Accessing networked drives locks machines

[Cory S. Estes]

Any suggestions/help would be appreciated!

The following info is provided:

Two machines networked together. Both running Win ME. Both using Linksys network cards. Both connected to a hub; the hub also is connected to a router and the router to a cable modem. Both seem to have clean and reliable access to the Internet, e-mail, etc. Both have had their RAM SIMMS checked they tested out ok.

Machine #1 runs a Shuttle AK31 V2/1.333 Gig Athlon, 256mb RAM.
Machine #2 runs a MSI KT3/1800+ Athlon (both new), 512mb RAM.

The drives are correctly mapped and shared on each machine, they each have a different, unique name, and have been set to file sharing.

On machine #1 if you try to access any of the three mapped drives on #2, #1 locks up tighter than a drum immediately. No <ctl><alt><del> or anything.

On machine #2 you can access in as far as a folder within one of the mapped drives on #1 but then #2 also locks up. On #2 <ctl><alt><del> will get you going again.

Have tried just about everything but have had no success. To top it off, I've discovered that this problem has, at times, seemed to just "clear up" and things work as they should. I'm starting to feel that Shuttle boards aren't working for me as hoped/expected. Could the problem be that either the board or the processor on #1 has problems? I just had to replace an almost new AK31V3/Athlon 1.2 Gig board and CPU that were less than a year old.

Suggestions highly welcome!

[GretaP]

Though it doesn't specifically mention your freeze-up problem, this (http://support.microsoft.com/default.aspx?scid=KB;en-us;q272991) may be a place to start.
I'll keep looking to see if I find any more info that more closely resembles your problem.

[Cory S. Estes]

Thanx for the info. I looked at what they had to say and even installed their downloadable "272991usam" patch.... no help. As far as symptoms, I can add a little more info:

After #2 locks up you have to <ctl><alt><del> to get out of it and then it either locks up and requires a reboot or, by itself, reboots.

After #1 locks up a <ctl><alt><del> causes the screen to go blank w/ nothing but a row of little green dots across the top of the screen at that time you have to hit the reset or power switch and reboot.

Still wondering if it's the MB and/or CPU on #1.

[Spider]

Hi Cory S. Estes,

What make/model is that router?

[Cory S. Estes]

The router is a Panasonic KX-HGW200.

[Spider]

I'm wondering why you have a hub in the network.

A hub, for a two computer network, and a router makes
the hub redundant. You don't need the hub.

The modem and both computers should be plugged into
the router. The router assigns addresses to the machines
plugged into it and with a hub in the mix there may be
some conflict there.

Eliminate the hub from the mix and after all is plugged in
then run winipcfg on both machines...Release
and Renew the connections.

I would normally show you some pictures on the ports
but there isn't a lot of technical info on that router.

btw, I hope you didn't pay more than $50.00 for that
router. They are outrageously over priced at many
outlets. The honest stores sell them for $50.00.

Have you done any configuring to the browser-based
administration of the router?

Are you running any software firewalls on those machines?

[Cory S. Estes]

Thanx for hanging with me. One way or the other there has to be a solution to this!

I run a hub because that's what the manual w/ it says to do for multiple machines connected w/ 10/100 cable. This particular router has the option to connect using a wireless setup. something they call a Home PNA phone line network, or there is a single RJ-45 jack that has a switch with the options Hub and PC. Both of the machines are in the same room so it's silly to use the phone line thing and I don't have the appropriate equipment for the wireless system. I already had the hub when I got the router more than a year and a half ago. In the past it has worked quite well, cleanly sharing data between up to three different systems. and, even when the machines won't share they both still aquire and untilze Internet connections as they should.

Have run winipcfg on both machines and have released and reset on both. The router assignes individual IP addresses to each machine as it is suppose to.

To the best of my knowledge the individual machines don't have firewalls. Not sure how to check that.

The rub of it all is that I've had this all working fine in the past. There was at least one period in the past when the same thing happened and I made do without copying back in the data I had saved off to #1. Then one day, out of the blue, I happened to try accessing #1 and everything behaved as it should. Last week when it became obvious that I was having trouble w/ #2 again, I was easily able to save numerous files I didn't want to lose, including over 150 .mp3 files, from #2 into the HD on #1. Now I have #2 repaired and my network is back up to its old tricks again.

All I can figure is that either there is some obscure setting somewhere that I've missed or there's a problem in #1.

Thanx again.

[Spider]

Originally posted by Cory S. Estes
I run a hub because that's what the manual w/ it says
to do for multiple machines connected w/ 10/100 cable.
A hub is only introduced to a routered network when the router
has no more free ports. I don't know how many ether ports you
have on the router but usually there are 3 to 4 ether ports on
most home network routers, if you have two computers plugged
into a 3 port router then you still have availability for one more
computer...a hub is only introduced if you need to exceed the
amount of available ether ports.
there is a single RJ-45 jack that has a switch with the options Hub and PC.
This is called an "uplink" port. Again it's only used when all free ether
ports are full and you need to add another computer to the system.
When using the uplink port the #1 ether port is usually disabled in
most routers and hubs.
The router assignes individual IP addresses to each machine as it is suppose to.
And these are addresses that start with 192.168 ?
To the best of my knowledge the individual machines don't have firewalls
ZoneAlarm and Outpost are the most common free ones. If a firewall
is running it will be in the System Tray.
The rub of it all is that I've had this all working fine in the past.
Corrupted NIC drivers, WindowsXX Update, registry modifications by programs,
and other things will take you beyond the past.

All I can figure is that either there is some obscure setting somewhere that
I've missed or there's a problem in #1.
I guess you missed my other question...
Have you done any configuring to the browser-based
administration of the router?

Also, have you applied any firmware upgrades to the router?
The last one is dated July 25 2001 version 2.05 (http://www.kmelink.net/ipproducts/us/download/hgw.html)

[Cory S. Estes]

This router only has one out port, period. That's why a hub must be used for multiple machines.

There is an "uplink" port on the hub, the instructions for the router specifically say not to use it. Again, this router doesn't have a hub built in.

The IP addresses are: 192.168.0.1 and 192.168.0.2

Ok, I see what you are saying about the firewall.... nope, none in use.

The two machines have identical NICs and drivers, Linksys.

Both machines have had all of the same Win ME updates. As fara as registry settings caused by installed programs..... well, they don't have the same programs installed.

No, haven't been to the router administration page since I originally set it up and, no, have done firmware updates to the router.

[Spider]

Originally posted by Cory S. Estes
This router only has one out port, period.
I see.
There is an "uplink" port on the hub, the instructions
for the router specifically say not to use it.
The router is capable of taking 32 computers. If your hub is full
and you need to add another computer then that is when
you would introduce another hub and plug it into the uplink port
on the original hub and after that you'd have to unplug the
computer from the original hub's #1 port.

Why the manual says "specifically say not to use it" (the uplink)
I find odd.
The two machines have identical NICs and drivers, Linksys.
I would install the latest drivers for those. Linksys change
the drivers frequently.
No, haven't been to the router administration page since I
originally set it up and, no, have done firmware updates to the router.
I'd get the router updated a.s.a.p.
Also when your in the Administration for the router make
sure you have a password set on the Administration logon.
If you need to know how to get the Admin page up let me
know and I'll give you a private message on how2. Since
it's a security issue I don't want to post the access info
publicly.

We should have a look at your startup sequence. Download
and run StartupList (http://www.spywareinfo.com/~merijn/files/startuplist.zip).
I'm thinking you may have picked up something nefarious,
the list will show if you have. You'll have to cut and paste
the output from StartupList into two replies...the list is too big
for one post.

[Cory S. Estes]

Update of what I have at this time.

The NIC drivers are already the most current.

Updated the firmware for the router and have gone through and checked all of the settings; everything is set to the defaults as they have been right along. Stopped everything and then restarted them as directed in the manual: cable modem, router, computers.

As an experiment I took the NIC out of #1, put it into another machine I had here, ran network setup on it, and mapped and shared the drive. Same problems still occur. Guess that rules out the MB and/or CPU on my #1 machine. I suppose that could say something about that particular NIC, however it has always, and still does, provide a clean and reliable connection to the Internet. I also haven't tried changing out the cables, but, again, all the cables currently in use are providing reliable Internet connections.

Have downloaded StartupList but haven't run it on both machines yet, will do that later.

[Spider]

Good job going through all that.

Both WindowsME's are up-2-date?
NetBEUI protocol installed on both?

Will await the startups on the two machines.

[Cory S. Estes]

Just unplugged the router from the hub and restarted both machines. Makes no difference, still the same locking one one if you attempt to access a mapped drive on the other and vise-versa. Also switched out cables one at a time, again no difference.

Win ME on both has been upgraded as much as available.

NetBEUI, TCP/IP, and Client for Microsoft Networks, as well as the drivers for the net cards, are installed on both machines.

I'd say this issue is starting to get my goat, but I'm afraid my goat is long gone..... working on pure unadulterated stubbornness now..... no @$^* machine is going to get the best of me!

[Cory S. Estes]

Spider,

Here is the first half of the Startup from #1:

StartupList report, 11/30/2002, 1:14:29 PM
StartupList version: 1.35.0
Started from : C:\UNZIPPED\STARTUPLIST135\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\LOGITECH\MOUSE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE
C:\PROGRAM FILES\NETROPA\SMART KEYBOARD\SMARTKBD.EXE
C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE
C:\PROGRAM FILES\DIAMOND\INCONTROL TOOLS 99\DMHKEY.EXE
C:\PROGRAM FILES\INTERVIDEO\COMMON\BIN\WINCINEMAMGR.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\PROGRAM FILES\NETROPA\SMART KEYBOARD\MEDIACTR.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\STARTUPLIST135\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
InControl Desktop Manager.lnk = C:\Program Files\Diamond\InControl Tools 99\DMHKEY.EXE
InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
EReminderdiamond = C:\Program Files\Encompass\Diamond\EReminder.exe diamond
EM_EXEC = c:\logitech\mouse\system\em_exec.exe
wcmdmgr = C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
NAV Agent = C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
Smart Keyboard = C:\Program Files\Netropa\Smart Keyboard\Smartkbd.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Weather = C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4395}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

[Cory S. Estes]

OK, here's part 2 of 2, Startup from machine #1:

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 29/11/2002, 17:23:22)

[Rename]
C:\WINDOWS\SYSTEM\ACTXPRXY.DLL=C:\WINDOWS\SYSTEM\S ET6144.TMP
C:\WINDOWS\SYSTEM\ADVPACK.DLL=C:\WINDOWS\SYSTEM\SE T6145.TMP
C:\WINDOWS\SYSTEM\ATL.DLL=C:\WINDOWS\SYSTEM\SET615 0.TMP
C:\WINDOWS\SYSTEM\BROWSELC.DLL=C:\WINDOWS\SYSTEM\S ET6151.TMP
C:\WINDOWS\SYSTEM\BROWSEUI.DLL=C:\WINDOWS\SYSTEM\S ET6152.TMP
C:\WINDOWS\SYSTEM\COMCTL32.DLL=C:\WINDOWS\SYSTEM\S ET6153.TMP
C:\WINDOWS\SYSTEM\CORPOL.DLL=C:\WINDOWS\SYSTEM\SET 6154.TMP
C:\WINDOWS\SYSTEM\DISPEX.DLL=C:\WINDOWS\SYSTEM\SET 6155.TMP
NUL=C:\WINDOWS\SYSTEM\DXTRANS.DLL
C:\WINDOWS\SYSTEM\DXTRANS.DLL=C:\WINDOWS\SYSTEM\SE T6156.TMP
NUL=C:\WINDOWS\SYSTEM\DXTMSFT.DLL
C:\WINDOWS\SYSTEM\DXTMSFT.DLL=C:\WINDOWS\SYSTEM\SE T6157.TMP
C:\WINDOWS\SYSTEM\IEPEERS.DLL=C:\WINDOWS\SYSTEM\SE T6161.TMP
C:\WINDOWS\SYSTEM\IMGUTIL.DLL=C:\WINDOWS\SYSTEM\SE T6163.TMP
C:\WINDOWS\SYSTEM\JSCRIPT.DLL=C:\WINDOWS\SYSTEM\SE T6165.TMP
C:\WINDOWS\SYSTEM\MLANG.DLL=C:\WINDOWS\SYSTEM\SET6 170.TMP
C:\WINDOWS\SYSTEM\MSHTML.DLL=C:\WINDOWS\SYSTEM\SET 6185.TMP
C:\WINDOWS\SYSTEM\MSHTML.TLB=C:\WINDOWS\SYSTEM\SET 6192.TMP
C:\WINDOWS\SYSTEM\MSHTMLED.DLL=C:\WINDOWS\SYSTEM\S ET6193.TMP
C:\WINDOWS\SYSTEM\MSLS31.DLL=C:\WINDOWS\SYSTEM\SET 6194.TMP
C:\WINDOWS\SYSTEM\SHDOCLC.DLL=C:\WINDOWS\SYSTEM\SE T61A3.TMP
C:\WINDOWS\SYSTEM\SHDOCVW.DLL=C:\WINDOWS\SYSTEM\SE T61A4.TMP
C:\WINDOWS\SYSTEM\SHFOLDER.DLL=C:\WINDOWS\SYSTEM\S ET61A5.TMP
C:\WINDOWS\SYSTEM\SHLWAPI.DLL=C:\WINDOWS\SYSTEM\SE T61A6.TMP
C:\WINDOWS\SYSTEM\URLMON.DLL=C:\WINDOWS\SYSTEM\SET 61D3.TMP
C:\WINDOWS\SYSTEM\WININET.DLL=C:\WINDOWS\SYSTEM\SE T61D4.TMP
C:\WINDOWS\SYSTEM\WLDAP32.DLL=C:\WINDOWS\SYSTEM\SE T61D5.TMP
NUL=C:\PROGRA~1\INTERN~1\IEXPLORE.EXE
C:\PROGRA~1\INTERN~1\IEXPLORE.EXE=C:\PROGRA~1\INTE RN~1\SET61E2.TMP
C:\WINDOWS\SYSTEM\WEBCHECK.DLL=C:\WINDOWS\SYSTEM\S ET6241.TMP
C:\WINDOWS\SYSTEM\MSIDLE.DLL=C:\WINDOWS\SYSTEM\SET 6242.TMP
C:\WINDOWS\SYSTEM\SENS.DLL=C:\WINDOWS\SYSTEM\SET62 43.TMP
C:\WINDOWS\SYSTEM\SENSAPI.DLL=C:\WINDOWS\SYSTEM\SE T6244.TMP
C:\WINDOWS\SYSTEM\ES.DLL=C:\WINDOWS\SYSTEM\SET6245 .TMP
C:\WINDOWS\SYSTEM\ESSHARED.DLL=C:\WINDOWS\SYSTEM\S ET6246.TMP
C:\WINDOWS\SYSTEM\ESTIER2.DLL=C:\WINDOWS\SYSTEM\SE T6247.TMP
C:\WINDOWS\SYSTEM\dispex.dll=C:\WINDOWS\SYSTEM\dis pex.001
C:\WINDOWS\SYSTEM\jscript.dll=C:\WINDOWS\SYSTEM\js cript.001
C:\WINDOWS\SYSTEM\vbscript.dll=C:\WINDOWS\SYSTEM\v bscript.001

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

@C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

c:\logitech\mouse\mouse.exe

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
iWon BHO - C:\PROGRAM FILES\IWON\IWONBAR\1.BIN\IWONBAR.DLL - {C298FB42-E3E2-11D3-ADCD-0050DAC24E8F}
iWon Search Assistant BHO - C:\PROGRAM FILES\IWON\SRCHASTT\1.BIN\I1SRCHAS.DLL - {08E1C8E1-E565-44fc-A766-C9539BB3ABB7}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Symantec NetDetect.job
Norton SystemWorks One Button Checkup.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[{9DBAFCCF-592F-FFFF-FFFF-00608CEC297C}]
CODEBASE = http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab

[WildTangent Control]
InProcServer32 = C:\WINDOWS\WT\WEBDRIVER\WEBDRIVER.DLL
CODEBASE = http://www.wildtangent.com/install/wdriver/racing/rcriot2/zone/wtinst.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[AlternaTIFF ActiveX Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ALTTIFF.OCX
CODEBASE = http://www.alternatiff.com/install/00/alttiff.cab

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1044/V31Controls/x86/mil/en/actsetup.cab

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2002092801/housecall.antivirus.com/housecall/xscan53.cab

[Register Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\HWUTILS.DLL
CODEBASE = http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.30/Hiwire.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37588.5754976852

[iWon Progressive Counter]
InProcServer32 = C:\PROGRAM FILES\IWON\IWONSLOT\1.BIN\IWONSLOT.DLL
CODEBASE = http://download.iwon.com/ct/pm3/iwonpm_5_1,0,2,5.cab

[FlashXControl Object]
InProcServer32 = C:\WINDOWS\SYSTEM\FLASHAX\FLASHAX.OCX
CODEBASE = https://vegastowers.microgaming.com/vegastowers/FlashAX.cab

--------------------------------------------------
End of report, 12,243 bytes
Report generated in 0.257 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


List from machine #2 to follow.

[Cory S. Estes]

And finally...... here's the startup from machine #2. It isn't as big, so it's all on one posting.

StartupList report, 11/30/2002, 1:06:26 PM
StartupList version: 1.35.0
Started from : C:\UNZIPPED\STARTUPLIST135\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\PROGRAM FILES\YAHOOKEYBOARD\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\ICQ\ICQ.EXE
C:\PROGRAM FILES\MSI\PC ALERT III\ALERT.EXE
C:\PROGRAM FILES\YAHOOKEYBOARD\MULTIMEDIA KEYBOARD\TRAYMON.EXE
C:\PROGRAM FILES\YAHOOKEYBOARD\ONSCREEN DISPLAY\OSD.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\UNZIPPED\STARTUPLIST135\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
PC Alert III.lnk = C:\Program Files\MSI\PC Alert III\alert.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SoundMan = SOUNDMAN.EXE
AtiPTA = Atiptaxx.exe
InCD = C:\Program Files\ahead\InCD\InCD.exe
INTERNET KEYBOARD = C:\Program Files\YahooKeyboard\Multimedia Keyboard\MMKeybd.exe
Mirabilis ICQ = C:\Program Files\ICQ\NDetect.exe
NAV Agent = C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MoneyAgent = C:\Program Files\Microsoft Money\System\Money Express.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run Once

ICQ = C:\PROGRAM FILES\ICQ\ICQ.EXE -trayboot

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4395}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 29/11/2002, 14:53:48)

[Rename]
C:\WINDOWS\powerpnt.ini=C:\_RESTORE\EXTRACT\powerp nt.ini
C:\WINDOWS\wavemix.ini=C:\_RESTORE\EXTRACT\wavemix .ini
C:\WINDOWS\tasks\desktop.ini=C:\_RESTORE\EXTRACT\d esktop.ini
C:\WINDOWS\win.ini=C:\_RESTORE\EXTRACT\win.ini
C:\WINDOWS\system.ini=C:\_RESTORE\EXTRACT\system.i ni
C:\WINDOWS\USER.DAT=C:\_RESTORE\EXTRACT\USER.DAT
C:\WINDOWS\SYSTEM.DAT=C:\_RESTORE\EXTRACT\SYSTEM.D AT
C:\WINDOWS\CLASSES.DAT=C:\_RESTORE\EXTRACT\CLASSES .DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;c:\;c:\dos;c:\m icromdx

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

@C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Symantec NetDetect.job
Norton SystemWorks One Button Checkup.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37587.5243287037

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL
CODEBASE = http://security.norton.com/SSC/SharedContent/common/bin/cabsa.cab

--------------------------------------------------
End of report, 8,311 bytes
Report generated in 0.477 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[Spider]

C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\SMART KEYBOARD\MEDIACTR.EXE
These two are not needed unless you really have a need for
all those extra keyboard buttons like email, connect, search, etc.
Netropia pings their server every second. Servers really dislike
Netropia because you can imagine a mulitude of Netropias all
pinging their server every second.
As far as your end is concerned it consumes a bit of resources
and comprimises your privacy.

This is a 16bit version of Install Shield
load C:\WINDOWS\WINSTART.BAT from both machines and change
@C:\WINDOWS\tmpcpyis.bat
to
rem @C:\WINDOWS\tmpcpyis.bat

IWON...oh oh!
When you play the prize machine at iwon you get injected with
this very ugly piece of spyware.

1. First go to Add/Remove Programs and look for anything "iwon"
and remove it.

2. Install and run Ad-aware on C: and the memory. Download the
Refupdater for Ad-aware and update Ad-aware before running it.
folder called "ornum" or "aornum", and delete those.

3. Search your hard drive for folders called Aornum, Ornum, Iwon.
Delete them.

4. Search the registry (regedit) for "Aornum" and delete any instance
of it. (back up reg b4 performing deletions). Then search for
"I1SRCHAS.DLL" and delete any found. Then search for "iwon".

After Ad-aware is run and the registry is cleaned and your rebooted
then bootup the "Find" on both comps and search your hard drive for
*.tmp and delete all of them.

Also look for folders (both machines)
c:\temp
c:\windows\temp
c:\windows\temporary internet files
c:\windows\cookies
delete the contents of all those folders
reboot
run Ad-aware again on C: and Memory.

On machine #2 you don't really need these in the startup
INTERNET KEYBOARD = C:\Program Files\YahooKeyboard\Multimedia Keyboard\MMKeybd.exe
InCD = C:\Program Files\ahead\InCD\InCD.exe
you can uncheck them in msconfig\startup

I'll look at these again later. Do those things I descibed for now.
I'm thinking your getting the glitch when IWON and Netropia
try and function at the same time. IWON will definitly search
for a network.

[Cory S. Estes]

I accomplished everything noted in the last post. Things run a bit faster, but the network locking problem still exists.

[Spider]

In Device Manager go to the hard drive and make sure DMA is
not selected.

I'm still thinking of what else can be done settings wise.

If the NIC card is plugged into the PCI slot closest to the AGP slot
then if you have another free PCI then you can try moving the card.

[Cory S. Estes]

Sure appreciate all the time you are spending on this.

DMA is off on both machines.

Both NICs are mounted in the bottom or next-to-the-bottom PCI slots. I'll try moving them if you think I should, but I've had IRQ problems in the past so since they seem to be sorted out and the IRQs seem to be relatively well-distributed now I hate to get into that fight again.

[Spider]

Nope, you don't want to get into moving around the Linksys NICs.

When ever I get probs with this kind of thing I pull the Linksys out
and put in a 3COM NIC and it solves the problem 99.9% of the time.
(notice I left myself a 0.1% safety excuse ;) )

Hey, no probs about helping you, that's why Cyber Tech Help
is here. MishY is the guy that makes all this possible.

[Cory S. Estes]

Well, Spider, you could have gone that extra 0.1%. I was able to borrow a new NIC today and all worked perfectly. The NIC in #2 had been checked out but the one in #1 hadn't. The beastly Linksys will recognize the network all day and cruises the Internet just fine but can't access anything on the network. I put in a new D-Link and everything worked perfectly; replaced it w/ the original Linksys and it was back to its old tricks. Two new 3Com boards are on order and will be here by the end of the week! No more of this messing around, I'll just replace 'em both and be done w/ it.

You can't believe how much I appreciate your time and effort. In the words of the immortal Gomer Pyle, "Thank you, thank you, thank you!" :wave:

[Spider]

Thanks for the kind words Cory.

I can't remember if you said what make your router was but if it's
Linksys they put up some new firmware upgrades the other day.
Ya might want to pop those in first chance you get.
http://seafoods.hypermart.net/images/wave.gif

[Cory S. Estes]

Router is a Panasonic... did firmware on it the other day. The NICs and hub are Linksys that I got as a packaged kit three or more years ago. I'll pitch the bad NIC and keep the good one in our trusty ol' PIII/500 back-up machine.