[highland403]

Dan,

When I open Local Area Connection properties, there isn't anything called 'This connection uses the following items'. There is a window that says 'Components checked are used by this connection' and in the window below that is
Client for Microsoft Networks,
File & Printer Sharing for Microsoft Networks
Internet Protocol (TCP/IP)

Steve

[Advertisements]

Then that means that you don't have NWLink IPX/SPX installed. Please check your Protocol headings again; are they actually there?

[Dan]

Then that means that you don't have NWLink IPX/SPX installed. Please check your Protocol headings again; are they actually there?

[highland403]

Dan,

I checked a second time a couple of days ago and NWLink IPX/SPX was still there. I won't be able to check the computer again until tomorrow morning but how could it just show up and then just disappear?

By the way, I posted the Hijack This log on the Hijack This forum like you asked. However, not really knowing how all of this works, I didn't post it under the same name as this post. I posted it under Winsock Corruption? Its showing up on page 5 right now. Sorry for the inconvenience. Should I post it again under the name used in this Forum?

Steve

[Dan]

Nah, it should be fine. They'll get to it when they have a chance.

I won't be able to check the computer again until tomorrow morning but how could it just show up and then just disappear?

That's what I'd like to know

Let me know if it's still there when you get the chance.

Thanks.

[highland403]

Dan,

NWLink IPX/SPX is still there. Just for fun I checked the other computers and neither of them have the NWLink names. They both only have the 10 names that you said should be there.

I also ran LSPFix on computer A. It did not have any files in the Remove list. The files in the Keep list were:

File....................................Description
Mr20.dll............................TCIP
Winrnr.dll..........................NTDS
nwprovau.dll......................NWLink IPX/SPX/NetBios...
msafd.dll...........................Protocol handler
rsvpsp.dll..........................Protocol handler

I'm not sure about the 2nd file name (Winrnr.dll) because the letters 'rnr' run together. It could be 'mr'.

Steve

[Dan]

Steve,

Could you please clear something up for me (that you said in an earlier post):

both computers can talk to computer A if A is not plugged into the router.

If Computer A is not plugged into the router, then how do the other computers communicate with it?

nwprovau.dll......................NWLink IPX/SPX/NetBios...

If you still have this entry in your Registry (and you can't locate the file in your LAC Properties), then that means you must have Uninstalled/Removed it incorrectly. If you are positive that you do not need any sort of Netware connection on your computer, and you can not locate NWLink IPX/SPX in your LAC, then you can remove this registry entry.

(*Note: Before you remove this entry, please create a Registry Back-up).
Run LSPFix.exe again, however this time check 'I know what I'm doing' and then select the nwprovau.dll file, and press the right arrow (>>) to send it to the Remove section. Scroll down and click 'Finish>>'. Restart your computer, and test your Connection.

[highland403]

Dan,

The statement I made was incorrect when I said, "both computers can talk to computer A if A is not plugged into the router." That should have said, "both computers can talk to computer A if A is plugged into the router. Sorry for adding to the confusion.

I backed up the Registry, then ran LSPFix.exe and removed nwprovau.dll. I restarted the computer and tried the connection. I thought that fixed it because my home page started showing up, but only part of it came up and then the connection died. I tried connecting again but no luck.

I checked msinfo32 and the NWLink IPX/SPX names are still there.
I then ran LSPFix.exe again and nwprovau.dll did not show up.

Steve

[Dan]

Steve,

Thanks for clearing that up for me

Please post a fresh IPCONFIG /ALL

Also, please goto Start, Run, type EVENTVWR and press 'OK'. Now look under the Sytems and Application logs for any errors or warnings that you think might be connected with your Internet connection (eg. Look for TCP/IP or DHCP errors etc).

Please run the application WinsockFix again (you downloaded it earlier).

Thanks,
Dan.

[highland403]

Dan,

Here is the ipconfig /all:

Microsoft Windows 2000 [Version 5.00.2195]
© Copyright 1985-2000 Microsoft Corp.

C:\Documents and Settings\Administrator.MAIN>ipconfig /all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : THG
Primary DNS Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mad.wi.charter.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : mad.wi.charter.com
Description . . . . . . . . . . . : Intel® 82559 Fast Ethernet LAN on
Motherboard
Physical Address. . . . . . . . . : 00-03-47-76-57-F6
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.102
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 24.196.64.53
68.115.71.53
24.159.193.40
Lease Obtained. . . . . . . . . . : Wednesday, December 28, 2005 8:32:01
AM
Lease Expires . . . . . . . . . . : Saturday, December 31, 2005 8:32:01
AM

C:\Documents and Settings\Administrator.MAIN>

The system log errors are:
Service Control Manager
DCOM
DHCP on 12/22/05
and a DHCP Warning.

The application log errors are:
rasctrs on 12/24
PerfNet
PerfDisk
and about 1,000 AVG7 on 12/15.

I also ran WinsockFix again and rebooted the computer but still no luck.

I noticed that when Computer A is plugged into the router, its' port light blinks very rapidly while the port lights for the other two computers only blink periodically. Does this mean anything other than Computer A is trying to connect but can't?

Steve

[Dan]

Your connection looks fine now.

Have you recieved a reply from your Malware post as of yet?

Can you please post the information of these errors:
DCOM
DHCP on 12/22/05
DHCP Warning

By port light do you mean the activity light?

[highland403]

Dan,

So far there have been no responses to my Malware post.

When you say "Can you please post the information of these errors:
DCOM
DHCP on 12/22/05
DHCP Warning

Do you mean open these errors and copy the content, or post the actual system log and application log?

And by port light, i think its the activity light because the top light for that port is labeled link/act and the bottom light is labeled 100. Its the top light that is blinking incessantly.

[Dan]

Do you mean open these errors and copy the content, or post the actual system log and application log?

Please open those errors and copy the content.

[highland403]

Dan,

Major problems here. Now none of my computers can access the internet.

Unfortunately, the virus has now spread to my other 2 computers. I cannot access the internet from any of them. Anything that you want me to post will have to be copied to a floppy and then posted from my computer at home.

I believe the virus that I had on my main computer has now spread to the other 2 computers. A file called Jamey.exe shows up 10 times under processes in the Windows Task Manager.

I have been told that no one can guarantee that the virus can be completely deleted from the computer (so the virus could reinstall itself if it has a backdoor that can't be located and deleted?)

So it appears that the solution is to get rid of my computers and buy new ones.

What do you think?

Steve

[Dan]

So it appears that the solution is to get rid of my computers and buy new ones.

That's not a solution... Please dont rush off and buy new computers until the Malware Removalists have had an opportunity to help you.

[highland403]

Dan,

Here are those logs you asked for:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 12/24/2005
Time: 9:19:29 AM
User: NT AUTHORITY\SYSTEM
Computer: THG
Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not register with DCOM within the required timeout.

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 12/22/2005
Time: 7:50:54 PM
User: N/A
Computer: THG
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0003477657F6. The following error occured:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Data:
0000: 79 00 00 00 y...

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 12/22/2005
Time: 11:14:33 AM
User: N/A
Computer: THG
Description:
The IP address lease 192.168.1.102 for the Network Card with network address 0003477657F6 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

Event Type: Warning
Event Source: dnscache
Event Category: None
Event ID: 11050
Date: 12/28/2005
Time: 8:47:29 AM
User: N/A
Computer: THG
Description:
The DNS Client service could not contact any DNS servers for a repeated number of attempts. For the next 30 seconds the DNS Client service will not use the network to avoid further network performance problems. It will resume its normal behavior after that. If this problem persists, verify your TCP/IP configuration, specifically check that you have a preferred (and possibly an alternate) DNS server configured. If the problem continues, verify network conditions to these DNS servers or contact your network administrator.
Data:
0000: b4 05 00 00 ´...

I haven't bought new computers yet, but I am running out of time.

Steve