Jump to content

bullet

Member
  • Posts

    146
  • Joined

  • Last visited

  • Donations

    0.00 USD 
  • Country

    United States

Posts posted by bullet

  1. Some one could be pulling a prank on you. If you put shutdown.exe with appropriate switches into your startup folder then the computer will do exactly what you are describing. Check the startup folder and see what is there.

  2. This may not be the exact answer you are looking for but here goes.

    If I understand what you are trying to do then I think you can just use Bart's Modboot or even better Bart's Network Boot Disk

    You can map a network drive then just do a network unattend install. You can put any script you want to run in your unattend install. That way you don't have to mess with deleting partitions.

    If you have the money you can also do a RIS Install

    As far as creating a diagnostic partition why not just have a diagnostic CD like Bart's PE

    I feal like a Bart Lagerweij spokesperson. It is good software I assure you.

    Hope this helps :rolleyes:

  3. Here is my HiJack Log

    Logfile of HijackThis v1.97.7
    Scan saved at 9:06:26 AM, on 3/4/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\NetSupport Manager\Client32.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Symantec AntiVirus\SavRoam.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\TIREMOTE\wuser32.exe
    C:\WINDOWS\TIREMOTE\TIRemoteService.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\WINDOWS\system32\ICO.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\FSRremoS.EXE
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\WINDOWS\system32\atiptaxx.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Microsoft IntelliType Pro\type32.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Intuit\Track-It! 6.5\Technician Client\TIWin.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Documents and Settings\bwinchester.TBCNET\Desktop\HiJack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://srv1/companyhome/default.asp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://srv1/companyhome/default.asp
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://r.office.microsoft.com/r/rlidOfficeUpdate?clid=1033
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O11 - Options group: [JAVA_IBM] Java (IBM)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38396.5100810185
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{69BFF62B-997A-4644-B5CE-64BB7F5D3123}: NameServer = 192.168.71.101

    Attached is a screen shot of the netstat -a command for those who think I am full of crap.

  4. I install the MS AntiSpyware and it didn't find anything related to my problem. Installed Registry Mechanic and even though it is a neat little program it didn't help either. I still have the big gap in my add/remove programs list and I still have the ads.rediff.com Listening on various ports.

    The netstat -b shows Active connections and it did not show any of the ads.rediff.com ports so at least they are not constantly active. Who knows.

    Does anyone have any more ideas?

  5. I think that my machine is infected with some sort of undetecable spyware. If I open a command prompt and run the netstat -a command it displays all of the active ports on my computer. On 6 ports there is an entry of ads.rediff.com and it is listening. I have ran a full AdAware scan, and ran HiJack this neither could find anything to do with this ads.rediff.com thing. I even searched the registry for "rediff" and could not find a single entry. However, it still remains.

    I am not sure if this is realated or not but there is a huge blank space in my add/remove programs list. It is probably about 100 pages long. I am not sure if the blank space is causing the listening ports of not. I can't get rid of it either. If anyone has any idea then please help. Thanks

  6. The only use that I have found for Windows ME is job security. Probably 8 out of the last 10 personaly owned computer that I have fixed have had Windows ME. All of the problems were O.S related. I recommend that everyone running Windows ME should upgrade to Windows 98. :lol:

  7. Welcome to Symantec. I hate it. :realmad:

    Uninstall problems are common for Norton especially if you have system works. Symantec support is pretty close to an oxymoron. Here is the document that you are probably looking for

    Norton antivirus 2005 removal

    Norton is good antivirus if you never change. Even trying to upgrade to newer versions of Norton is painful as you can atest. My advice is once you have removed Norton use AVG. AVG is free and it works just as good as Norton. As an added bonus if you decide to change you can actually remove it from your system using Add/Remove programs without a headache. :yes:

  8. I have searched MSFN forums and have read the Unattend Guide. I cannot find a specific answer for my question. I have many different machines where the hard drive has more than 1 partion on it. What can I do to my unattend CD to just delete all partitions and format 1 partion using NTFS? I don't care about losing any data. My winnt.sif has

    [Data]

    Autopartition=1

    [unattended]

    Repartition=Yes

    Thanks for the help

  9. You can also try to change your NIC settings to 10 MBFull instead of auto detect. Just go into network connection, right click on local area network then properties. You should then click the configure button for your adapter. Go to the advanced tab and then change the speed & duplex setting. :yes:

  10. Actually horsecharles I was talking to Jaclaz and the method he used in his link.

    As for twista if you have the adapters then at this point it might be the easiest. If you still want to try the method I originally suggested then make sure file and printer sharing is turned on, share a folder on your desktop computer with the install files in it. Then with the crossover cable connected boot a laptop with a network boot disk like the one in my other post. Once everything is loaded and you are at a command prompt type

    \\net use z: <computername>\<sharename>

    computername being the name of the desktop computer and the sharename being the name of the shared folder. Once there then copy files. Beforehand make sure the laptop HD has been partitioned and formated using a regular win98 boot disk.

    Good luck

  11. Somehow I don't think that taking your hard drive out using an adapter to connect it to another system and then copy the file over is even remotely close to what I suggested. ;)

    It will work but it is a totally different method than what I said.

×
×
  • Create New...