computer crashing/help sponge

[Mr. Sandman]

I'm am posting this here because this is where I found the information
too change the configs that are now causing me a problem. I am running
XP and K-melon browser. Well I followed sponges guide for securing my
computer too the letter. I have the Proxomitron, DNS Kong and Sponges
list 3 for Kerio. Now sometimes when I go too a new web page I get a
blue screen and my computer re boots. Any Ideas?

[Mr. Sandman]

"Adriano" <ashuat@hotmail.com> wrote in message
news:4ok4mvgrorhngems0f8nh85lkv0dfdl2tf@4ax.com...
> Hi,
> I think I have taken a virus, in fact every 10 minutes of navigation
> in Internet, my PC automatically reboots.
> My antivirus found a virus but it has not succeeded in putting it in
> quarantine. I have manually deleted it in "Attach" of Eudora.
> I have run the tools to eliminate "Sobig" and "Lovsan" viruses but
> they have not found anything. I have run again the antivirus but
> nothing of nothing.
> Which virus could I have taken?

Not everything is a virus. If you're using XP, it has a nasty feature
enabled by default. If you go into System Properties, Advanced and
then
Settings for Startup and Recovery, you'll see an option to
automatically
reboot. Keep in mind this won't prevent you from experiencing SOME
kind of
error; your system just won't reboot anymore.

-Tim


> Thanks.
>
> bye Adriano

This might be the answer

[sponge]

Mr. Sandman <IBEW_Wireman@union.yes> wrote in message news:<d5i4mvc63h6s13ijvuui6i4327mpkls871@4ax.com>. ..
> I'm am posting this here because this is where I found the information
> too change the configs that are now causing me a problem. I am running
> XP and K-melon browser. Well I followed sponges guide for securing my
> computer too the letter. I have the Proxomitron, DNS Kong and Sponges
> list 3 for Kerio. Now sometimes when I go too a new web page I get a
> blue screen and my computer re boots. Any Ideas?

Aside from the other posters(?) advice, it could well be a
virus/trojan, one that your anti-virus software doesn't recognize.

I'm also thinking it may have to do with your system's being able to
access the net. Have you allowed SVCHOST.EXE to access the net thru
Kerio?

Sponge
Sponge's Anti-Spyware Source
www.geocities.com/yosponge

[Lance Delacroix]

On Fri, 12 Sep 2003 22:38:43 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
prounounced a fatwah thus:

>I'm am posting this here because this is where I found the information
>too change the configs that are now causing me a problem. I am running
>XP and K-melon browser. Well I followed sponges guide for securing my
>computer too the letter. I have the Proxomitron, DNS Kong and Sponges
>list 3 for Kerio. Now sometimes when I go too a new web page I get a
>blue screen and my computer re boots. Any Ideas?

ANY new web page, or specific web pages?

[Mr. Sandman]

On Sat, 13 Sep 2003 16:57:27 +0300, Lance Delacroix
<lance_delacroix@fastmail.fm> wrote:


>ANY new web page, or specific web pages?

No specific or new web pages. It appears too be a random event.

Aside from the other posters(?) advice, it could well be a
virus/trojan, one that your anti-virus software doesn't recognize.

I'm also thinking it may have to do with your system's being able to
access the net. Have you allowed SVCHOST.EXE to access the net thru
Kerio?

Sponge
Sponge's Anti-Spyware Source
www.geocities.com/yosponge

I don't appear too have a rule for SVCHOST.EXE. Also I haven't had the
problem yet since I disabled the automatic reboot feature. But since
this was a random experience I will give it some more time. I will
also add a rule for the above file.

[Mr. Sandman]

On Sun, 14 Sep 2003 12:54:26 +0300, Lance Delacroix
<lance_delacroix@fastmail.fm> wrote:

>On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
>prounounced a fatwah thus:
>
>>On Sat, 13 Sep 2003 16:57:27 +0300, Lance Delacroix
>><lance_delacroix@fastmail.fm> wrote:
>>
>>
>>>ANY new web page, or specific web pages?
>>
>>No specific or new web pages. It appears too be a random event.
>
>Try using Mozilla instead of K-meleon and see what happens. I think I
>had wierd probs with K-m, too. Finally stopped using it.

I just crashed again, took quite a while, like I said this has been a
random event. Dont think changing browsers is the answer as this has
happened with different browsers. I think it is in the networking
congig.

[Mr. Sandman]

Is there a way too check logs? Then I could find out "why " I am
crashing?

[Lance Delacroix]

On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
prounounced a fatwah thus:

>On Sat, 13 Sep 2003 16:57:27 +0300, Lance Delacroix
><lance_delacroix@fastmail.fm> wrote:
>
>
>>ANY new web page, or specific web pages?
>
>No specific or new web pages. It appears too be a random event.

Try using Mozilla instead of K-meleon and see what happens. I think I
had wierd probs with K-m, too. Finally stopped using it.

[sponge]

On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
wrote:

How's your disk space? Windows gets real screwy when it gets low on
disk space. And even half a gig is low by Windows standards. You can
run scandisk (or whatever the equivalent is in XP) to check it out;
sometimes you have a lot less than the OS reports.

If that doesn't work, try shutting off the firewall for a bit. You can
disable it from running at startup from the Adminstration - >
Miscellaneous menu. This and the NetBIOS config is the only thing from
my page that could potentially cause a system crash or reboot (short
of something extraordinary, like a bad file write.)

I'm also curious to know what you have running. Get HiJackThis! to
find out and post a log here.

Sponge
Sponge's Anti-Spyware Source
www.geocities.com/yosponge

[Mr. Sandman]

On 14 Sep 2003 16:04:42 -0700, yosponge@yahoo.com (sponge) wrote:

>On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
>wrote:
>
>How's your disk space? Windows gets real screwy when it gets low on
>disk space. And even half a gig is low by Windows standards. You can
>run scandisk (or whatever the equivalent is in XP) to check it out;
>sometimes you have a lot less than the OS reports.
>
>If that doesn't work, try shutting off the firewall for a bit. You can
>disable it from running at startup from the Adminstration - >
>Miscellaneous menu. This and the NetBIOS config is the only thing from
>my page that could potentially cause a system crash or reboot (short
>of something extraordinary, like a bad file write.)
>
>I'm also curious to know what you have running. Get HiJackThis! to
>find out and post a log here.
>
>Sponge
>Sponge's Anti-Spyware Source
>www.geocities.com/yosponge

First of all thank you for taking the time too help me try and figure
this out. I am pretty much a newbie but am trying too learn. I have
17.7GB of hard drive space. It is a confusing problem because it is so
random. Thank you again for any help.

Logfile of HijackThis v1.96.0
Scan saved at 7:50:44 PM, on 9/14/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ICO.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\Evidence Eliminator\ee.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Pyrenean\DNSKong\DNSKong.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Proxomitron Naoko-4\Proxomitron.exe
C:\Program Files\Agent\agent.exe
C:\Documents and Settings\d and l\My
Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.insightbb.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.insightbb.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
= about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
IBEW
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyServer =
ftp=127.0.0.1:8080;gopher=127.0.0.1:8080;http=127. 0.0.1:8080;https=127.0.0.1:8080;socks=127.0.0.1:80 80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyOverride = <local>
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page =
http://www.microsoft.com/isapi/redir...e5update&O1=b1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and
Settings\d and l\Application
Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
N3 - Netscape 7: user_pref("browser.search.defaultengine",
"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_01.src");
(C:\Documents and Settings\d and l\Application
Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} -
C:\Program Files\Zero Knowledge\Freedom\freebhor.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton
SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
-k
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [POINTER]
C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\My Shared Folder\software\Norton
SystemWorks 2003-Retail\norton\FASTSAFE\QDCSFS.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
/STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [AVG7_RegCleaner]
C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero
Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence
Eliminator\ee.exe /m
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather
Channel\The Weather Channel.exe
O4 - Startup: DNSKong.lnk = C:\Program
Files\Pyrenean\DNSKong\DNSKong.exe
O4 - Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie
Software\MemTurbo\memturbo.exe
O4 - Startup: proxomitron.lnk = C:\Program Files\Proxomitron
Naoko-4\Proxomitron.exe
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone
Labs\ZoneAlarm\zonealarm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
present
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.co...?1059844265546
O17 -
HKLM\System\CCS\Services\Tcpip\..\{5F3482F9-45D5-46AB-86E7-AFA29D8F6707}:
NameServer =
127.0.0.1,63.240.76.5,204.127.202.5,204.127.198.5, 216.148.227.75