[kanishka]

hello.
i am sorry that i took so long to reply this time around.was out of city.
well i have donr the process u told me to and the xp is in its orignal form now. thankz
. but i dont know how to make a screenshot. guide me fot that plz. and our major problem of rdriv is not solved what shall we do for that.
is there a solution or will i have to format my drive.

waiting for ur reply.

[Advertisements]

When the installation message is on your screen, press the 'print screen' button on your keyboard. It will look like nothing is happening.

Then open Notepad or Word to a new file and rightclick the mouse. Choose 'paste'. Save that file and attach it to your reply here.

[g2i2r4]

When the installation message is on your screen, press the 'print screen' button on your keyboard. It will look like nothing is happening.

Then open Notepad or Word to a new file and rightclick the mouse. Choose 'paste'. Save that file and attach it to your reply here.

[kanishka]

the window is not getting copied in the notepad.and since in my 1st mail i told u that i had formated my comp. so since then i dont have ms office . that is no ms word.
if u want me to try this process in word, will u tell me the link 4om where to dwnlod the ms office.
wat to do next.

[g2i2r4]

If you get the installation message press the print screen button.

Start Wordpad by using the Start button in the bottom left of your screen and following the path to Notepad: Start-Programs-Accessories-Wordpad

Rightclick anywhere in that file and choose paste.

Edited by g2i2r4, 28 June 2005 - 01:55 PM.

[kanishka]

hello.]
what u told me to do in the word pad worked i hav got it saved. but now the prob. is that i cannot send the attachment to you as the size is more that 2mb. and therefore it is not getting attached. so tell me what to do now.

also i wanted to tell u that since last 10 daysor so the processing of the computer has gone very slow. all the programs take a long time to execute a request, is it due to the virus. or is it due to using avast antivirius and ewido together. i dont know but its getting on to me.plz help.

[g2i2r4]

Can you attach it to your post here?

[kanishka]

no i am not able to thats what i was saying. since the limitation to attach a post here is just 2mb i am not able to as my file size is 2.6mb and therefore is not getting attached here with the post.

Attached Files

•  rdriv.rtf   344KB   148 downloads

[kanishka]

no i am not able to thats what i was saying. since the limitation to attach a post here is just 2mb i am not able to as my file size is 2.6mb and therefore is not getting attached here with the post.

[g2i2r4]

Download rdrivRem.zip
Unzip it to your desktop.

It's an updated version.

Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight "Safe Mode" then hit enter.

Please double-click rdrivRem.bat to run the program - follow the instructions on the screen. After it's complete, rdriv.txt will be created in the rdrivRem folder.

Reboot back to normal mode. Post me the content of the rdriv.txt.

[kanishka]

i ran the process but it sisnt detected anything here is what u requested for.


~~~~~~~~~~~~~ Pre-run File Check ~~~~~~~~~~~~~

rdriv.sys NOT PRESENT!
ItunesMusic.exe NOT PRESENT!
wkssvc.exe NOT PRESENT!


~~~~~~~~~~~~~ Post run File Check ~~~~~~~~~~~~~

rdriv.sys NOT PRESENT!
ItunesMusic.exe NOT PRESENT!
wkssvc.exe NOT PRESENT!


both the installation window are still comming, that is ewido security suit and rdriv hardware installation.
i wanted to tell u something, when i started the computer in safe mode even there the installation windows were comming i first said no to both the installation and then ran the rdrivrem.bat

[g2i2r4]

Can you try to send it to me by e-mail (check our PM).

Copy the part in bold below into notepad. Save it as unlegacy.reg (set filetype to "All Files")

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDIRECTX]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDIRECTX]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msdirectx]


Doubleclick the file you made and confirm you want to merge it with the registry.
Reboot once more and post a new log using HijackThis.

[kanishka]

i hope u have got my mail. let me know if u havent.
i have done the complete procedure and here is the log that u requested for


Logfile of HijackThis v1.99.1
Scan saved at 11:52:20 PM, on 7/3/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\AIRTEL\AIRTEL-Broadband\fts.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\rasautou.exe
C:\Program Files\AIRTEL\AIRTEL-Broadband\pppoetray.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [%FP%AIRTEL fts.exe] "C:\Program Files\AIRTEL\AIRTEL-Broadband\fts.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1117646471222
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5BAB303-5CE4-4DCB-BCCB-591793A1B6D6}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{D33A2A29-FCA1-4091-ADE0-BE9F08CAFDA2}: NameServer = 202.56.215.6 202.56.230.6
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

[g2i2r4]

I have received your e-mail, thank you.

I posted the screenshots for my collegues to see, I'll get back to you on that.

Your HijackThis log is clean.
--------------------------------------


http://www.billsway.com/vbspage/
Scroll down to

Registry Search Tool
Search the Windows Registry for input string and display results (easier than repeatedly hitting the F3 key in RegEdit).

Script revised 13 Dec 2001 to work with Windows XP and Windows 2000.

And download this program.

Open the RegSearch folder and double click RegSearch.vbs. Allow it to run.

enter ewido
RegSearch will "disappear" but it is actually searching the registry for that entry.

Copy and paste what it finds into a Notepad file.


--------------------

Repeat the same procedure for rdriv

[kanishka]

plz let me know that in the last reply u told me to double clik RegSearch.vbs. and then enter ewido and then rdriv. u mean to say that i should run the hardware setup which is appering on the screen or something else. let me know m confused.

[g2i2r4]

Ok let's start with this:

Open the RegSearch folder and double click RegSearch.vbs. Allow it to run.

type in:
ewido
RegSearch will "disappear" but it is actually searching the registry for that entry.

Copy and paste what it finds into a Notepad file.