What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help Removing Hijacker, Please

94 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
Here is the most current HJT log:

Logfile of HijackThis v1.98.2
Scan saved at 8:44:14 PM, on 9/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\jetsuite\jsdaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GetRight\getright.exe
C:\jetsuite\JETSTAT.EXE
c:\jetsuite\JSFMAN.EXE
C:\WINNT\System32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [PopNot] C:\Program Files\PopNot\PopNot.exe auto
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PNSetup] C:\Program Files\PopNot\PNSetup.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKCU\..\Run: [Lavasoft Adwatch] C:\Program Files\Lavasoft Ad-Aware\Ad-watch.exe /min
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Allow Site's Pop-&ups - file://C:\Program Files\PopNot\trustsite.script
O8 - Extra context menu item: Always &Kill this Pop-up - file://C:\Program Files\PopNot\blocksite.script
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…83/mcinsctl.cab
Post #47
I am so sorry it has taken me so long to get back to you. Hopefully we can get this cleaned up now.


Step#1

The reason I asked about those programs was to determine if they could have something to do with the hijack but you have had them too long for that
I have identified that Office file and it appears to be legit and YES the OS's when upgraded have half and half essentially.


Step#2

There is an alternate way of finding a hidden DLL, please do the following

These steps will produce a file in notepad that appears to contain gibberish. Please post it all back here.

1. Please Copy the contents of the quote box to Notepad.

Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
ren windows1.hiv windows.txt


2. Save the notepad file as *All Files* with the name the file Appinit.bat
on the Desktop.

3. Double-click on Appinit.bat

4. This will create a file on the desktop named windows.txt

5. Please post the entire contents of Windows.txt to this thread using 'Add Reply'.


Step#3

Fortunately I am familiar with that ISP so we should be able to get you back online.

You can do one of two things, 1) Go to Start > Control Panel > Network Setup Wizard and allow it to run but at the page that is marked: Select a connection method make sure you select either one computer connecting through the other or each connecting separately through the router. Name the computer, then follow the rest of the instructions 2) go to Start > Control Panel > Network Connections > right click on the connection and then choose status of the ethernet adapter. If the right click menu has enable at the top then click on that and do what it says. Then rightclick and choose properties of the LAN connection. A window with a box in the middle will open. (At this point you may need your XP CD). Under The Connection Uses the following the following need to be there: Client For Microsoft Networks, and QoS Packet Scheduler and Internet Protocol (TCP/IP). Choose Properties for each and the following should be in properties:
Client For Microsoft Networks - Windows Locator
QoS Packet Scheduler - nothing highlighter so no properties
Internet Protocol (TCP/IP) -
ON GENERAL TAB:1) Obtain An IP Address automatically
2) Obtain DNS Server Address automatically
Advanced Button: IP Setting> IP address: - DHCP Enabled (if nothing in
this box then Add- DHCP enabled
 in the upper box
3)Put a check mark in Autmatic Metric
Next Tab - DNS 1) boxes are both empty
2) put a check mark in Append Primary and Connection specific
DNS Suffixes and Append Parent Suffixes of the Primary
DNS Suffix
3) Put a check mark in Register this connection's addresses in DNS
Next Tab - WINS - box is empty
1) Make sure there is a check mark in Enable LMHOSTS
lookup
2) Under NetBios Setting - check mark in Default - Use NetBIOS
setting from the DHCP server etc…..

Next Tab - Options - 1) The box at top should have TCP/IP filtering in it
Highlight and click Properties - on window that opens: First
2) column - TCP ports - set to Permit All, second column
- UDP Ports - Permit All and third column - IP Protocols
- Permit All
3) NO check mark in Enable TCP/IP filtering in all adapters



ON NEXT TAB OF MAIN WINDOW - ALTERNATE CONFIGURATION > check mark in Automatic private IP address

Click OK

In LAN window choose Advanced tab - click Settings and see if you have the Windows Firewall enabled.

Click Closed

The three items I mentioned above are vital to the function of your internet connection. You need at least one client, one service and one protocol before the LAN can access the internet. If they are not there then you will need your XP CD to install them. It is possible that you may have to reset the router and let one computer connect directly to your ISP before letting the router connect again. These are minimum connections.

Click Closed.

Your IP address on the WAN side of your network ( to the outside world ) is [removed] which is the IP that you have received from your ISP. The IP addresses that start with 192 are the IP addresses of the computers set by the router and are the ones inside your home.



Step#4

Please post the Windows.txt and we'll hope it is as clean as your log is now and it's a matter of getting your husband back online. If you spoke with tech support they may be able to help you with the setup of the Internet IP addresses but won't deal with a router. If you have to reset the router you will have to start by plugging your computer directly into the modem as it was before you installed the router and setting it up before plugging the router back in to the connection

Good Luck!
Post #48
Here is the content of 'windows.txt: regf       Pugf hbin  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨ÿÿÿnk, `X˜;¢2Ä ÿÿÿÿ ÿÿÿÿÿÿÿÿ  x ÿÿÿÿ 0  )  Windows Èþÿÿskÿÿx x    ”     ì      !  €  !      #  €  #  ?          ?        ?             ÿÿÿÿÐÿÿÿvk  à   d DeviceNotSelectedTimeoutèÿÿÿ1 5  `å °å èå  ° Ðÿÿÿvk  €'   C GDIProcessHandleQuota T ðÿÿÿ9 0  `è àÿÿÿvk  `   o Spooler ðÿÿÿy e s Q u àÿÿÿvk  €   Y swapdisk °  @ p ¨ Ðÿÿÿvk  0   i TransmissionRetryTimeoutÐÿÿÿvk  €'   D USERProcessHandleQuotaa àÿÿÿ°  @ p ¨ Ø ÿÿÿÿØ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ_VÔïšy"áhA¦‹ ÄÜxò’° ýæ,@@ºz)4ͯVa˜0  ÿ÷ÿÿÿÚ KŒ Î4Èž˜Â”ƒ…løî8¿¾à{ûÿ;ǃûã÷ÿûóþßÿÿÿÿÿ¿ïúûÿ»ûÿ¿¿ÿýÿß~ûþÿý»ýŸÿÿÿÿÿÿÿÿûÿÿÿ÷ÿÿïÿÿßÿÿÿÿû¿{ÿÿÿ?ÿÿÿÿÿÿÿÿïÿï÷þû{÷ÿk¿û÷ÿýÿÿÿþûßÿÿïûÿ»³ïþ›ûÿÿÿÿ~ïv÷þÿÿÿÿo¿÷~÷ÿïÿÞÿÿÿÿßýïý¼ÿ÷ÿ÷ÿÿÿÿÿÿ¿½ÝýßwÿÿïÿÿüîÿÿÝÿþÿÿ¿ÿ¿þÿÿÿwþ÷ßÿwÿoÿ÷¿ÿïÿûßÝý÷¿ÿÿÿïï¿ßýýþ¿ÿï¿o~»»ûþ÷ÿ÷ÿþw÷ÿÿÿÿÿýÿÿÿû?ÿ{ÿÿÿÿÿÿÿÿû÷ÿþÿÿýÿýÿßûÿîÿÿÿïÿßþÿ¿ÿïï÷ÿßÿÿüßÿÿÿýÿÿÿÿÿÿÿßÿÿÿûþ»ÿ÷ïÿßÿÿÿÿÿÿýýÿ÷÷ûÿÿÿßÿÿÿÿÿûÿÿÿýÿÿÿÿÿÿÿÿþÿÿÿÿÿ÷ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ!ÿgÿÿÿÿÿÿÿÿÿÿßÿÿÿÿo€è Çÿÿÿÿÿÿoþöÿÿÿÿÿ¿üÿ¼þÿÿÿÿoÿÿßÿÿÿÿÿ÷þäwþÿÿÿÿÿoûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ;ÌÿÏÿÀŪÿÿÿÿÿÿúÿÿÿÿ
Post #49
I followed your instructions and my husband's computer is now again connected to the internet… BUT As soon as IE opened, a window popped up in the middle of the page. It is entitled Messenger Service The content is as follows: Message from SPYWARE ADVISORY to USER on 9/22/2004 9:20:34 AM Important alert message: Wednesday September 22 Your computer may be infected with unauthorized spyware programs Easy instructions to learn how to fix your computer: 1. Grab a pen and write down the website address www.spw3.com on a piece of paper. Keep it in a safe place 2. Open your Internet Explorer, Netscape or AOL web browser 3. Type the web site address www.spw3.com into the "address" box at the top of your web browser and press the "go" button TIP: DO NOT PRESS THE OK BUTTON BELOW UNTIL YOU WRITE DOWN WWW.SPW3.COM OR YOU WILL LOSE THIS WINDOW Am I being paranoid or is this another hijcking invitation? There is also a privacy report in the IE task bar, which I assume exists because I have customized the cookies, as per directions on a link from siggyz. Inside are the addy's of a couple of sites which have been blocked. I would also appreciate some instruction on how to "bullet proof" my husband's computer from future problems ( as much as possible). There is a particular site which he visits every day which on the surface appears quite benign but I am not sure that it really is. He's a hockey coach and visits www.omha.net to read the message board. I KNOW that the site is mainatined by OK staff, but I have no way of knowing whether something may have been embedded that they are not aware of. He has had problems before with bugs he has picked up and that site seems to be the only common denominator.
Post #50
Just in case we've had another problem, I decided to scan with HJT and post another log. I did not close IE because the only way to close the Messenger Window was to click 'ok', which I did not want to do. Rather I went into the Task Manager and shut down from there. The message window did not close, even though IE was already closed.

After re-boot, my husband'somputer is no longer connected to the Internet and I am getting the same DNS error message in IE .

I am POSITIVE that I followed your directions exactly. I will do it all again and see if I get the message window popping back up again. I will post my results here as soon as I am finished.

HJT log:

Logfile of HijackThis v1.98.2
Scan saved at 9:46:50 AM, on 9/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\PopNot\PopNot.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GetRight\getright.exe
C:\jetsuite\JETSTAT.EXE
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Webshots\WebshotsTray.exe
c:\jetsuite\jsdaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [PopNot] C:\Program Files\PopNot\PopNot.exe auto
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PNSetup] C:\Program Files\PopNot\PNSetup.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKCU\..\Run: [Lavasoft Adwatch] C:\Program Files\Lavasoft Ad-Aware\Ad-watch.exe /min
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Allow Site's Pop-&ups - file://C:\Program Files\PopNot\trustsite.script
O8 - Extra context menu item: Always &Kill this Pop-up - file://C:\Program Files\PopNot\blocksite.script
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…83/mcinsctl.cab
Post #51
When I went into Control panel/Network Connections, my "internet connection" was gone. It had been there previously and all of the settings which you directed me to check had been intact. The only connection visible after re-boot was 'Local Area Connection' device name: Winbond W89c940-Based…etc.

I clicked on 'create a new connection', which brough up the Connection Wizard. I chose 'set up my connection manually'.

I then chose 'connect using a broadband connection that is always on' as I have a Rogers high speed account (at least they CALL it high speed…:) )

The wizard informed me that my connection should already be configured and directed me to a help file which instructed me to click on the connection I want to repair. I clicked on 'Local Area Connection', then 'repair this connection', then got he following message: The following steps of the repair operation failed:

Renewing the IP address.

Please contact your network administrator or ISP.

Just for the sake of my own curiosity, I then unplugged my husband's computer from the router.

The status bar informed me that a network cable was unplugged ref: my Local Area Connection.

I then plugged my husband's computer directly into the Rogers modem and was advised that my Local Area Connection was now 'connected' - at a speed of 10.0 Mbps

I opened up IE and there was Yahoo, functioning normally.

I opened up the privacy report and saw the following:

'Websites with content on current page:

http://switch.atdmt.com/action/Yahoo_Fixed…age_ClientMedia - Blocked Cookie'

I don't know if that is significant or not.

Popnot, my popup blocker was resident and running and I received no further communication from Spyware Advisory.


I right clicked on 'Local Area Connection' and following are the properties listed:

1a.General:

Connect using Winbond W89C940-based Ethernet Adapter (generic)

1.a.1 Configure
General: Device Type: Network adapters
Manufacturer: Winbond Electronics Corp
Location: PCI bus 0, device 12, function 0
Device status: This device is working properly.

1.a.2 Driver
Driver Provider: Microsoft
Driver date: 7/1/2001
Driver version: 3.22.1402.1
Digital Signer: Microsoft XP Windows Publisher
Driver file: c:\winnt\system32\drivers\w940nd.sys

1.a.3 Resources
I/O range: 7C00 - 7C1f
IRQ - 12
no conflicts


1.b Authentication
1st box checked: Enable IEEE 802.1x authentication for this network
EAP type: Smart Card or other certificate

1.b.1 Properties

Box Checked - Smart card or Other Certificate Properties
Box Checked - Use a certiificate on this computer; use simple certificate selection

Box Checked - Validate server certificate

Trusted Root certificate Authorities - none checked


Box Checked - Authenticate as computer when computer information is available

1.c Advanced

Windows firewall not selected

I then unplugged my husband's computer from the Rogers modem, reconnected router to Rogers modem, reconnected husband's computer to router, unplugged router to reset and tried IE on husband's computer - no internet connection.

I then plugged husband's computer into the port which MY computer uses, just in case we had a bunch of blown ports (my computer is connecting just fine).

Again - no internet connection on husband's computer.

Router information:

We have a Linksys modem,model # BEFSR41, 4 ports.

There is a difference among active lights between my computer and my husband's.

Lights showing for my computer: Link/act, Full/col, 100

Light's showing for husband's computer: Link/acct only.

Just for the heck of it, I decided to run an HJT log while my husband's computer was plugged directly into the Rogers modem and after a normal reboot.

After the boot two strange things happened. I got a warning message from Popnot saying that it could not validate my registration (this has never happened before) and I got a popup window on my computer (WITHOUT opening IE) with the following message:



Message from WARNING TO YOU on 9/22/2004 10:56:39AM

NOTICE: your system is in danger

Get software that will stop all security threats and popups. GUARANTEED.
You can dounload it right now and be protected in 2 minutes. We even include software to clean the spyware you HAVE. The best software available, nobody beats our protection. Total peace of mind.
www.messagestomper.com
(Type this address into your browser before clicking OK.

I clicked the righthand 'x' to close and got a repeat of the first popup message from www.spw3.com, with the correct current time.

I clicked the righthand 'x' to close and the second popup disappeared.



Here is the HJT log:

Logfile of HijackThis v1.98.2
Scan saved at 11:10:57 AM, on 9/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
c:\jetsuite\jsdaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GetRight\getright.exe
C:\jetsuite\JETSTAT.EXE
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Webshots\WebshotsTray.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\jetsuite\JSFMAN.EXE
C:\WINNT\System32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [PopNot] C:\Program Files\PopNot\PopNot.exe auto
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PNSetup] C:\Program Files\PopNot\PNSetup.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKCU\..\Run: [Lavasoft Adwatch] C:\Program Files\Lavasoft Ad-Aware\Ad-watch.exe /min
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Allow Site's Pop-&ups; - file://C:\Program Files\PopNot\trustsite.script
O8 - Extra context menu item: Always &Kill; this Pop-up - file://C:\Program Files\PopNot\blocksite.script
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…83/mcinsctl.cab

I next opened up IE on my husband's computer and went to various sites, just to provethat I was actually using a REAL IE. Worked fine.

I next shut down my husband's computer, unplugged it from the Rogers modem, plugged it back into the router, did the whole reset operation and tried to access the Internet.

Popnot loaded normally, no 'messages'…and no internet connection.

I see three consistencies:

1. Hubby's computer appears not to be able to connect to the internet when it is plugged into the router, even though the router seems to be functioning OK.
2. When Hubby's computer is plugged directly into the Rogers modem, it CAN connect but then the warning messages pop up.
3. Whether plugged into router or Rogers' modem, the task bar indicates that there is a Local Area Connection and the speed is 10mbps.


When I do an IP config with hubby's computer connected to router, I get this:

Ethernet Adapter Local Area Connection:

Connection specific DNS suffix: blank
Autoconfiguration IP address: 169.254.231.61
Subnet mask: 255.255.0.0
Default gateway: blank

When I do an IP config with hubby's computer connected directly to Rogers' modem, I get this:

Ethernet Adapter Local Area Connection

Connection-specific DNS suffix: pr.phub.net.cable.rogers.com
IP address:[removed]
Subnet mask: 255.255.255.0
Default gateway: [removed]

Network Connection Details:
Physical address: 00-40-95-04-4f-85
IP address: [removed]
Subnet mask: 255.255.255.0
Default gateway: [removed]
DHCP server: [removed]
Lease obtained: 9/22/2004
Lease expires: 9/29/2004
DNS servers: [removed]
24.153.23.66
WINS server: blank

When I plug my hubby's computer into the Rogers' modem WITHOUT rebooting, I do not get any warning message popups after the connection to the internet is established.

If I reboot his computer while still connected directly to the Rogers' modem, my popnot encounters a problem but no warning messages.
My privacy report now contains 2 entries:

http://switch.atdmt.com/action/Yahoo_Fixed…age_ClientMedia - Blocked Cookie'
http://view.atdmt.com/NYC/view/yhxxxlbn002…t;wi.1;hi.1/01/ - Blocked cookie.

And just about now, if I were a drinking person, I'd be heading out top the local LCBO and getting a LARGE bottle of SOMETHING!
I don't know if anything that I have recorded here is of any use, but I have tried to put you at the computer with me to get an idea of what is happening.

I feel like one of those monkeys they say could reproduce Shakespeare if given enough time in a room full of typewriters…:)

Here is the final HJT log after I connected the computer to the Rogers' modem directly and then did a warm reboot in normal mode with the computer still connected to the Rogers' modem:

Logfile of HijackThis v1.98.2
Scan saved at 11:51:42 AM, on 9/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
c:\jetsuite\jsdaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\GetRight\getright.exe
C:\jetsuite\JETSTAT.EXE
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Webshots\WebshotsTray.exe
c:\jetsuite\JSFMAN.EXE
C:\WINNT\System32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [PopNot] C:\Program Files\PopNot\PopNot.exe auto
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PNSetup] C:\Program Files\PopNot\PNSetup.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKCU\..\Run: [Lavasoft Adwatch] C:\Program Files\Lavasoft Ad-Aware\Ad-watch.exe /min
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Allow Site's Pop-&ups; - file://C:\Program Files\PopNot\trustsite.script
O8 - Extra context menu item: Always &Kill; this Pop-up - file://C:\Program Files\PopNot\blocksite.script
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…83/mcinsctl.cab

I am wondering where those '017' entries are, though. They don't appear in any of these logs.

Through all of this my computer works correctly whether it is plugged into the router or the Rogers' modem.
Post #52
I have just completed a scan with AdAware-SE and it found 28 CoolWebSearch objects. I deleted them and saved the log file, which I wanted to post here. But my husband's CD drive now seems to be disabled. The only drives which are showing in Win Explorer are A & C. The light is on constantly on my D (CD ROM) drive but it is not appearing in the component list. I will atempt to find a 3-1/4 floppy to copy the Adaware log to and post here.
Post #53
Bearing in mind that I have NO idea what I am doing, I opened up the computer and looked to see if all the connections were secure. Then I inserted my XP disk into the CD drive and rebooted the computer and lo and behold - there was life. Here is the Adaware scan result: Lavasoft Ad-Aware Plus Build 1.02 Logfile created on:Wednesday, September 22, 2004 12:43:17 PM Using definitions file:SE1R7 06.09.2004 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch(TAC index:10):28 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Reffile status: ========================= Definitions File Loaded: Reference Number : SE1R7 06.09.2004 Internal build : 10 File location : C:\Program Files\Lavasoft\Ad-Aware SE Plus\defs.ref File size : 334604 Bytes Total size : 1062308 Bytes Signature data size : 1039594 Bytes Reference data size : 22202 Bytes Signatures total : 29277 Fingerprints total : 92 Fingerprints size : 4655 Bytes Target categories : 15 Target families : 545 (Requires Ad-Aware SE or higher) Memory + processor status: ========================== Number of processors : 1 Processor architecture : Intel Pentium Memory available:29 % Total physical memory:253432 kb Available physical memory:72596 kb Total page file size:621544 kb Available on page file:481160 kb Total virtual memory:2097024 kb Available virtual memory:2048188 kb OS:Microsoft Windows XP Professional Service Pack 1 (Build 2600) Ad-Aware Settings =========================== Set : Move deleted files to Recycle Bin Set : Safe mode (always request confirmation) Set : Don't log streams smaller than 0 Bytes Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan within archives Set : Scan my Hosts file Extended Ad-Aware Settings =========================== Set : Unload recognized processes & modules during scan Set : Ignore spanned files when scanning cab archives Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Block pop-ups aggressively Set : Load Ad-Watch minimized Set : Automatically select problematic objects in results lists Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Show splash screen Set : Backup current definitions file before updating Set : Play sound at scan completion if scan locates critical objects 9-22-2004 12:43:17 PM - Scan started. (ADS scan) Performing deep Scan and listing Alternate Data Streams… Setting back browser settings… ca_inoculateit Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» C: Drive supports Alternate Data Streams. Scanning and Enumerating ADS… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : dueyn Category : Data Miner Comment : Object : C:\WINNT\Approach.ini:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : qhmph Category : Data Miner Comment : Object : C:\WINNT\EventSystem.log:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : ajcro Category : Data Miner Comment : Object : C:\WINNT\MedCtrOC.log:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : tjvwi Category : Data Miner Comment : Object : C:\WINNT\MF_C421.lfa:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : lkgkk Category : Data Miner Comment : Object : C:\WINNT\MozillaUninstall.exe:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : wmruh Category : Data Miner Comment : Object : C:\WINNT\MSOPrefs.232:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : lroer Category : Data Miner Comment : Object : C:\WINNT\PCS6.LIC:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : ufvsu Category : Data Miner Comment : Object : C:\WINNT\PCS6.LIC:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : vkwmo Category : Data Miner Comment : Object : C:\WINNT\PCSPATS.DAT:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : olgzq Category : Data Miner Comment : Object : C:\WINNT\Prairie Wind.bmp:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : gmzel Category : Data Miner Comment : Object : C:\WINNT\QTFont.for:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : fsgtw Category : Data Miner Comment : Object : C:\WINNT\QTW.INI:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : rmskn Category : Data Miner Comment : Object : C:\WINNT\QTW.INI:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : lhwiv Category : Data Miner Comment : Object : C:\WINNT\regedit.exe:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : qmrms Category : Data Miner Comment : Object : C:\WINNT\RESULT.QTW:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : mmhzf Category : Data Miner Comment : Object : C:\WINNT\sdkpo32.dll:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : woskb Category : Data Miner Comment : Object : C:\WINNT\setupact.log:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : barzz Category : Data Miner Comment : Object : C:\WINNT\ST6UNST.EXE:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : uajmb Category : Data Miner Comment : Object : C:\WINNT\SYSINI.QTW:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : mturv Category : Data Miner Comment : Object : C:\WINNT\tl32v20.dll:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : tlfgu Category : Data Miner Comment : Object : C:\WINNT\tsoc.log:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : eumxx Category : Data Miner Comment : Object : C:\WINNT\twain.dll:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : lmxmw Category : Data Miner Comment : Object : C:\WINNT\twunk_16.exe:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : wnaek Category : Data Miner Comment : Object : C:\WINNT\uninstall-temp.exe:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : pcvym Category : Data Miner Comment : Object : C:\WINNT\vb.ini:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : pgwkc Category : Data Miner Comment : Object : C:\WINNT\Webshots.scr:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : hhhpe Category : Data Miner Comment : Object : C:\WINNT\wiadebug.log:\ CoolWebSearch Object Recognized! Type : Alternate Data Stream Data : aizcy Category : Data Miner Comment : Object : C:\WINNT\win.002:\ C: Enumerating detected ADS… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 28 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 28 1:42:29 PM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:59:11.436 Objects scanned:98005 Objects identified:28 Objects ignored:0 New critical objects:28
Post #54
Ok A few ideas from what you have told me. It is very helpful what you posted. Bookmark the following website for later and get the programs from there after we finish Shoot The Messenger, DComBobulator and Unplug N Pray and use them. Have a good read there is a ton of information on this website but right now lets try to get things back up and running http://www.grc.com/default.htm

I have a question: Are all the HJT logs from your husband's computer? I am assuming they are but now they are clean for now anyway. On your husband's computer:


Step#1

First of all let's make sure that you are rid of the CoolWWWebSearch Variant.

1. Please Download the most recent version of CWShredder, from CWShredder.exe Download into it's own folder.

2. Check for Updates

3. CLOSE ALL WINDOWS except CWShredder

4. Run the program by clicking 'fix' and letting it fix all CWS remnants.

5. REBOOT to finish the removal and clear memory.


Step#2

The messenger service that M$ includes with XP is for use on a large network for the Administrators to send messages to each computer on the LAN, it is a huge security hole for everyone else and needs to be disabled. It has nothing to do with MSN Messenger or any of the other Instant Messenger services. I think this is where the popup came from last time and is a major security issue. (This is instead of using the Shoot The Messenger above). Please go to Start>Control Panel >Administrative Tools>Services and open Services. On the Right hand side scroll down until you find Messenger. Right-click on Messenger and choose Properties. On the General Tab click on Stop. Then in the drop-down window above choose Disabled. Go to
LogOn tab Highlight each Profile in the window and choose Disable. Close out services and Administrative Tools.

Step#3

From the AdAware log I know where the infection is hiding (some of it anyway) and you need another tool to run to get rid of them.Please download the following tool to determine which system files have had Alternate Data Streams added to them.
ADS Spy. Check the properties of each result you receive for each file and then post the results back here so I can tell you what to remove because it does show good things too.


Step#4

Now to the router. Have you tried connecting your husband's computer with your cord - sometimes the cords get damaged and that is what kills the internet. I doubt that the website your husband visits daily is a problem because that website has a huge following. I think it is possible that there were ads placed on the pages though that could have caused the problem - it is always wise to be wary of ads you see on any website as they can embed themselves as you were thinking.

Did you try resinstalling the driver for his Ethernet card and building the connection from scratch with the settings I gave you in the last post? Those settings are for Rogers with a router.


Step#5

The privacy report is part of IE and those cookies are bad. Do you have IE-Spyad loaded? If IE is blocking bad entries then that is good. Once you have the computer back online and completely clean, then I'll give you recommendations for preventing this in the future. Many of the programs we use will also prevent the fix from working so I don't advise loading them until the computer is clean.

I would like you to disable the following programs while your husband is NOT connected(see below) to the internet and then do a new HJT scan without those programs:

The McAfee Software
The PopNot popup blocker
Ad Watch
JetSuite
GetRight

What you can do to disable them is use Spybot SD in Advanced Mode. Open Spybot SD choose Mode>Advanced at the top. Then at the bottom left choose Tools. On the right Put a check mark beside System Startup. Choose System Startup on the left menu . Now uncheck each of the programs above that show in the right panel.

REBOOT

SCAN with HijackThis (do NOT fix anything yet) and SAVE LOG.

Open Spybot SD again and go to Tools>System Startup and put a check mark back into the programs where you removed them

Close Spybot SD

POST the logfile here in this thread using 'Add Reply' to see if anything new shows up.

On your computer you can do the steps to remove messenger as above. I would also like an HJT scan from your computer to make sure that nothing has been transferred from your husbands BUT it would be better done at the end to keep the computer's straight.

Good Luck
Post #55
All scans, logs, etc have been from my husband's computer. I have sporadically run HJT on MY computer and found nothing unusual, based on my accrued knowledge from working with my husband's computer. I have run CW shredder (updated) and it has indicated that hubby's computer was completely clean. I watched the run-through and it found nothing. I have rebooted and disabled Messenger. Here are the results of the ADS scan. I couldn't find anything labelled 'properties'. Please let me know what else you need from ADS Spy, if anything. C:\WINNT\Approach.ini : dueyn (10240 bytes, MD5 061BEDE403B694ECABD74A11E5066410) C:\WINNT\Approach.ini : eueiz (10889 bytes, MD5 B991E74BBA4E88D94A245CD95DB32211) C:\WINNT\BestSol.ini : wuxep (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\EventSystem.log : qhmph (10240 bytes, MD5 061BEDE403B694ECABD74A11E5066410) C:\WINNT\FaxSetup.log : iiecb (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\Kyor.ini : hspoy (93812 bytes, MD5 5AC22477AC03DDE331D7840248B3D1D1) C:\WINNT\lunin10.exe : noyla (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\MedCtrOC.log : ajcro (11591 bytes, MD5 7574ECEBED42A2C540F7C82B27615412) C:\WINNT\MF_C421.lfa : tjvwi (11591 bytes, MD5 7574ECEBED42A2C540F7C82B27615412) C:\WINNT\MozillaUninstall.exe : lkgkk (3063 bytes, MD5 D4EE4258D1CD45D155A4462F95CF8D14) C:\WINNT\msdfmap.ini : nvwek (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\MSOPrefs.232 : wmruh (56832 bytes, MD5 97D38F0B73B2ACB62F17955F1CE66B1F) C:\WINNT\muisetup.log : ypzph (94050 bytes, MD5 DC1A4D16D56F04F020DE1762E93EA31F) C:\WINNT\notepad.exe : obwjh (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\ntdtcsetup.log : jqcid (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\PCS6.LIC : lroer (10240 bytes, MD5 061BEDE403B694ECABD74A11E5066410) C:\WINNT\PCS6.LIC : ufvsu (56832 bytes, MD5 97D38F0B73B2ACB62F17955F1CE66B1F) C:\WINNT\PCSPATS.DAT : vkwmo (11591 bytes, MD5 7574ECEBED42A2C540F7C82B27615412) C:\WINNT\Prairie Wind.bmp : olgzq (11388 bytes, MD5 67AAB077A24C5C189EB6265910922C54) C:\WINNT\QTFont.for : gmzel (3063 bytes, MD5 D4EE4258D1CD45D155A4462F95CF8D14) C:\WINNT\QTW.INI : fsgtw (11591 bytes, MD5 7574ECEBED42A2C540F7C82B27615412) C:\WINNT\QTW.INI : rmskn (56832 bytes, MD5 97D38F0B73B2ACB62F17955F1CE66B1F) C:\WINNT\regedit.exe : lhwiv (10240 bytes, MD5 061BEDE403B694ECABD74A11E5066410) C:\WINNT\RESULT.QTW : qmrms (3063 bytes, MD5 D4EE4258D1CD45D155A4462F95CF8D14) C:\WINNT\sdkpo32.dll : mmhzf (11388 bytes, MD5 67AAB077A24C5C189EB6265910922C54) C:\WINNT\setupact.log : gyvji (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\setupact.log : woskb (56832 bytes, MD5 97D38F0B73B2ACB62F17955F1CE66B1F) C:\WINNT\ST6UNST.EXE : barzz (11591 bytes, MD5 7574ECEBED42A2C540F7C82B27615412) C:\WINNT\SYSINI.QTW : uajmb (11388 bytes, MD5 67AAB077A24C5C189EB6265910922C54) C:\WINNT\tl32v20.dll : mturv (3063 bytes, MD5 D4EE4258D1CD45D155A4462F95CF8D14) C:\WINNT\tsoc.log : tlfgu (11591 bytes, MD5 7574ECEBED42A2C540F7C82B27615412) C:\WINNT\twain.dll : eumxx (56832 bytes, MD5 97D38F0B73B2ACB62F17955F1CE66B1F) C:\WINNT\twunk_16.exe : lmxmw (11388 bytes, MD5 67AAB077A24C5C189EB6265910922C54) C:\WINNT\uninstall-temp.exe : vqvnf (10889 bytes, MD5 B991E74BBA4E88D94A245CD95DB32211) C:\WINNT\uninstall-temp.exe : wnaek (11388 bytes, MD5 67AAB077A24C5C189EB6265910922C54) C:\WINNT\vb.ini : pcvym (10240 bytes, MD5 061BEDE403B694ECABD74A11E5066410) C:\WINNT\vmmreg32.dll : gkyyb (27232 bytes, MD5 8BE20EAED0EE86AA7D3E786E76D008A2) C:\WINNT\Webshots.scr : pgwkc (11388 bytes, MD5 67AAB077A24C5C189EB6265910922C54) C:\WINNT\WebshotsUninstall.exe : cygti (93772 bytes, MD5 F1370D196DDC9DAC274E5B1B1DE2D078) C:\WINNT\wiadebug.log : hhhpe (3063 bytes, MD5 D4EE4258D1CD45D155A4462F95CF8D14) C:\WINNT\win.002 : aizcy (56832 bytes, MD5 97D38F0B73B2ACB62F17955F1CE66B1F)
Post #56
I have checked the cables on both my husband's and my computer and both are working fine.

I will delete the current internet connection on my husband's computer and rebuild it from scratch. It makes sense that it may have become corrupted during all of this activity.

I have disabled Messenger on MY computer.

I have disabled the startups you requested with Spybot S&D and have run a new HJT scan.

Here are the results:

Logfile of HijackThis v1.98.2
Scan saved at 8:56:13 PM, on 9/23/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\PopNot\PopNot.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Webshots\WebshotsTray.exe
c:\jetsuite\jsdaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PopNot] C:\Program Files\PopNot\PopNot.exe auto
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DllCmd32.lnk.disabled
O4 - Global Startup: GetRight - Tray Icon.lnk.disabled
O4 - Global Startup: HP LaserJet 3100 Status.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Allow Site's Pop-&ups - file://C:\Program Files\PopNot\trustsite.script
O8 - Extra context menu item: Always &Kill this Pop-up - file://C:\Program Files\PopNot\blocksite.script
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…83/mcinsctl.cab
Post #57
Ok you can re-enable those programs now, I was wondering if they were blocking some malware that was hiding, that is why I had you stop them. Unfortunately it is not showing anything and the log appears clean.

Were you able to rebuild the Internet connection? I would like to know this before we go any farther.

If you have internet access I suggest that you go to PCPitstop and/or
Belarc for a complete scan of the computer as they test more info about the computer in general than the tools i have used. They also test the hardware.

Sorry it took me so long to respond to you
Post #58
I am attempting to rebuild the Internet connection but have become quite muddled. The options that I was given by the Setup wizard were as follows: 1. Connect to the Internet - connect to the Internet so you can brpwse the web and read email 2. Connect to the network at my workplace - connect to a business network (using dial-up or VPN) so you can work from home, etc. 3. Set up a home or small office network - connect to an existing home or small office network or set up a new one 4. Set up an advanced connection - connect directly to another computer using your serial, parallel, or infrared port or set up this computer so that another computer can connect to it. I selected #3 and went through the steps but still have no internet connection I tried to disable the current internet connection but after I set up the new one, just the old one was there and its staus was enabled but it still wasn't working. The message I got when I tried to open up IE was that he page that I requested wasn't available offline. This indicates to me that I am not connecting at all, even though the task bar shows a connection (still at 10Mbps). I really don't know what I'm doing at this end of the computer.
Post #59
Hi I can imagine you feel like you are going in circles. I suggest you do the following to get rid of the current connection (hopefully). Find the driver for your network card it may be on your Windows CD. or may already be loaded into windows.

Go to Start>Control Panel>System>Hardware>Device Manager when the device manager window opens highlight the network card connection and right click on it - you should have choices of :Update Drive, Disable, Uninstall, Scan for Hardware Changes, and Properties. Choose uninstall. Then reboot. After a few reboots windows should find the hardware again and give you the choice of what driver to install for it. If it asks, then point it to your Windows CD. It also may just find one on your hard drive. If it finds one on the hard drive, accept it because it is likely to be the most updated driver.

Once the hardware driver is reinstlled you should be able to rebuild the network information and internet connection. If you have to phone Rogers to get them to help set it up, make sure your husbands computer is plugged directly into the modem as they will need access to the computer by remote.

**Before doing anything copy my instructions to notepad and save it so you will have access to the settings from your computer**

Good Luck - you also may want to take a break for the night and relax until tomorrow.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI