDOWS\SYSTEM\RENCHF.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\WEBSAVINGSFROMEBATES\WEBSAVINGSFROMEBATES.EXE
    C:\HIHACKVIRUS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/p/hp/?http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dial
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = www.prodigy.net;enroll.prodigy.net;enroll-isp.prodigy.net;
    O2 - BHO: iWon BHO - {C298FB42-E3E2-11D3-ADCD-0050DAC24E8F} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL
    O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL
    O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\GSIM.DLL
    O3 - Toolbar: i&Won Co-Pilot - {CA0B9B71-C2AF-11D3-B376-0800460222F0} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
    O4 - HKLM\..\Run: [VsEcomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\vsecomr.exe
    O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
    O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.Exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [BELT] C:\WINDOWS\BELT.exe
    O4 - HKLM\..\Run: [WebSavingsfromEbates] wjview /cp:p "C:\Program Files\WebSavingsfromEbates\System\Code" Main lp: "C:\Program Files\WebSavingsfromEbates"
    O4 - HKLM\..\Run: [renchf] C:\WINDOWS\SYSTEM\renchf.exe
    O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
    O4 - HKLM\..\RunServices: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.Exe /RUNSERVICES
    O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: RealGuide (HKLM)
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O12 - Plugin for .pcm: C:\PROGRA~1\INTERN~1\PLUGINS\NpCurMem.dll
    O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} (iWon Slot Machine) - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab
    O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://download.iwon.com/ct/pm3/iwonpm_2_1,0,2,5.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {84431AB8-1869-11D4-885A-00104B215F34} (Linkzilla Control) - http://www.sivi.com/linkzilla/Lzilla.ocx
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/sbcy/yinst.cab
    O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FIX19105/flash.cab
     
  5. starwaves77

    starwaves77

    Joined:
    Feb 16, 2002
    Messages:
    540
    101010,

    Yes, you have some virus's/trojans.

    First: download SPYBOT , after you install, run in the 'advanced mode' , click on 'search for updates' , install any it finds, then click on 'check for problems' , DELETE everything it lists & has checked in RED,

    NEXT:

    Run Hijack again, after the scan is finished, put a check in the box next to all the following, then click 'FIX':

    C:\WINDOWS\SYSTEM\RENCHF.EXE

    C:\PROGRAM FILES\WEBSAVINGSFROMEBATES\WEBSAVINGSFROMEBATES.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm


    O2 - BHO: iWon BHO - {C298FB42-E3E2-11D3-ADCD-0050DAC24E8F} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL

    O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL

    O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\GSIM.DLL

    O3 - Toolbar: i&Won Co-Pilot - {CA0B9B71-C2AF-11D3-B376-0800460222F0} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL


    O4 - HKLM\..\Run: [BELT] C:\WINDOWS\BELT.exe

    O4 - HKLM\..\Run: [WebSavingsfromEbates] wjview /cp "C:\Program Files\WebSavingsfromEbates\System\Code" Main lp: "C:\Program Files\WebSavingsfromEbates"

    O4 - HKLM\..\Run: [renchf]
    C:\WINDOWS\SYSTEM\renchf.exe

    O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm

    O12 - Plugin for .pcm: C:\PROGRA~1\INTERN~1\PLUGINS\NpCurMem.dll

    O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} (iWon Slot Machine) - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

    O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://download.iwon.com/ct/pm3/iwonpm_2_1,0,2,5.cab

    O16 - DPF: {84431AB8-1869-11D4-885A-00104B215F34} (Linkzilla Control) - http://www.sivi.com/linkzilla/Lzilla.ocx

    REBOOT IN SAFE MODE:
    start pc, tap F8 key about once per second till you come to the black startup screen, choose 'safe mode' with your arrow keys and hit enter,

    Click on start / find / files and folders
    Now search for and delete all the following:

    WEBSAVINGSFROMEBATES.EXE
    RENCHF.EXE
    IWONBAR.DLL
    ebatesmoemoneymaker1.exe
    miniinstaller.exe
    saveinstwmcm.exe
    iwon2ns.exe
    iwonbar.dll
    aornum.exe
    i1srchas.dll

    You may not find all of them, Spybot and Hijack will delete a lot of this, but keep in mind, these are remnants you don't want, if after using a combination of spyware removers & hijack this, they still exist, you have to remove them manually,

    REMOVE THESE FOLDERS:
    C:\Program Files\
    ebates
    iWon
    Ornum

    Uninstall 'iWon' using 'Add/Remove Programs' in the Control Panel. Look for 'iWon' , 'iWon Plus' , 'iWon EZ Setup'

    And then look for 'eBates' or any variation of it, 'ebatesmoemoneymaker', , Remove it too,

    -----------
    Finish this off by running Ad Ware 6.0 , check the 'run in deep scan mode' , and proceed, delete everything it finds,

    Then post another Hijack log,

    PS..... I clicked on 'smartbotpro.com' in your Hijack log, and was regularly pounded with one of the ultimate spyware's out there, Passthison.com , trying to change my homepage,

    :)
     
  6. 0101

    0101 Thread Starter

    Joined:
    Apr 20, 2004
    Messages:
    3
    After trying the soulution suggested by starwaves77 this is my response. First of all when I ran SPYBOT it didn't give me the option to run in advanced mode. So I just ran SPYBOT and it didn't ask me to 'check for problems' or delete anything.

    NEXT I ran Hijack and didn't find the following to fix:
    C:\WINDOWS\SYSTEM\RENCHF.EXE

    C:\PROGRAM FILES\WEBSAVINGSFROMEBATES\WEBSAVINGSFROMEBATES.EXE

    O4 - HKLM\..\Run: [renchf]
    C:\WINDOWS\SYSTEM\renchf.exe

    O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} (iWon Slot Machine) - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

    After click 'FIX' for everything other than listed above, I Rebootes in SAFE MODE. When PC cameup in safe mode, I couldn't find any of the following:
    WEBSAVINGSFROMEBATES.EXE
    RENCHF.EXE
    IWONBAR.DLL
    ebatesmoemoneymaker1.exe
    miniinstaller.exe
    saveinstwmcm.exe
    iwon2ns.exe
    iwonbar.dll
    aornum.exe
    i1srchas.dll

    Also I could only find the folder for iWon and couldn't find folders for ebates or Ornum.

    After than I uninstalled iWon and couldn't find eBates.

    Then I ran Ad Ware 6.0 in 'run in deep scan mode' and attached is my log from that. I wasn't sure if I sould remove everything this log suggests and also if I need to remove the registry for the specified.

    Please let me know what I should do next?
    Here is the ad-aware6 log file attached. Please help????
     

    Attached Files:

  7. starwaves77

    starwaves77

    Joined:
    Feb 16, 2002
    Messages:
    540
    101,

    Advanced mode in Spybot just adds a couple more options to work with but either mode lets you 'check for problems' , once you open Spybot you will see a tab for:
    'check for problems'
    'recovery'
    'search for updates'
    Press the one for 'check for problems' that begins the scan,

    Advanced mode is accessed by clicking on 'mode' in top tool bar, but you don't need to use it,

    Just uninstall your spybot (click start / programs / spybot /uninstall) and download this newer version, they just released it:

    Spybot 1.3 rc 4

    Begin the scan by clicking on 'check for problems' , when the scan is finished, delete everything listed in RED, with the red exclamation marks, there will be a lot, , , click on 'fix problems'

    ------------

    The Adware 6.0 log is loaded with spyware, run it again, after the scan is finished, remove ALL that is listed in the scan, put a check in the box for everything it found, or 'right click in that results area and choose 'Select ALL Object' , click next ,
    ------

    Post another hijack this log:

    :)
     
  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/222560

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice