Help...Trying to get XPhome to connect via my NTLcable

[Raistlin]

Originally Posted by Incognitas

What? a bulldozer?

That's the second one on the list. The most preferred option is the "reformat".

[John1]

Hi Raistlin, Hi Incognitas,

Yes, a format and fresh start has been put forward many times by one
or two people and my friend who was given this XPmachine.
However i am not at all sure that the 'MS.Office' programme is included
with the XP cd.rom , it may well not be. Or 'MS.Outlook' thats like
Outlook Express's big brother, and i think thats a separate purchase.
And other programs which don't spring to mind which will be lost after
a format, unless the 'Installation files' have been kept separately
along with their registration codes, so they can be re-installed.

In fact all i have inherited of this setup is the machine itself and
the XPcd.rom i may not actually be able to re-install XP since i havent
been given any packaging or any numbers for this, and it will probably
want me to give it some number at some stage during a re-install.
I am hoping that the numbers from Belarc will be what i need ......
if or when it comes to needing to do a re-install.

Briefly, i am not sure that i am in a position to do a successful re-
install. However using a bulldozer sounds like fun.

I will post my latest HJT-log, after using Killbox, FxAgentB, and CWS,

Cheers, John
__________________

Logfile of HijackThis v1.99.1
Scan saved at 06:31:22, on 13/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\ZONELABS\minilog.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Hi-Jack this\HiJack3\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.btopenworld.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.ukj/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\minilog.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

***********************

I think it is now reasonable,
i may 'allow' Generic Host via ZA,
and see if it will go to google,
which up to now has been re-directed.

Cheers, John

[John1]

Yes, connected ok,
after running Panda Active Scan, its picked out about twenty five
files as infected.

I will be checking out those, and hopefully this painful carry on
will soon be done.

With any luck this machine that has been passed on to me, will
soon be clean, and i can start getting used to the XP system.

I will try to keep this up to date,
John

[Paul K]

Only 25? You got lucky lol. Make sure you run a full set of virus, trojan and spyware sweeps and then once you are clean and fully operational make a system restore point just in case

[John1]

Hi Paul,

only (around) 25 left
after battering it with killbox and CWS, and working through the housecall
results.
Yes i'm quite happy that Panda has brought these up for attention.


C:\WINDOWS\system32\mubenlzz.exe

C:\WINDOWS\system32\fqouektv.exe

C:\WINDOWS\system32\ebclcijb.exe

C:\WINDOWS\system32\bbzfsevd.exe

C:\WINDOWS\system32\lrygybit.exe

C:\WINDOWS\system32\jgerqwoc.exe

These will be the first to get snuffed,
Others yet to be checked.

I'll get there eventually.
Meanwhile, i am still worried about needing code numbers,
if (when) i ever need to do a re-install from the XP-cd.

I wasn't given any packaging or numbers.
(yes, i have made restore points)

John

[John1]

downloaded SpSeHjfix, a 'disinfect' utility,
ran CWS again, then Panda and killed with killbox all
in the list from Panda.

Seems to be clear now.

Made new restore point
deleted old restore point.

Happy now ..... John

PS: asked previous owner for product key,
he said it wasn't actually himself that installed the system,
he will find out about it for me from his brother (in law ?)
who did the install, he said that nothing like i described has been
thrown out, and when it surfaces he will pass it on.

[John1]

(update ...)

Hi,
I found a 'script' which returns the product key from my WinXP,
the site i found it on said it may not be the right key, depending
on how it was installed.
I think it said that if it was installed by a dealer under an 'OEM'
arrangement, then it may not be correct, but if it was installed
from the user CD then it should be correct.
I have no idea which way this XP was installed, but i have copied
down the product key that was displayed by this 'script' so i hope
that it is correct if i ever need it.
There has been no word from the brother of the previous owner,
who installed it.

I am getting a bit more used to XP now, but i am still unsure of
how the system would be affected if i change the hard drive, or put
in a DVD burner, would i have to re-register something somewhere ?

If i don't re-register will my system fall foul of the registration, and
start to shut itself down ? ( i'm not very knowledgeable about XP )

Regards, John

[AndrewJ]

Hiya John if you wait a little longer I am sure someone more experienced will be along to help.

From what I know of Xp, certain hardware changes are fine but if you change alot you change the hardware ID, then Windows will ask for activation, if you do not activate it ( this can be done via the internet or phone ) after 30days it locks you out of xp until you do activate it.

Now you enter the cdkey to isntall windows so let us say you installed some new hardware which changed it ( i put a slave HD in my pc and it did not bother it ) you would just attempt to activate if it accepted all is good, if not follow the phone number given and try to get a new ID from Microsoft, if you cannot, then it may be worthwhile seeing into a new copy.

www.overclockers.co.uk offer a good priced Xp Home OEM copy for about £70.

best of luck wish I could be of more help to you.

[Paul K]

You can install or change hardare without re-Activating as long as you don't make any massive changes all in one go or make a number of changes across a certain length of time. Installing a new hard drive now and a new burner at a later date will not cause you any problems. If you are unsure of whether you have a legitimate copy of Windows XP then try downloading this
http://www.microsoft.com/downloads/d...displaylang=en
and you will be asked to validate your copy of XP, if it throws a problem you will soon know as it will fail to validate correctly.
There's more info on the activation process here
http://www.microsoft.com/technet/pro...ctiv.mspx#EEAA
__________________

On another front though I would think that the installation of XP that you have on the PC is a standard install using an "generated key" or a known key that has been found on a warez site which could work for a while until MS find it's been compromised at which point the computers using it will suddenly find themselves unable to update until re-activated.
If the computer is happy to run windows update and validates correctly I wouldn't worry too much but you would be advised to look into buying a copy of XP at some point if you don't have one to hand.

[John1]

Hi,

After reading both the foregoing posts carefully,
i conclude that they both think i have not got a genuine XP CD.

Both previous posts mention that i should consider buying an XP
CD, and that makes me think that maybe i should check the one
that i have already bought.

Exactly why both previous posters think that my WinXP CD may not
be the genuine article, i don't know.
It looks normal to me, but then this is the first one ive seen.

Maybe it isn't genuine, you have me worried now.

The previous owner did not keep all the packaging, in fact he did
not keep any of the packaging. Or any of the paperwork relating to
this computer and CD. However he did know that it is necessary to
keep the CD. But he did not know it is also necessary to keep the
wrapper. I have extracted a 'key' using a script, but depending on
the type of installation, the 'Read-me' with the script says that
it may, or may not return the correct key.

Paul has suggested i try to 'Validate' in order to see if i have a
legitimate copy of XP, but i get the impression that if it doesn't
'Validate' then my XP would no longer work.
Before doing that, i wonder if there is any way i could check first?
It doesn't look like a copy, the screenprinting is very neat and
tidy. Copies of CDs and DVDs ive seen before, have an inkjet paper
stuck on, i haven't seen a screenprinted copy before.
I know that isn't definitive.

I will try to contact the person who installed this XP install.

John