View Full Version : Help...Trying to get XPhome to connect via my NTLcable
Hi,
I'm trying to get an XP home PC to connect to the internet,
using my NTL cable connection through the ethernet port.
But i am not used to the XP arrangement, and i am not
having much (any) success.
Would be grateful for any help offered ...................
Cheers, John :)
do you have a set top box or cable modem ?
What's the exact problem?
Do you have an ethernet cable between the pc and the modem? Disconnect it and go into Control Panel- Network Connections and see what it says next to "Local Area Connection"- should say "network cable unplugged" or smthg... then plug it in, what does it say then? Should say "Connected" or something.
Right click the connection and select Status, on the Support tab what are the first digits of the IP? something like 10, 192, 169, etc etc. Just the first two/three digits?
What make/model is the CM and what lights are on/flashing?
What type of cable are you using to connect (look for anything written on the plugs)?
Hi Kronas,
Its a cable modem, i'm using its ethernet port now
Cheers, John :)
__________________
Hi nffc ........
reading now .........
__________________
Ok, had a think,
i think i should start the XP machine then follow instructions.
This will mean that this machine will have to come off of the
cable modem,
but i can stay in touch using the ordinary telephone modem
does that sound ok to you guys ?
if you have a cable modem then power down the modem leave it off for five minutes, then simply plug the ethernet port in to the pc and modem, then power up the modem wait for 5 minuites again and you should be away surfing.
if not then something is wrong, if you cannot browse websites etc then use the wizard in internet explorer in tools - internet options - connections tab - setup.
And,
Why are my posts all coming in as little ADD-ONS
to earlier posts ????
That seems a bit odd to me ???
__________________
Hi Kronos,
That sounds easy,
and i will try it,
but first i will get this on line through the phone,
so as i can follow instructions properly.
OK ?
And,
Why are my posts all coming in as little ADD-ONS
to earlier posts ????
That seems a bit odd to me ???
its the way the forum is setup... if you keep adding bits to your post within a certain time it will add it to your last post.
read the instructions and follow them make sure you have your ntl password if it stops just reeboot it should continue ( says mark hopefully )
And,
Why are my posts all coming in as little ADD-ONS
to earlier posts ????
That seems a bit odd to me ???
It's one of Paul's home-made hacks to stop double-posting!
If you're using >1 pc to access the net chances are you're confusing the modem with the MAC addresses being different. Now you can make them the same but that's not the best option. Better than that are:
- rebooting the modem when you change PCs
- getting a router
Sadly you have provided little info on your actual set-up so there's little we can do to help you specifically...
Oh,
Okay ....
i can live with that,
never seen it before thats all.
probably see it lots now ...
you can go for classic view
looks just like me or 98
Well if its a home made hack,
then maybe i won't see it elsewhere ....
If it works then jolly good !!
I am just setting up the dial-up
on my laptop.
be back soon ..... i hope
some sort of problem with old laptop running k'meleon
can get to this site,
cant post.
try to type in letters,
browser goes bananas,
shuffling up and down then stopping
on a highlighted letter somewhere else on page,
that i am trying to put into reply box.
maybe try different laptop
Please excuse the delay.
i am very sorry about the delay.
This is the third laptop of trying so far.
The first had no serial port.
Yes, no serial port, and i only noticed when
i tried to plug in the Modem.
The next had a problem with its browser and
it was unbelievably slow.
This one aint much better,
running 98lite on an old 70 Megacycle Compaq laptop
with 16 MB of ram.
But it works, or seems to so far.
OK so my cable modem is now free to connect to the
XP home computer, usingan ethernet cable.
I will turn on the XP machine now.
and plug in the ethernet cable. OK ?
I will also attempt to post this and look through this thread
to see if i should post anything else.
The cable modem is an NTL cable modem.
The problem machine is a homebrew running XP home.
The problem machine has an ethernet card fitted,
its green lights come on when they should.
Anything you want to know, i will post straightaway.
John :)
__________________
switching on XP machine now
XP machine running.
Green lights flickering normal looking on NTL cable modem.
At back of XP machine little green light on ethernet card is flickering.
XP logo now moving around the screen,
i think this is some sort of screen saver thats kicked in.
I have worked through the instructions in the XP help,
but no success yet.
Please give me a clue what to do .......
__________________
just been reading back through this thread,
going to turn off my cable modem,
then wait 5 mins,
then turn it on again.
I will keep my fingers crossed, John :)
__________________
remembered the dock for the laptop with no serial port,
went and got it cos this laptop is a reasonable speed 500megs
and set up the dial up on this laptop.
I think its time to switch back on the cable modem,
and see how it goes.
__________________
03:15 AM
still no result from the XP machine,
but it does bring up a dial-up box asking for name and password,
i have filled these in, just in case it might use them to connect
via the ethernet card, but it doesn't.
Any suggestions ?
I am going to read back through this thread to see if there
is anything ive missed ......
__________________
03:35 Hrs AM.
kronas,
do you have a set top box or cable modem ?
Its a cable modem, small, silver plastic, from NTL
nffc,
What's the exact problem?
I've no idea. probably my lack of experience using XP.
I have no trouble with my other stuff running 98se.
Do you have an ethernet cable between the pc and the modem?
Yes, its an eight wire cable, and it works fine on my other stuff.
This cable is sound, i checked it earlier.
Disconnect it and go into Control Panel- Network Connections and see what it says next to "Local Area Connection"- should say "network cable unplugged" or smthg... then plug it in, what does it say then? Should say "Connected" or something.
Okay, i will do that now ....
__________________
03:45 Hrs AM.
Yes, it said
'Network cable unplugged'
in light grey letters.
Plugged it back in, then it said
'Enabled'
in light grey letters.
So i hope this means something .....
something positive i hope .....
__________________
03:59 Hrs AM.
Right click the connection and select Status, on the Support tab what are the first digits of the IP? something like 10, 192, 169, etc etc. Just the first two/three digits?
The first five digits are: 81.111
What make/model is the CM and what lights are on/flashing?
having a look now ........
04:00 Hrs AM.
Its assembled in Taiwan,
Model Number: 08004EU
Lights:
There are seven lights along its front: PWR,USB,ENET,U/S,SYNC,RDY
RDY and PWR are steady on lit. DNS is kinda flashing unevenly,
ENET is flickering fast for short bursts.
What type of cable are you using to connect (look for anything written on the plugs)?
Standard looking sort of cable, put together with those clear crimp-on
plugs, quite ordinary looking, 8-wire, works fine on my other stuff.
No writing on the plugs. Cable has manufacturers writing along it.
Hi markymoan,
read the instructions and follow them make sure you have your ntl password if it stops just reeboot it should continue ( says mark hopefully )
Yes, if you mean the instructions in the 'Help' on XP, there are (were)
two of us here, and we both read the instructions, very carefully, and
did exactly as instructed ... where possible. Yes i have my NTL password
but i dont know the name of the ISP. I am guessing that it is either
ntlworld, or ntlworld.com, or www.ntlworld.com. I have tried all of these
in conjunction with my username in its entirety including before and after
the @ sign, and also with it just the bit before the @ sign, cos i am not
sure which it wants. There are many combinations, and we covered them all
twice. I dunno where we went wrong. Maybe three or four times.
Hi nffc,
If you're using >1 pc to access the net chances are you're confusing the modem with the MAC addresses being different. Now you can make them the same but that's not the best option. Better than that are:
- rebooting the modem when you change PCs
- getting a router
Well, i do have >(more-than)1 PC set up as a small home network, but i am
not connecting the XP machine into it,
I am just using the XP machine alone on the cable modem ethernet point.
So briefly, no, the XP is on its own.
As to the modem retaining the previous MAC Address, which will be
different, i thought that switching the cable modem off fot a short time
then back on while plugged into the new device, would re-set the MAC
address. Maybe it did, but that didn't help.
Sadly you have provided little info on your actual set-up so there's little we can do to help you specifically...
Its a shambles. it is a nightmare trying to sort out anything here.
The set-up as applied to this XP machine is straightforward enough, cable
comes in the window frame, into some little fixing box, down to the NTL
cable modem, ethernet wire goes to XP machine. The XP machine is a
homebrew put together by someone i don't know, for a guy a few houses
along from me. He has a new one now, and he has given this one to my
friend. It has been in use for about a year, till the guy got a new one.
We are trying to set it up to get internet access. Sadly, unsuccessfully
so far.
If there is anything that you would like to know, i will post it right
away.
Hi markymoan,
you can go for classic view
looks just like me or 98
Yes, i was thinking of doing that, cos i am sort of used to 98,
it might help me handle it .....
__________________
04:50 Hrs AM.
Its getting a bit too late for me now, so i am going to go to bed,
maybe the new day will bring better luck.
Cheers, John :)
My you had a night and a half... :Yikes:
I hope you have got it sorted by now? :)
If you are getting a dial up connection dialog box appearing then you are not set up correctly in Internet Explorer properties. Make sure that in Internet Explorer, tools, Internet Options, connections, you are set to never dial a connection. Also check in your LAN settings in case a proxy is set.
When connecting to the SACM you need to power off the PC,
power off the SACM
Connect the ethernet cable to the SACM and PC
Reboot SACM
Allow all lights to settle and lock
Power up PC
Open browser.
Do you have a firewall running at all on the computer? Also do you have the Windows XP CD in case you need to clean install the OS?
Hi Incognitas,
Hi Paul,
Yes, it went on for a while,
but it seems to be working now.
In fact, it MAY have been working all along ....
but this desktop is a bit cluttered and we couldn'tell.
Anyway this XP home is now connecting, and we are trying to get used to it.
Can you explain how to put a 'Back' button along the top somewhere,
we have to 'start again' to go back a page ..........
Cheers, John :)
Internet Explorer? Should be able to right click the bar up the top where the other buttons are and then choose standard buttons as the back and forward arrows are part of the standard set.
Hi,
Thanks, after fiddling about, we found the bit to add toolbars,
it is in the dropdown under 'Tools' so we got the normal set now!
Anyway, now that my friends XP is running, i have put my little
network of three PCs back into the cable modem, and then my stuff wouldn't work.
So i thought, well, maybe the cable modem has adjusted itself
to the numbers in the XP machine, so maybe i should switch it off for
a little while, and try again !!!
Nope. So i tried my router off for a bit, Nope, then the router and the
cable modem, Nope, then the router and not the cable modem, Nope,
then my PCs and the cable modem - with the router on, Nope, Then
starting the router first, Nope, all these with five minute intervals ....
Then i kinda lost the plot .......
Just switched everything on, and guess what, all ok.
Could someone tell me ... what is the correct order of starting
the stuff up ?
And just for fun (to rub it in) i think my 40gig hard drive is failing,
i hope not but its giving trouble running scandisk, thats a bad sign.
Cheers, John :)
If everything is plugged in via the modem then you shouldn't have to switch anything off as the router controls the connection to the modem. You should be able to just plug in the computers to the router and then swithch the PCs on.
The order to switch things on normally is
SACM,
Wait for lights to settle,
Router,
Wait for lights to settle,
PCs.
If you are leaving the SACM and router switched on then there may be a problem with either the set up of the computers or the Router as the Router will keep the connection to the SACM live all the time.
Thanks for that Paul,
So its:
Cable Modem - wait for lights to settle,
Router - wait for lights to settle,
PCs.
Got that.
Thing is,
how can the C.M. 'adapt' itself to to a number in the router,
before the router is switched on ?
Or maybe ive got it wrong .....
John :)
It doesn't, your equipment MAC addresses (router etc) are stored against your account information, the SACM therefor knows of certain equipment that is registered against your account and will quite happily allow those to work.
A-ha,
a glimmer of light is emerging,
so the unit remembers the last device ??
Is that it?
maybe switching it off then on ... introduces a new device ??
It does something .....
__________________
No wait a mo,
you said 'account information',
so this info is at the far end (from me) of the cable connection ?
__________________
Anyway,
as this friend would like to use his XP occasionally on my cable,
i would prefer to 'take turns' with it rather than have another PC
on my little network.
So as "nffc" mentioned earlier,
it is possible to make the MAC addresses the same.
This i think would solve my minor network issues,
if we can alter the Mac address of the XP machine,
so its the same as my router,
then i think that should cover it.
Mind you - i dunno either of the addresses !!!
You can get the MAC address of the router from within the router normally ;)
What router make and model is it?
OK,
this little router is accessed using the browser, just like a web page.
I will have a look to find the MAC address now
__________________
trouble getting in,
dunno why, ive accessed it before plenty times ....
OK,
this little router is accessed using the browser, just like a web page.
I will have a look to find the MAC address now
__________________
trouble getting in,
dunno why, ive accessed it before plenty times ....
It's "sods law" ;) When you want to access it you forget the password or can't get in lol.
OK, found it.
For some unaccountable reason IE browser would not go in.
Got in using Mozilla.
Mac address is six pairs of hex numbers,
4C -..-..-..-..- E4
If you want it i will PM it to you , OK
OK, found it.
For some unaccountable reason IE browser would not go in.
Got in using Mozilla.
Mac address is six pairs of hex numbers,
4C -..-..-..-..- E4
If you want it i will PM it to you , OK
Yep looks about right, one thing to check is wether you have a proxy set in IE as it might stop you accessing the router unless you bypass it for local addressses.
__________________
To get the IP address of the computer all you need to do is
Start menu
Select Run
type
CMD
When the DOS window opens
typeipconfig /all
press enter.
Towards the bottom of the info that appears you will see a set of IP address info and a Physical Address, this Physical address is the MAC of the computer/ NIC card.
( i dunno what that means ! )
i haven't set any prohibitions on IE.
Thing is, we cant find the MAC address on this XP,
theres nithing in 'help' , no results .
Any ideas ?
__________________
nothing^
__________________
found this:
http://www.nthelp.com/NT6/change_mac_w2k.htm
Followed its instructions .......
hope its OK,
tried to change it to the router MAC number !!!
Still dont know what number it was !!
just been back checking,
found that extra bit on your last post,
and entered ipconfig in the dos box,
Yes, success, the number has changed to what we set it.
So, we will try the cable modem on it now.
Hopefully all will be well !!
Cheers, John :)
__________________
Hi,
on the XP machine now,
all seems well,
when its put back to my little network we'll see
if it just goes in ok. Should be fine.
Many thanks, John :)
just been back checking,
found that extra bit on your last post,
and entered ipconfig in the dos box,
Yes, success, the number has changed to what we set it.
So, we will try the cable modem on it now.
Hopefully all will be well !!
Cheers, John :)
__________________
Hi,
on the XP machine now,
all seems well,
when its put back to my little network we'll see
if it just goes in ok. Should be fine.
Many thanks, John :)
Always pays to read the full post lol ;)
Hi,
(later)
back on my little network now,
all is well.
We can now 'take turns' without problems!
Many thanks to you all, Kronas, nffc, markymoan, Incognitas, Paul,
Cheers, John :)
You're welcome, hooking extra PCs on a router is the easy way to share a connection but whatever works for you is fine ;)
Hi,
(later)
back on my little network now,
all is well.
We can now 'take turns' without problems!
Many thanks to you all, Kronas, nffc, markymoan, Incognitas, Paul,
Cheers, John :)
Ah I think the kudos should go to Paul..I know nothing about this subject..However I reckon Paul is up for the Most Helpful Thread award-AGAIN... ;)
Well, sharing your own stuff on a router is fine,
but i don't know what sites my friend visits,
or what state his PC is in,
so i'm afraid thats the way it is for the time being.
I don't think the cable modem can get any malware !
John :)
You should just try using this form of protection...
http://gallery.hd.org/_tn/std/bizarre/how-to-stop-computer-viruses-with-a-condom-on-the-modem-lead-ANON.jpg
Well, sharing your own stuff on a router is fine,
but i don't know what sites my friend visits,
or what state his PC is in,
so i'm afraid thats the way it is for the time being.
I don't think the cable modem can get any malware !
John :)
As long as your system is running AV, anti-spyware/ trojan software etc you should be fine. I'd make a point of asking him to run a spyware and virus sweep of his system if he wants to use your connection ;) If NTL sees any major virus activity on certain ports they can lock you out of your connection till it's cleaned.
Hi Paul,
I didn't know that NTL were actively watching customers connections.
We have indeed done many anti-malware 'sweeps' and cleared almost a
hundred 'major threats' from his machine, which now shows clean on
the 'sheild-guard' anti-virus which is on the machine, that came
with it. Ive never heard of it.
We have tried to get 'Trend Housecall' to run, that is one i am
familiar with, it doesn't just say '30 threats' (or similar),
Trend will actually list the malware by name. Much more sensible.
But it doesn't like the activeX settings on the XP machine, and
wont load. We have been to the 'Security' bit, and reset to minimum
just to load Trend, but it still wouldn't load. When we checked the
XP machine had put the settings back to where they were.
We concluded that maybe the previous owner had 'set' some sort
of parental controls so that the settings stayed high ..... well we
don't think he would have, but he may have got someone to do it
for him.
Meanwhile, he'll just have to 'take his turn' on the cable modem,
not perfect, but hey, its my cable so thats the way it is. :)
Regards, John :)
Hi,
I have been working on this XP machine on and off, for days now.
I think it has severe problems with infections.
Don't think there are any 'parental settings' in force on the
directX security settings.
Having trouble getting 'Housecall' to load, so much trouble that
i am starting to think the malware is actively preventing it from
loading.
Anyway, yesterday i managed to get the 'Euro Trend' to load and
run. It shows up about twenty three trojans, of various names.
Trying to show a pic ....
Sorry, no pic. The BMP and the JPG have been copied on to a floppy
from the XP machine, but they won't show up in my 98 machine, maybe
that is correct, maybe it isn't.
I would have thought that the paint program BMP on 98 would show a
BMP picture from the paint program copied using a floppy from the
XP machine. Maybe this is just another incompatibility that is new
to me.
They include:
REG NTRTKIT.A
DATEI.A
DLUCA.AG
DLUCA.GEN
DLUCA.A
DLUCA.B
and many similar.
So looks like i have some busy evenings ahead trying to clean up.
Regards, John :)
well, problems on this XP machine seem to have taken a turn for the worse.
It now directs Google to 127.0.0.0.1 (loopback), and as far as i can tell
everything else i try also gets directed to 127.0.0.0.1 (loopback),
EXCEPT of course the site which appears to be an 'adult' entertainment site,
which is called 'about: blank', yes, the same name you get when the browser
can't find it.
I have checked the hosts file, as i thought this may have been used to re-
direct the sites i am trying to get to, but no the hosts file is untouched.
I want to download 'Hi-Jack this' on to it, but it wont connect to anything.
So now i am thinking of putting 'Hi-Jack this' on to a floppy (or CD) to get
it on to the XP machine, but i don't know if the XP machine will read floppies
made on a 98se machine, it wont read my CDs that i do know.
So i spose i will try it with a floppy, and see how far i get ....
John
Check your add remove programs list for anything nasty, XP will read CD's burned on 98se so you can download a few tools and burn them onto CD and then install them to the infected PC.
You need to check for spyware, trojans etc and use hijackthis to check your settings.
Check your add remove programs list for anything nasty, XP will read CD's burned on 98se so you can download a few tools and burn them onto CD and then install them to the infected PC.
You need to check for spyware, trojans etc and use hijackthis to check your settings.
Should he be doing this in safe mode Paul? :erm:
Check your add remove programs list for anything nasty, XP will read CD's burned on 98se so you can download a few tools and burn them onto CD and then install them to the infected PC.
You need to check for spyware, trojans etc and use hijackthis to check your settings.
Should he be doing this in safe mode Paul? :erm:
It should work in either mode really, safe mode is better for more entrenched virus or trojan infection. I would try it after a normal boot up before running it in safe mode. :)
Hi Paul,
ok, will do, i will check the 'add/remove' for anything that looks suspicious.
As to reading CDs, well i will try again, but it hasn't been able to read the
ones i have tried up to now, ones that will read ok in other machines(98).
I suppose this might be a problem with the CD unit ...
I could try using the floppy for some of the stuff.
I will try to get 'Hi-Jack' on to the machine, somehow.
Hi Incognitas,
I haven't figured out how to get into 'Safe-Mode' yet.
Its different from the 98 i'm used to ....
John :)
Do you have any software that you use to burn the CDs? Nero etc? If so make sure you are burning as a straight forward data cd.
Getting into safe mode is simply a case of repeatedly pressing F8 when the computer flicks past the BIOS boot screen.
Raistlin
06-07-2005, 15:42
Hi Paul,
ok, will do, i will check the 'add/remove' for anything that looks suspicious.
As to reading CDs, well i will try again, but it hasn't been able to read the
ones i have tried up to now, ones that will read ok in other machines(98).
I suppose this might be a problem with the CD unit ...
I could try using the floppy for some of the stuff.
I will try to get 'Hi-Jack' on to the machine, somehow.
Hi Incognitas,
I haven't figured out how to get into 'Safe-Mode' yet.
Its different from the 98 i'm used to ....
John :)
Hijack This isn't a particularly big program.
If you can get email access on the affected machine you could try emailing it to yourself as an attachment.
Hi Paul,
Yes, i do use Nero, and i have a data CD recorded a while ago, i think
it has 'Hi-Jack' on it, i will try to get that onto the XPmachine.
I will try again to get into safe-mode (i think i was trying F3 !!)
Hi Raistlin,
I had wondered if Email access might still work, but i haven't set
any of the stuff on the XPmachine yet, if it reads data CDs ok then
that should do, and the email can wait till its clean.
I do appreciate all of your help.
Regards, John :)
I have managed to get it into safe mode ( i was trying F3 !! )
and i have put 'Hi-Jack this' onto it using a CD i made a while ago.
Haven't run HJ yet, will get back as soon as i have.
Cheers, John :)
Hi, Ran the H.J. .... heres the logfile....
not too clever with it myself .....
Logfile of HijackThis v1.99.1
Scan saved at 21:31:26, on 06/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\ZONELABS\minilog.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system32\sncntr.exe
C:\windows\system32\dxvid.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Hi-Jack this\HiJack3\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Steve\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.btopenworld.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Steve\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.ukj/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: (no name) - {32386F8C-E797-40A3-8ADD-82494C4B37EE} - C:\WINDOWS\System32\ceeohh.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PMXInit] C:\WINDOWS\System32\pmxinit.exe
O4 - HKLM\..\Run: [sncntr] c:\windows\system32\sncntr.exe /nocomm
O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O18 - Filter: text/html - {050470D4-7F59-4C26-8A8A-9586A8FEFC8E} - C:\WINDOWS\System32\ceeohh.dll
O18 - Filter: text/plain - {050470D4-7F59-4C26-8A8A-9586A8FEFC8E} - C:\WINDOWS\System32\ceeohh.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\minilog.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RtKit - Unknown owner - C:\WINDOWS\system32\RtKit\rtkit.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe
Cheers, John :)
This might be it ;)
http://www.sophos.com/virusinfo/analyses/trojstartpaer.html
__________________
Have you run an up to date virus scan recently?
__________________
Oh and this
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.rtkit.html
Nice to see your anti-virus is working well :erm:
__________________
Add this to the list
http://www.sophos.com/virusinfo/analyses/trojdlucai.html
__________________
Oh and it looks like the dxvid.exe file entry is spyware too.
__________________
Think you need to run
adaware
spybot S&D
Spyware blaster
A full virus scan with up to date definitions
__________________
Adaware (http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10045910.html?part=dl-ad-aware&subj=dl&tag=top5)
SpybotS&D (http://downloads.net-integration.net/spybotsd14.exe)
Spyware Blaster (http://majorgeeks.com/downloadget.php?id=2859&file=11&evp=61b0e8ad41924a03c37615f4682b4cef)
Raistlin
06-07-2005, 22:14
Make sure you run them all from Safe Mode ;)
Make sure you run them all from Safe Mode ;)
Yeah that is in the removal instructions on some of the links to Sophos. I think someone needs to clean sweep his PC and then protect it a bit better.
Hi Paul, Hi Raistlin,
(the PC was aquired in this condition,
it will be hopefully kept clean from now on ... )
I mentioned earlier, that almost everything is being sent to 127.0.0.1
except some annoying 'adult' site, and now i've just read this about
the RTKIT(troj) from the Symantic site....
Routes all the Internet requests through itself using a packet driver,
preventing normal utilities and applications from detecting the
Backdoor's network traffic.
So it looks like it maybe was the malware doing that, which is why i
didn't find anything new in the Hosts folder .....
I will run those programs, from safe-mode.
Adaware
SpybotS&D
Spyware Blaster
And get back to you.
John :)
I've run it through the unofficial 'HiJack Checker'
http://hijackthis.de/index.php?langselect=english
and its picked out these items for further scrutiny:
C:\WINDOWS\system32\ZONELABS\minilog.exe
I am inclined to trust this one
C:\windows\system32\sncntr.exe
running process. (sncntr.exe)
Added as result of a Troj/Dluca-I trojan infection
This is a nasty process!
You should fix it and try to delete it manually!
C:\windows\system32\dxvid.exe
running process. (dxvid.exe)
This is a unknown process.
PAUL picked this one out as possible spyware
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar
= res://C:\DOCUME~1\Steve\LOCALS~1\Temp\sp.dll/sp.html
This entry should be fixed by HijackThis!
This entry should be fixed by HijackThis!
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar
= res://C:\DOCUME~1\Steve\LOCALS~1\Temp\sp.dll/sp.html
This entry should be fixed by HijackThis!
This entry should be fixed by HijackThis!
R3 - URLSearchHook: (no name) -
{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
Should be fixed.
O2 - BHO: (no name) - {32386F8C-E797-40A3-8ADD-82494C4B37EE} -
C:\WINDOWS\System32\ceeohh.dll
Unknown application
dunno what to do with this ...
O4 - HKLM\..\Run: [sncntr] c:\windows\system32\sncntr.exe /nocomm
Added as result of a Troj/Dluca-I trojan infection
Hit rate: 99 % (result) Must be fixed!
no room for ambiguity there then!
O4 - HKLM\..\Run: [dxvid] c:\windows\system32\dxvid.exe /nocomm
Unknown
Hit rate: -1 % (result) Unknown application
PAUL picked this out ......
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
This entry should be fixed if this address does not belong to your
PC-manufacturer or your 'Internet-Service-Provider (ISP)'.
This entry should be fixed if 'http://www.btopenworld.com/'
is not your PC-manufacturer or your 'Internet-Service-Provider (ISP)'.
......This is the ISP of the previous owner (i think)......
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
This entry is possibly nasty. Should be fixed.
.........i better fix it then.....
O18 - Filter: text/html - {050470D4-7F59-4C26-8A8A-9586A8FEFC8E} -
C:\WINDOWS\System32\ceeohh.dll
Only a few Hijackers are listed here. The most popular are 'cn'
(CommonName) , 'ayb' (Lop.com) and 'relatedlinks' (Huntbar) .
They should be fixed.
O18 - Filter: text/plain - {050470D4-7F59-4C26-8A8A-9586A8FEFC8E} - C:\WINDOWS\System32\ceeohh.dll
Only a few Hijackers are listed here. The most popular are 'cn'
(CommonName) , 'ayb' (Lop.com) and 'relatedlinks' (Huntbar) .
They should be fixed.
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
Unknown
..........well i'll just have to guess then....
O23 - Service: TrueVector Basic Logging Client (minilog) -
Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\minilog.exe
Unknown service. (minilog.exe)
............think i will let this one by ..........
O23 - Service: RtKit - Unknown owner -
C:\WINDOWS\system32\RtKit\rtkit.exe (file missing)
These entries shows all services which are not from Microsoft.
Often malware is starting as a systemservice and it's not easy
to detect it. Unknown service. (rtkit.exe (file missing))
Unnecessary (deactivated) entry that can be fixed.
........... i think this will get the chop ...........
************
Well its a start.
I will set to with that,
after running Adaware, Spybot and SpywareBlaster.
Be back later, and let you know how i get on !
Cheers, John :)
Hi,
Since i last posted there's been some terrorist bombings in London.
I'm not that central, i'm just within the M25 ring, in the North-west.
Apparently all the mobile phone networks were shut down by the authorities.
I can't really see how this helped very much, and probably upset and
disturbed more people than it helped. If it helped at all.
However, internet connections were not interfered with, as far as i know.
I shall have to dig out my old CB-radio set if this kind of reaction is
going to become a typical response to various disturbances.
Some of my friends were very worried about family members unacounted for.
They are now known to be ok, but it was a worrying day.
Anyway, i will get on with working through that Hi-Jack report,
and i will get back to you soon,
Regards, John :)
Hi,
A friend has told me that the mobile telephones were shut down
because mobile telephones can be used to detonate bombs.
That had not occurred to me, and i suppose that is quite prudent.
I am now downloading the 'CWshredder' program, in order to run it
on this XPmachine, which is now not connecting at all.
I have run LSP-fix, which did not seem to make any difference.
I will try to keep progress up to date on this thread.
Regards, John :)
Raistlin
11-07-2005, 19:44
Stick with it John, sounds like you're getting there.
Never a quick process sorting out a machine when it's in this state.
The last one that gave me this much trouble ended up with me using the ultimate virus removal tool on it, that solved all the problems quite nicely :)
Stick with it John, sounds like you're getting there.
Never a quick process sorting out a machine when it's in this state.
The last one that gave me this much trouble ended up with me using the ultimate virus removal tool on it, that solved all the problems quite nicely :)
What? a bulldozer?
Raistlin
11-07-2005, 19:58
What? a bulldozer?
That's the second one on the list. The most preferred option is the "reformat".
Hi Raistlin, Hi Incognitas,
Yes, a format and fresh start has been put forward many times by one
or two people and my friend who was given this XPmachine.
However i am not at all sure that the 'MS.Office' programme is included
with the XP cd.rom , it may well not be. Or 'MS.Outlook' thats like
Outlook Express's big brother, and i think thats a separate purchase.
And other programs which don't spring to mind which will be lost after
a format, unless the 'Installation files' have been kept separately
along with their registration codes, so they can be re-installed.
In fact all i have inherited of this setup is the machine itself and
the XPcd.rom i may not actually be able to re-install XP since i havent
been given any packaging or any numbers for this, and it will probably
want me to give it some number at some stage during a re-install.
I am hoping that the numbers from Belarc will be what i need ......
if or when it comes to needing to do a re-install.
Briefly, i am not sure that i am in a position to do a successful re-
install. However using a bulldozer sounds like fun.
I will post my latest HJT-log, after using Killbox, FxAgentB, and CWS,
Cheers, John :)
__________________
Logfile of HijackThis v1.99.1
Scan saved at 06:31:22, on 13/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\ZONELABS\minilog.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Hi-Jack this\HiJack3\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.btopenworld.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.ukj/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\minilog.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe
***********************
I think it is now reasonable,
i may 'allow' Generic Host via ZA,
and see if it will go to google,
which up to now has been re-directed.
Cheers, John :)
Yes, connected ok,
after running Panda Active Scan, its picked out about twenty five
files as infected.
I will be checking out those, and hopefully this painful carry on
will soon be done.
With any luck this machine that has been passed on to me, will
soon be clean, and i can start getting used to the XP system.
I will try to keep this up to date,
John :) :)
Only 25? You got lucky lol. Make sure you run a full set of virus, trojan and spyware sweeps and then once you are clean and fully operational make a system restore point just in case ;)
Hi Paul,
only (around) 25 left
after battering it with killbox and CWS, and working through the housecall
results.
Yes i'm quite happy that Panda has brought these up for attention.
C:\WINDOWS\system32\mubenlzz.exe
C:\WINDOWS\system32\fqouektv.exe
C:\WINDOWS\system32\ebclcijb.exe
C:\WINDOWS\system32\bbzfsevd.exe
C:\WINDOWS\system32\lrygybit.exe
C:\WINDOWS\system32\jgerqwoc.exe
These will be the first to get snuffed,
Others yet to be checked.
I'll get there eventually.
Meanwhile, i am still worried about needing code numbers,
if (when) i ever need to do a re-install from the XP-cd.
I wasn't given any packaging or numbers.
(yes, i have made restore points)
John :)
downloaded SpSeHjfix, a 'disinfect' utility,
ran CWS again, then Panda and killed with killbox all
in the list from Panda.
Seems to be clear now.
Made new restore point
deleted old restore point.
Happy now ..... John :)
PS: asked previous owner for product key,
he said it wasn't actually himself that installed the system,
he will find out about it for me from his brother (in law ?)
who did the install, he said that nothing like i described has been
thrown out, and when it surfaces he will pass it on.
(update ...)
Hi,
I found a 'script' which returns the product key from my WinXP,
the site i found it on said it may not be the right key, depending
on how it was installed.
I think it said that if it was installed by a dealer under an 'OEM'
arrangement, then it may not be correct, but if it was installed
from the user CD then it should be correct.
I have no idea which way this XP was installed, but i have copied
down the product key that was displayed by this 'script' so i hope
that it is correct if i ever need it.
There has been no word from the brother of the previous owner,
who installed it.
I am getting a bit more used to XP now, but i am still unsure of
how the system would be affected if i change the hard drive, or put
in a DVD burner, would i have to re-register something somewhere ?
If i don't re-register will my system fall foul of the registration, and
start to shut itself down ? ( i'm not very knowledgeable about XP )
Regards, John :)
Hiya John if you wait a little longer I am sure someone more experienced will be along to help.
From what I know of Xp, certain hardware changes are fine but if you change alot you change the hardware ID, then Windows will ask for activation, if you do not activate it ( this can be done via the internet or phone ) after 30days it locks you out of xp until you do activate it.
Now you enter the cdkey to isntall windows so let us say you installed some new hardware which changed it ( i put a slave HD in my pc and it did not bother it ) you would just attempt to activate if it accepted all is good, if not follow the phone number given and try to get a new ID from Microsoft, if you cannot, then it may be worthwhile seeing into a new copy.
www.overclockers.co.uk offer a good priced Xp Home OEM copy for about £70.
best of luck wish I could be of more help to you.
You can install or change hardare without re-Activating as long as you don't make any massive changes all in one go or make a number of changes across a certain length of time. Installing a new hard drive now and a new burner at a later date will not cause you any problems. If you are unsure of whether you have a legitimate copy of Windows XP then try downloading this
http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en
and you will be asked to validate your copy of XP, if it throws a problem you will soon know as it will fail to validate correctly.
There's more info on the activation process here
http://www.microsoft.com/technet/prodtechnol/winxppro/evaluate/xpactiv.mspx#EEAA
__________________
On another front though I would think that the installation of XP that you have on the PC is a standard install using an "generated key" or a known key that has been found on a warez site which could work for a while until MS find it's been compromised at which point the computers using it will suddenly find themselves unable to update until re-activated.
If the computer is happy to run windows update and validates correctly I wouldn't worry too much but you would be advised to look into buying a copy of XP at some point if you don't have one to hand.
Hi,
After reading both the foregoing posts carefully,
i conclude that they both think i have not got a genuine XP CD.
Both previous posts mention that i should consider buying an XP
CD, and that makes me think that maybe i should check the one
that i have already bought.
Exactly why both previous posters think that my WinXP CD may not
be the genuine article, i don't know.
It looks normal to me, but then this is the first one ive seen.
Maybe it isn't genuine, you have me worried now.
The previous owner did not keep all the packaging, in fact he did
not keep any of the packaging. Or any of the paperwork relating to
this computer and CD. However he did know that it is necessary to
keep the CD. But he did not know it is also necessary to keep the
wrapper. I have extracted a 'key' using a script, but depending on
the type of installation, the 'Read-me' with the script says that
it may, or may not return the correct key.
Paul has suggested i try to 'Validate' in order to see if i have a
legitimate copy of XP, but i get the impression that if it doesn't
'Validate' then my XP would no longer work.
Before doing that, i wonder if there is any way i could check first?
It doesn't look like a copy, the screenprinting is very neat and
tidy. Copies of CDs and DVDs ive seen before, have an inkjet paper
stuck on, i haven't seen a screenprinted copy before.
I know that isn't definitive.
I will try to contact the person who installed this XP install.
John :)
vBulletin® v3.8.11, Copyright ©2000-2024, vBulletin Solutions Inc.