[mda4]

Could you please do that from the Laptop? Thanks.

Pinging google.com from the lappie has very similar results.

4 packets sent/received

minimum = 172 ms, max 251 ms, avg 200 ms

[Advertisements]

The new desktops name is Dad, right? Sorry if I seem to be asking stupid questions, however I'm not sure why your Laptop keeps on losing network connectivity.

On the Laptop, please do the following:
Test your Network
1. Goto Start, Run, type: NETSH DIAG GUI - press 'OK'. A Command Prompt window will open temporarily; don't touch it, it will disappear in a moment.
2. A Microsoft Help and Support window will then open; select the option 'Scan your system'.
3. Wait for the scan to finish and then scroll down to the heading 'Modems and Network Adapters'. Look at 'Network Adapters' (don't expand it yet). Beside your connection information, you should see a green 'PASSED'; if you do not (if you see a red 'FAILED') then expand 'Network Adapters', scroll down the list until you see the heading with the 'FAILED', expand that option and copy and paste the results here.
In the NETSH DIAG GUI, you should be looking for any red 'FAILED', however the key one is Network Adapters for you. If you see any other red FAILED, expand the component and copy the results.

[Dan]

The new desktops name is Dad, right? Sorry if I seem to be asking stupid questions, however I'm not sure why your Laptop keeps on losing network connectivity.

On the Laptop, please do the following:
Test your Network
1. Goto Start, Run, type: NETSH DIAG GUI - press 'OK'. A Command Prompt window will open temporarily; don't touch it, it will disappear in a moment.
2. A Microsoft Help and Support window will then open; select the option 'Scan your system'.
3. Wait for the scan to finish and then scroll down to the heading 'Modems and Network Adapters'. Look at 'Network Adapters' (don't expand it yet). Beside your connection information, you should see a green 'PASSED'; if you do not (if you see a red 'FAILED') then expand 'Network Adapters', scroll down the list until you see the heading with the 'FAILED', expand that option and copy and paste the results here.
In the NETSH DIAG GUI, you should be looking for any red 'FAILED', however the key one is Network Adapters for you. If you see any other red FAILED, expand the component and copy the results.

[mda4]

The new desktops name is Dad, right? Sorry if I seem to be asking stupid questions, however I'm not sure why your Laptop keeps on losing network connectivity.

On the Laptop, please do the following:
Test your Network
1. Goto Start, Run, type: NETSH DIAG GUI - press 'OK'. A Command Prompt window will open temporarily; don't touch it, it will disappear in a moment.
2. A Microsoft Help and Support window will then open; select the option 'Scan your system'.
3. Wait for the scan to finish and then scroll down to the heading 'Modems and Network Adapters'. Look at 'Network Adapters' (don't expand it yet). Beside your connection information, you should see a green 'PASSED'; if you do not (if you see a red 'FAILED') then expand 'Network Adapters', scroll down the list until you see the heading with the 'FAILED', expand that option and copy and paste the results here.
In the NETSH DIAG GUI, you should be looking for any red 'FAILED', however the key one is Network Adapters for you. If you see any other red FAILED, expand the component and copy the results.

All passed. The Desktop's name is actually "Den". I log in as "Dad" (Administrator)

[Dan]

All passed. The Desktop's name is actually "Den". I log in as "Dad" (Administrator)

From the laptop, do ping DEN -- you'll probably get a response.

If you run the Network Setup Wizard again, are you able to see the new desktop again?

On the old PC, can you see the new PC?

On the old PC, please do the following:
Please goto Start --> Run --> Type CMD and press OK --> Now, please do the following:
cacls D:\ /g everyone:f -- NOTE: There is a space between the \ and / along with a space between the g and everyone -- there is no space between the everyone, : and f -- can you now access the old desktop from the new/laptop?

Also, I'm going to suggest that you try these steps on all of the computers to make sure you don't have any Malware.

[mda4]

OK, I'll do all those things. I did them a couple of weeks ago when I was infected. Just thjis evening, a couple of srange things occurred: When I reboooted, I got an error saying I had limited virtual memory, and no paging file, or the paging file is too small. Also, Word 11.0 tries to reinstall itself, but fails. I can run Work ok, though.

I'll pick up where we left off tomorrow. Thanks for your patience.

[Dan]

This is a suggestions from another Trusted Tech Staff Member:

Windows inernet connection firewall can be a [bleep] to turn of.. somtimes it is still on even when it says it is turned off and the only way to verify for 100% sure that I have found is through services.msc.... if needed here is how:

1. Click on START
2. Click on RUN
3. Type in: services.msc and hit <ENTER>
4. Scroll down to "INTERNET CONNECTION FIREWALL"
5. Right click and select "Properties"
6. click the STOP button, and from the the startup type dropdown menu select "disabled"
7. Restart the computer
8. Apply steps 1-7 to all windows Xp computers on the network

Now have them check for file share and they should have it as long as the network wizard has been run and the correct connection methods have been selected in the wizard.

Please try that as well.

[mda4]

OK, this computer is really doing some starnge things now. I can't even access my C drive; the only folder listed under C is Documents and Settings. When I click on C, I get an error saying it isn't accessible, and access is denied. And this is on the desktop itself, not trying to access it from a different computer on the network.

YIKES!!!

[mda4]

From the laptop, do ping DEN -- you'll probably get a response.

If you run the Network Setup Wizard again, are you able to see the new desktop again?

On the old PC, can you see the new PC?

On the old PC, please do the following:
Please goto Start --> Run --> Type CMD and press OK --> Now, please do the following:
cacls D:\ /g everyone:f -- NOTE: There is a space between the \ and / along with a space between the g and everyone -- there is no space between the everyone, : and f -- can you now access the old desktop from the new/laptop?

Also, I'm going to suggest that you try these steps on all of the computers to make sure you don't have any Malware.

I'm not able to run Norton antivirus because of insufficient memory. (I've got a gig of RAM, and lots of free hard drive space. I was able to access a thumb drive with Hijack this and logged the following:
Logfile of HijackThis v1.99.1
Scan saved at 12:03:11 AM, on 1/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\MSN Video Enhanced\MSNVE.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Misc programs\WillowRd.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\SSSCRE~1.SCR
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\VPC32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Dad\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Dad\Application Data\Mozilla\Profiles\default\ipi2w17w.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {88069C82-7012-7FEF-4140-2850A25765B4} - C:\WINDOWS\system32\sahmn.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MSN Video Enhanced] "C:\Program Files\MSN Video Enhanced\MSNVE.exe"
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: ScreenArt.lnk = C:\Program Files\Misc programs\WillowRd.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.co...84/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.co...,21/mcgdmgr.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O20 - Winlogon Notify: awtqn - awtqn.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Local Security Authority Subsystem Service (lsass) - Unknown owner - C:\WINDOWS\scvhost.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Any suggestions?

[Dan]

Please post that HJT log here.

Once you get the all-clear from the Malware Removalists, please post back here.

Edited by Dan G, 14 February 2006 - 07:53 PM.

[mda4]

I tried the commands you gave me in the last post, but I'm not sure I don't think it worked. I got an error msg when i put a space between /e /g, and I received a different message about wildcards when I omitted the space "/e/g". I can't post it because my copy and paste doesn't seem to work.

I've also posted to the malware post with my hijackthis log.

[Dan]

Mike,
On which computer(s) did you recieve the error(s)?

Edited by Dan G, 19 January 2006 - 10:36 PM.