Can't get on the Internet

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

0101

Thread Starter
Joined
Apr 20, 2004
Messages
3
From last few days, I haven't been able to get on the internet.

I have HP-8580C PC and Windows 98 Operating system. The following message comes after I get on the internet.

"This program is set to run in MS-DOS mode and cannot run while other programs are runnning. All other programs will close if you choose to continue." Then a pop-up window asks if I want to continue and I enter yes.

When I enter yes, nothing happens. This problems only happens if I get on the internet and not from any other applications running on the PC.

Please let me know how I can fix my PC?
 
Joined
Sep 8, 2003
Messages
1,457
Hi there 0101 ; This is a new one for me ?? But try this; go to your "SYSTEM TOOLS" and in "SYSTEM CONFIGURATION" click on the "TOOLS" tab. You will see Internet Exployer , click this , then click "REPAIR" . You will need to Re-boot after this is done.
What type of Internet connection do you use ??
Good Luck !!
 
Joined
Feb 16, 2002
Messages
540
New for me too,

A program running in DOS is controlling the outcome of your windows internet connection, and it's unkown?

Post a Hijack log to see if there is a trojan/virus operating here. Download this Hijack This, double click Hijackthis.exe to run, then click on 'scan'. After the scan, click on 'Save Log' , copy and paste that info in the forum, don't fix anything until it's reviewed first,

Also see if this applies to any programs your running: Dos Error Message

:)
 

0101

Thread Starter
Joined
Apr 20, 2004
Messages
3
starwaves77 said:
New for me too,

A program running in DOS is controlling the outcome of your windows internet connection, and it's unkown?

Post a Hijack log to see if there is a trojan/virus operating here. Download this Hijack This, double click Hijackthis.exe to run, then click on 'scan'. After the scan, click on 'Save Log' , copy and paste that info in the forum, don't fix anything until it's reviewed first,

Also see if this applies to any programs your running: Dos Error Message

:)
I tried the above, since did not see how to attach the above generated file, I am copying its contents below, please help

Logfile of HijackThis v1.97.7
Scan saved at 11:43:16 PM, on 4/21/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\WJVIEW.EXE
C:\WINDOWS\SYSTEM\RENCHF.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\WEBSAVINGSFROMEBATES\WEBSAVINGSFROMEBATES.EXE
C:\HIHACKVIRUS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/p/hp/?http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dial
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = www.prodigy.net;enroll.prodigy.net;enroll-isp.prodigy.net;
O2 - BHO: iWon BHO - {C298FB42-E3E2-11D3-ADCD-0050DAC24E8F} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\GSIM.DLL
O3 - Toolbar: i&Won Co-Pilot - {CA0B9B71-C2AF-11D3-B376-0800460222F0} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING
O4 - HKLM\..\Run: [VsEcomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\vsecomr.exe
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.Exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [BELT] C:\WINDOWS\BELT.exe
O4 - HKLM\..\Run: [WebSavingsfromEbates] wjview /cp:p "C:\Program Files\WebSavingsfromEbates\System\Code" Main lp: "C:\Program Files\WebSavingsfromEbates"
O4 - HKLM\..\Run: [renchf] C:\WINDOWS\SYSTEM\renchf.exe
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\RunServices: [McAfeeWebScanX] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.Exe /RUNSERVICES
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: RealGuide (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .pcm: C:\PROGRA~1\INTERN~1\PLUGINS\NpCurMem.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} (iWon Slot Machine) - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://download.iwon.com/ct/pm3/iwonpm_2_1,0,2,5.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {84431AB8-1869-11D4-885A-00104B215F34} (Linkzilla Control) - http://www.sivi.com/linkzilla/Lzilla.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/sbcy/yinst.cab
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FIX19105/flash.cab
 
Joined
Feb 16, 2002
Messages
540
101010,

Yes, you have some virus's/trojans.

First: download SPYBOT , after you install, run in the 'advanced mode' , click on 'search for updates' , install any it finds, then click on 'check for problems' , DELETE everything it lists & has checked in RED,

NEXT:

Run Hijack again, after the scan is finished, put a check in the box next to all the following, then click 'FIX':

C:\WINDOWS\SYSTEM\RENCHF.EXE

C:\PROGRAM FILES\WEBSAVINGSFROMEBATES\WEBSAVINGSFROMEBATES.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm


O2 - BHO: iWon BHO - {C298FB42-E3E2-11D3-ADCD-0050DAC24E8F} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL

O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL

O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\GSIM.DLL

O3 - Toolbar: i&Won Co-Pilot - {CA0B9B71-C2AF-11D3-B376-0800460222F0} - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL


O4 - HKLM\..\Run: [BELT] C:\WINDOWS\BELT.exe

O4 - HKLM\..\Run: [WebSavingsfromEbates] wjview /cp "C:\Program Files\WebSavingsfromEbates\System\Code" Main lp: "C:\Program Files\WebSavingsfromEbates"

O4 - HKLM\..\Run: [renchf]
C:\WINDOWS\SYSTEM\renchf.exe

O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm

O12 - Plugin for .pcm: C:\PROGRA~1\INTERN~1\PLUGINS\NpCurMem.dll

O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} (iWon Slot Machine) - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://download.iwon.com/ct/pm3/iwonpm_2_1,0,2,5.cab

O16 - DPF: {84431AB8-1869-11D4-885A-00104B215F34} (Linkzilla Control) - http://www.sivi.com/linkzilla/Lzilla.ocx

REBOOT IN SAFE MODE:
start pc, tap F8 key about once per second till you come to the black startup screen, choose 'safe mode' with your arrow keys and hit enter,

Click on start / find / files and folders
Now search for and delete all the following:

WEBSAVINGSFROMEBATES.EXE
RENCHF.EXE
IWONBAR.DLL
ebatesmoemoneymaker1.exe
miniinstaller.exe
saveinstwmcm.exe
iwon2ns.exe
iwonbar.dll
aornum.exe
i1srchas.dll

You may not find all of them, Spybot and Hijack will delete a lot of this, but keep in mind, these are remnants you don't want, if after using a combination of spyware removers & hijack this, they still exist, you have to remove them manually,

REMOVE THESE FOLDERS:
C:\Program Files\
ebates
iWon
Ornum

Uninstall 'iWon' using 'Add/Remove Programs' in the Control Panel. Look for 'iWon' , 'iWon Plus' , 'iWon EZ Setup'

And then look for 'eBates' or any variation of it, 'ebatesmoemoneymaker', , Remove it too,

-----------
Finish this off by running Ad Ware 6.0 , check the 'run in deep scan mode' , and proceed, delete everything it finds,

Then post another Hijack log,

PS..... I clicked on 'smartbotpro.com' in your Hijack log, and was regularly pounded with one of the ultimate spyware's out there, Passthison.com , trying to change my homepage,

:)
 

0101

Thread Starter
Joined
Apr 20, 2004
Messages
3
After trying the soulution suggested by starwaves77 this is my response. First of all when I ran SPYBOT it didn't give me the option to run in advanced mode. So I just ran SPYBOT and it didn't ask me to 'check for problems' or delete anything.

NEXT I ran Hijack and didn't find the following to fix:
C:\WINDOWS\SYSTEM\RENCHF.EXE

C:\PROGRAM FILES\WEBSAVINGSFROMEBATES\WEBSAVINGSFROMEBATES.EXE

O4 - HKLM\..\Run: [renchf]
C:\WINDOWS\SYSTEM\renchf.exe

O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} (iWon Slot Machine) - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

After click 'FIX' for everything other than listed above, I Rebootes in SAFE MODE. When PC cameup in safe mode, I couldn't find any of the following:
WEBSAVINGSFROMEBATES.EXE
RENCHF.EXE
IWONBAR.DLL
ebatesmoemoneymaker1.exe
miniinstaller.exe
saveinstwmcm.exe
iwon2ns.exe
iwonbar.dll
aornum.exe
i1srchas.dll

Also I could only find the folder for iWon and couldn't find folders for ebates or Ornum.

After than I uninstalled iWon and couldn't find eBates.

Then I ran Ad Ware 6.0 in 'run in deep scan mode' and attached is my log from that. I wasn't sure if I sould remove everything this log suggests and also if I need to remove the registry for the specified.

Please let me know what I should do next?
Here is the ad-aware6 log file attached. Please help????
 

Attachments

Joined
Feb 16, 2002
Messages
540
101,

Advanced mode in Spybot just adds a couple more options to work with but either mode lets you 'check for problems' , once you open Spybot you will see a tab for:
'check for problems'
'recovery'
'search for updates'
Press the one for 'check for problems' that begins the scan,

Advanced mode is accessed by clicking on 'mode' in top tool bar, but you don't need to use it,

Just uninstall your spybot (click start / programs / spybot /uninstall) and download this newer version, they just released it:

Spybot 1.3 rc 4

Begin the scan by clicking on 'check for problems' , when the scan is finished, delete everything listed in RED, with the red exclamation marks, there will be a lot, , , click on 'fix problems'

------------

The Adware 6.0 log is loaded with spyware, run it again, after the scan is finished, remove ALL that is listed in the scan, put a check in the box for everything it found, or 'right click in that results area and choose 'Select ALL Object' , click next ,
------

Post another hijack this log:

:)
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top