Dialup networking and modem problems...

First thing to do is to UNINSTALL NAV!!!! - it's not compatible with ME,
despite all assertions by Symantec.

Once that's done......
You may have a virus/spyware hijack

download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://download.nai.com/products/mca...rt/stinger.exe

- update your virus scanner and run a full system scan of all files.

Reboot to Safe Mode and run CWShredder - to remove variants of the
CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Use CWShredder, the removal tool:
http://www.merijn.org/files/cwshredder.zip
http://www.merijn.org/files/CWShredder.exe
http://www.spywareinfo.com/downloads...CWShredder.exe
http://www.zerosrealm.com/downloads/CWShredder.zip

download AdAware from www.lavasoftusa.com, install, update, and run it to
remove spyware, adware,
and other such nasties from your system.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Tegger®" wrote in message
.. .
I've been asked to fix a dialup problem on a computer.

Specs:
Dell desktop of some kind (sorry)
Windows ME (no Windows Updates *ever*)
Norton AntiVirus 2004 (installed AFTER the problems started Saturday)
Lucent Win Modem (model unknown)

Specifically, the problems are these:
1) Dialup fails with "error 633", saying it can't find the modem

2) Norton AntiVirus AutoProtect will not start. Error is "tapisrv.exe has
caused an error...". You can start the interface, but can't click on the
Enable button without getting the error

3) Whenever you open NAV and try to start AutoProtect, it also attempts to
start the dialup connection to the Internet

4) Cannot make a New Connection in DUN because the modem cannot be found

5) Modem *is* present and responds correctly to Diagnostics in the Modem
Control Panel

6) Modem can also be accessed directly through its COM port in
HyperTerminal. ati commands return correct data. Did not try atdt,
though...

7) All OE dbx and wab files were overwritten with new ones

8) CPU usage goes to 100% after dialup attempted


Additionally, there a
No suspicious entries in Registry under the Run keys
No new DLLs or other suspicious files that I can find
No odd Tasks listed in Task Manager

I am many miles way from this machine at the moment. At this point I
cannot
tell whether it's a virus, corrupted Dialup Networking or something else.

Any guidance here for when I do get a chance to work on the computer?
Googling brings up nothing good.

--
TeGGeR®

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (personal free version)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download sysclean.com and place it in that directory.
Dowload the signature files (pattern files) by obtaining the ZIP file.
For example; lpt194.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point
10) Please report back your results

Dave






"Tegger®" wrote in message
.. .
| I've been asked to fix a dialup problem on a computer.
|
| Specs:
| Dell desktop of some kind (sorry)
| Windows ME (no Windows Updates *ever*)
| Norton AntiVirus 2004 (installed AFTER the problems started Saturday)
| Lucent Win Modem (model unknown)
|
| Specifically, the problems are these:
| 1) Dialup fails with "error 633", saying it can't find the modem
|
| 2) Norton AntiVirus AutoProtect will not start. Error is "tapisrv.exe has
| caused an error...". You can start the interface, but can't click on the
| Enable button without getting the error
|
| 3) Whenever you open NAV and try to start AutoProtect, it also attempts to
| start the dialup connection to the Internet
|
| 4) Cannot make a New Connection in DUN because the modem cannot be found
|
| 5) Modem *is* present and responds correctly to Diagnostics in the Modem
| Control Panel
|
| 6) Modem can also be accessed directly through its COM port in
| HyperTerminal. ati commands return correct data. Did not try atdt,
| though...
|
| 7) All OE dbx and wab files were overwritten with new ones
|
| 8) CPU usage goes to 100% after dialup attempted
|
|
| Additionally, there a
| No suspicious entries in Registry under the Run keys
| No new DLLs or other suspicious files that I can find
| No odd Tasks listed in Task Manager
|
| I am many miles way from this machine at the moment. At this point I cannot
| tell whether it's a virus, corrupted Dialup Networking or something else.
|
| Any guidance here for when I do get a chance to work on the computer?
| Googling brings up nothing good.
|
| --
| TeGGeR®
|

not an uncommon circumstance, really - I've dealt with a few of those
myself, and some have come from drive-by installs of spyware, loading
trojans which then proceed to take over the machine.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Tegger®" wrote in message
...
"Noel Paton" sprach im
:

The owner insists she did not click "Yes" to any popups and did not open
any attachments other than data files for work. However, those data files
include Word docs and jpegs, and she's totally unpatched, so...


--
TeGGeR®

"Tegger®" wrote in message
.. .
I've been asked to fix a dialup problem on a computer.

Specs:
Dell desktop of some kind (sorry)
Windows ME (no Windows Updates *ever*)
Norton AntiVirus 2004 (installed AFTER the problems started Saturday)
Lucent Win Modem (model unknown)

Specifically, the problems are these:
1) Dialup fails with "error 633", saying it can't find the modem

2) Norton AntiVirus AutoProtect will not start. Error is "tapisrv.exe has
caused an error...". You can start the interface, but can't click on the
Enable button without getting the error

3) Whenever you open NAV and try to start AutoProtect, it also attempts to
start the dialup connection to the Internet

4) Cannot make a New Connection in DUN because the modem cannot be found

5) Modem *is* present and responds correctly to Diagnostics in the Modem
Control Panel

6) Modem can also be accessed directly through its COM port in
HyperTerminal. ati commands return correct data. Did not try atdt,
though...

7) All OE dbx and wab files were overwritten with new ones

8) CPU usage goes to 100% after dialup attempted


Additionally, there a
No suspicious entries in Registry under the Run keys
No new DLLs or other suspicious files that I can find
No odd Tasks listed in Task Manager

I am many miles way from this machine at the moment. At this point I
cannot
tell whether it's a virus, corrupted Dialup Networking or something else.

Any guidance here for when I do get a chance to work on the computer?

What I know about ME is that it's somewhat different then Win98 so I'll
tell you what I'd do with that OS. Boot up in Safe Mode, go to Device
Manager and double-click on Modem. Remove all that's there (should be only
one entry but often there's more) and reboot. Windows should detect the
modem and reinstall it, hopefully correctly this time. It's a bad idea to
use Norton anything.

"Tegger®" wrote in
:

I've been asked to fix a dialup problem on a computer.

Specs:
Dell desktop of some kind (sorry)
Windows ME (no Windows Updates *ever*)
Norton AntiVirus 2004 (installed AFTER the problems started Saturday)
Lucent Win Modem (model unknown)

Specifically, the problems are these:
1) Dialup fails with "error 633", saying it can't find the modem

2) Norton AntiVirus AutoProtect will not start. Error is "tapisrv.exe
has caused an error...". You can start the interface, but can't click
on the Enable button without getting the error

3) Whenever you open NAV and try to start AutoProtect, it also
attempts to start the dialup connection to the Internet

4) Cannot make a New Connection in DUN because the modem cannot be
found

5) Modem *is* present and responds correctly to Diagnostics in the
Modem Control Panel

6) Modem can also be accessed directly through its COM port in
HyperTerminal. ati commands return correct data. Did not try atdt,
though...

7) All OE dbx and wab files were overwritten with new ones

8) CPU usage goes to 100% after dialup attempted


Additionally, there a
No suspicious entries in Registry under the Run keys
No new DLLs or other suspicious files that I can find
No odd Tasks listed in Task Manager

I am many miles way from this machine at the moment. At this point I
cannot tell whether it's a virus, corrupted Dialup Networking or
something else.

Any guidance here for when I do get a chance to work on the computer?
Googling brings up nothing good.


Possibly caused by spyware; try LSP-Fix.
http://www.cexx.org/lspfix.htm

That won't work in the long term, as, if you look in the autoexec.bat file
now, it'll be empty again, except for the environment variables - since ME
doesn't process either config.sys or autoexec.bat in the normal way (it
reads the content at shutdown, and extract the environment variables for the
next boot, then discards the rest).

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Tegger®" wrote in message
.. .
"Tegger®" sprach im
:
In an attempt to prevent this from happening again, I added a line to the
AUTOEXEC.BAT in the root of the C: drive, simply deleting the INI file.
Seems to work so far...

--
TeGGeR®

A better thing to do would be to ensure that the WININIT.INI file isn't
created in the first place, unless it's actually needed (and it IS needed
for a lot of installs/updates/etc...)

before shutting down next time, open the file in Notepad, and make a note of
the contents

look at the target files (to the right of the = sign), in Windows Explorer,
and see if their Properties give you any idea as to what they come from -
and scan them with an anti-virus and spyware scanner. If not, then try
seraching for the filenames in Google and see if you get any joy.

....or even post the contents of the WININIT.INI file back here, and I'll
take a stab at guessing what it means,


--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Tegger®" wrote in message
.. .
"Noel Paton" sprach im
:

That won't work in the long term, as, if you look in the autoexec.bat
file now, it'll be empty again, except for the environment variables -
since ME doesn't process either config.sys or autoexec.bat in the
normal way (it reads the content at shutdown, and extract the
environment variables for the next boot, then discards the rest).



Hmm. Didn't know to check that, and I'm not near that machine any more.

Then how do I ensure that the WININIT.INI file is deleted before Windows
looks for it at the next reboot?

If I add something to a Run line in the Registry, it will be read *after*
the error occurs.

Is there some other file I can add a line to that is either read on
shutdown, or read on startup before Windows starts?

--
TeGGeR®

BTDT - good luck!

My usual tack is something along the lines of 'There's just been an
update.....' together with ' I bet you've already found....' and 'do you
want to find that you're pick your own verb next time you need IE to work
properly?'



--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Tegger®" wrote in message
.. .
.. The owner is an artist that does work at home for a company I do
work for. She's the sort that refuses to cooperate with any and all
efforts
at maintenance and configuration until something goes seriously wrong,
which is frustrating for me.


--
TeGGeR®