|
Home > Archive > General Discussion > September 2003 > Anybody know how to get rid of this?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Anybody know how to get rid of this?
|
|
| subnet__zero 2003-09-22, 2:58 pm |
| There's a pop up that say's on the title bar: "Shit" and on the message it say's "connection failure". This a kids computer and I'd rather not get this message. I ran Spybot and Norton AV and it still pops up. Anybody know where it's located so that I can be rid of it?
Thanks | |
| Papiya 2003-09-22, 3:11 pm |
| You can get a tool like Google's toolbar to block popups or get Zone Alarm so that only the ports you specifically allow can be accessed. | |
|
| quote:
Originally posted by subnet__zero
There's a pop up that say's on the title bar: "Shit" and on the message it say's "connection failure". This a kids computer
Thanks
try ctrl + alt + delete to bring up the task manager.
see if you can catch it running, and see it.
When does it apear?
Does it apear when the browser is open?
Is this happening at a web site that you goto or is it happening at random times? | |
| subnet__zero 2003-09-22, 3:34 pm |
| Papiya,
It happens when the PC is not connected to the I'net, so it's some other type of pop-up.
Mir92,
It happens every 2-3 minutes when the computer is not connected to the internet. When bringing up the task manager, all it say's is "shit" running. No browser is open at this time, so it's not a web site. It's something internal on the PC and I'm having difficulties finding it. | |
|
| Have you updated and run your AV prog? | |
| Deja-vue 2003-09-22, 4:29 pm |
| If it's XP or Win2000, go to Controlpanel>>Administrative Tools>>Services>>scroll down to Messenger, doubleclick on it, Startuptype: change to disabled.
(Stop the Service before you do it)
 | |
| subnet__zero 2003-09-22, 5:26 pm |
| AV definitions are current as of today.
Deja-vue-
Did as you suggested, but the pop up continues. It's just a small 1.5"x 1.5" window that opens every 2-3 mins. On it's title bar it reads "Shit" and then has the RED X to close the window. In the text area, it say's: "Connection Failure" and there is also an "OK" button to close the window.
Any other ideas? | |
| ANDRONDA 2003-09-22, 5:36 pm |
| Papiya had a good answer. Zone alarm works well for things like this. There is a freeware called "outpost firewall" that also works well. | |
| subnet__zero 2003-09-22, 5:47 pm |
| Since it's not browser initiated and there is NO outside connection and this annoying message is coming from within the system, are you saying that ZoneAlarm can prevent this type of message? | |
|
| I think the idea they are trying to get across is this.
zone alarm is acting as IDS... detecting whether there is any dailer trying to initiate any outbound connection. there may very well not be any, but it is just another form of looking around you can do I suppose.
With regard to task manager, look at not what applications are open, but what process are running... use spybot advance mode to look around to see if you can tune it a bit. install ad aware to double check result.
Looking at processes in task manager, anything suspecisou, searh google to see if anything turn out. stop services etc etc. look at hmmmmm system startup, there may be something loaded that would appear legit.
put your kids through a lie detctor... grind them tell they fess up what kind of ill repute site they been to... ;/
edit: and of course, when doing this, with zonealarm etc, change policy to most restrictive, remove port 80 etc etc so you can catch all attempt to access/dial out. | |
| mindmesh 2003-09-22, 7:45 pm |
| try a search for "shit" on your HD and in your Registry. See what you find. Check your Add/Remove Programs for anything that doesn't seem like it should be there. Do a search for dialers, xxx, xx, adult, porn, teen, slut, etc. and see what you come up with.. Just an idea but if the apps aren't finding it you may be able to manually.
Good luck. | |
| Tarzanboy 2003-09-22, 7:56 pm |
| It looks like a simple script popup window, however it could be caused by a script (VBS/WSF) or application.
It's possible that this could have arisen on the system via 3rd party installer, web page installation or through something like a P2P app.
1. Turn on Show Hidden Files and Folders as well as Show System files.
2. Check to see what is in your startup group in Windows, both on the start menu and in MSConfig. If you don't know what it is, check into it and if you can't find info on it, disable it.
3. Delete the contents of your Temporary folders, %systemroot%\temp, %userprofile%\local settings\temp and %userprofile%\local settings\temporary internet files
4. Run a virus scan
5. Perform a search on your system for VBS or WSF files, as there shouldn't be any.
6. Try using sigverif from the run line to make sure critical files have not been tampered with.
Cheers,
TB | |
| enforcer 2003-09-23, 8:27 am |
| TB's covered what i was going to suggest and some, nice list TB.
if none of that does it Format c: is a nice command 
oh! mikops suggestion about the processes section of task manager is good, it should show you the filename of the program which is running it. then you can look on your harddrive for that file, and also on the startups via msconfig to see where it is starting from.
Good luck,
oh! and don't take the format c: too seriously. | |
| subnet__zero 2003-09-23, 8:55 am |
| OK, I found it by doing the selective startup in MSCONFIG (thought I had done that already) and unchecking everything and then checking one item at a time and restarting. Finally, something called "mscman.exe" in the CientMan folder was the culprit. So, I got rid of it in the registry and then had to unregister the .dll's in the ClientMan folder in order to delete the ClientMan folder. After doing an internet search, it turns out the culprit is a piece of spyware (surprise) that started showing up in April '03. I had tried Spybot, with the latest updates and it didn't find it which surprises me.
So, much THANKS Tarzanboy for the wakeup call re: MSCONFIG. Also, thanks to everyone for your help as well. | |
| rathore 2003-09-23, 9:05 am |
| ZONE ALARM & NORTON ANTIVIRUS are always my 1st choice 2 protect the PC from these types of prob's. | |
| enforcer 2003-09-23, 10:47 am |
| msconfig is a lovely litle friend | |
| Tarzanboy 2003-09-23, 8:55 pm |
| Glad it helped out.
Cheers,
TB | |
| Helen of Troy 2003-09-23, 9:07 pm |
| ok if u hav data then bckup now.
U no that fornart C: feeling?
Who cares?
Not me? | |
| Helen of Troy 2003-09-24, 4:27 am |
| Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
Um stupid people I hate to inform you of this but sys.exe will NOT remove Win 2000 bo
Meant .... ot managers.
SYS
Purpose
Transfers the operating system files IBMBIO.COM and IBMDOS.COM -- from the source drive to the target drive.
Do you see that?
It's IBM and that's what sys.exe does!!! LMAO!
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 04:04 PM IP: Logged
enforcer
Confusion Master
Registered: Jun 2002
Location: London
Country: United Kingdom
State:
Certifications: MCSE NT4, MCP 2K
Working on: MCSE 2K 216,217 MCSA 2K 218
Total Posts: 7679
Confusion says:
Theory and book learning is all well and good, but doing things in the real world is where you will find the truth.
I have many dual boot machines ie win98 first on the drive, and win2k added on a second partition, and to remove win2000 I have deleted the partition, and the sys c: from a win98 to remove the win2000 boot manager, so it boots like a basic win 98 machine.
that is why I said try it. please read the original post by the thread starter and you will see that is how his PC was set up.
case closed.
__________________
The Enforcer MCSE
Mission statement : To change and deviate from the subject at the earliest opportunity.
Please do not ask for credit, as the phrase fcuk off, often offends.
If at first you don't succeed . . . . . Delegate
Moderator:
Examnotes
Freaks Forum
Soccer at PatrotsWeekley
iCertify Forum
EZCertification Forum
Report this post to a moderator
09-23-03 04:28 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
Did you lock the thread?
You didn't do that again did you??
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 04:40 PM IP: Logged
Tech Ranger
On A Mission
M
Registered: Feb 2002
Location: Brooklyn
Country: United States
State:
Certifications: MCSA, MCP(210,215,217,218,219), Server+, Network+, I-Net+, A+
Working on: MCSE (216 at the moment)
Total Posts: 4605
Helen, why are you getting so bent out of shape over a thing like this?
__________________
The Computer is a creation of man. Man is a creation of God! -
Joe from Brooklyn
Report this post to a moderator
09-23-03 06:34 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
quote:
--------------------------------------------------------------------------------
Originally posted by Tech Ranger
Helen, why are you getting so bent out of shape over a thing like this?
--------------------------------------------------------------------------------
I have recently expounded *Employability Factor Zero .... *
I achieved this feat with a Helium Bomb.
U?
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 06:43 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
O Helium bomb U suck XXX and I am considering the Neutronium option ....
Let us pray ...
[U & I]
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 06:47 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
Well?? LMAO!!
??
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 11:13 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
By the way.
Another way of deleting the boot manager is by using Fdisk. Quite an interesting little program.
I suppose that if all else failed you would boot into Windows 2000 even given the fact that the evaluation period had expired and delete the boot manager from Disk Administrator.
Your turn.
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 11:29 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
Despite the boot manager, why don't you just choose the Windows 98 option?
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 11:35 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 126
Can you sys.exe the boot manager?
I don't know but I might try it later.
__________________
I am currently up for hire.
Report this post to a moderator | |
| Helen of Troy 2003-09-24, 4:33 am |
| Despite the boot manager, why not just boot into Windows 2000?
Sorry, I forgot.
You deleted that partition because the evaluation period self-destructed!
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 11:45 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
Try F-Eighting when you boot up --- that will give you even MORE boot up managerial options!!
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 11:49 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
Why did you format the disk and place on it Windows 98 when you could have had Windows 2000?
I don't know. Why did I format the disk and place on it Windows 98 when I could have had Windows 2000?
Search me!
__________________
I am currently up for hire.
Report this post to a moderator
09-23-03 11:55 PM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
I too have many machines with that particular dual boot scenario. When those evaluation copies ran out then I too seeked to sys.exe them all back to Windows 98 as one rightfully should in this particular cluster server time-lapsed situation!!
__________________
I am currently up for hire.
Report this post to a moderator
09-24-03 12:07 AM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
Though this resulted in a few hours of downtime I did however realise that I now had the virus-free edition I'd been looking for for all those years.
Case closed!
__________________
I am currently up for hire.
Report this post to a moderator
09-24-03 12:09 AM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
It is at your friend's house??
I am a very horny girl!! ....
__________________
I am currently up for hire.
Report this post to a moderator
09-24-03 12:16 AM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
Boddington's --- By Heck Yup!
My server is well and truly broken.
It is the 120 day evaluation period syndrome thing again.
I've been shuffling thru the drawers and all that dirty laundry.
And guess what?
I've come up with a copy of Windows 98 SE!
I have always wanted an operating system that goes faster than Windows 95 and by heck sweetie I think I found it now!
Can you cure this glitch on my lousy P/C?
Well can ya?
Punk.
LMAO!!!
__________________
I am currently up for hire.
Report this post to a moderator
09-24-03 12:23 AM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
Back to the original question ...
My question is does the mbr of the floppy get transferred to the mbr of the hard drive during fdisk /mbr?
---------------------------------------------
Yes.
__________________
I am currently up for hire.
Report this post to a moderator
09-24-03 12:31 AM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
I tried earlier with a dual boot scenario with Win 98 and 2000 in the real world and it worked.
Why don't you get a life?????
__________________
I am currently up for hire.
Report this post to a moderator
09-24-03 12:33 AM IP: Logged
Helen of Troy
Senior Member
F
Registered: Mar 2003
Location: Croydon
Country: United Kingdom
State:
Certifications: P.H.D. Masters in Mathematics (acquired recently)
Working on:
Total Posts: 132
The mbr of the floppy?
Choose the Mr. Floppy option.
[Whoever you are!!]
Just my opinion.
It's a completely free consultative opinion ...
__________________
I am currently up for hire.
Report this post to a moderator | |
| Helen of Troy 2003-09-24, 4:41 am |
| So Enforcer.
Why did you consider it your mission in Life to edit the uneditable?
Explain me ENFORCER.
U do now Enforcer.
We want no.
We want U XXXX!!!
We get U just like that IMO. | |
| MistyRing 2003-09-24, 7:55 am |
| Congrats Dick, someone gave your other post a Number 1 rating. Maybe you have secret admirers? | |
| enforcer 2003-09-24, 7:57 am |
| quote:
Originally posted by MistyRing
Congrats Dick, someone gave your other post a Number 1 rating. Maybe you have secret admirers?
that was me, check what a number 1 rating means  | |
| MistyRing 2003-09-24, 8:07 am |
| Ah now it becomes clear. No 1 is an odd choice though. | |
| enforcer 2003-09-24, 8:21 am |
| I think it's a star rating, like that for hotels.
would you ever stay in a 1 star hotel? | |
| FsuJDPhD 2003-09-24, 9:50 am |
| Hi there! Ok -- I realize that I am WAY out of my league on this site -- however, I'm having the problem with the "connection failure" error (arguably due to mscman.exe as well) mentioned below, and it looks like you may be the only guys who can help me. Since I do have a fairly broad knowledge of computers (although, admittedly I'm not a network engineer or anything even close), I'm wondering if you could walk me through the steps to get rid of this thing. I understand most of what was said in the posts leading up to this -- but, I just don't want to do anything that will create a horrible situation on my computer - so any specific help you could provide with items such as "selective startup in MSCONFIG and unregistering .dll's would be VERY MUCH appreciated. By the way, I too, tried Spybot with the latest updates to no avail. Thanks, in advance, for helping the new kid!
quote:
Originally posted by subnet__zero
OK, I found it by doing the selective startup in MSCONFIG (thought I had done that already) and unchecking everything and then checking one item at a time and restarting. Finally, something called "mscman.exe" in the CientMan folder was the culprit. So, I got rid of it in the registry and then had to unregister the .dll's in the ClientMan folder in order to delete the ClientMan folder. After doing an internet search, it turns out the culprit is a piece of spyware (surprise) that started showing up in April '03. I had tried Spybot, with the latest updates and it didn't find it which surprises me.
So, much THANKS Tarzanboy for the wakeup call re: MSCONFIG. Also, thanks to everyone for your help as well.
| |
| enforcer 2003-09-24, 10:49 am |
| What OS are you running?
do you have msconfig on your PC? | |
| FsuJDPhD 2003-09-24, 10:56 am |
| Windows XP and... I would presume, although, I'm not with that computer at the moment
quote:
Originally posted by enforcer
What OS are you running?
do you have msconfig on your PC?
| |
| enforcer 2003-09-24, 11:14 am |
| Don't think XP has msconfig included, you may have to download off the net, do a google search for msconfig and XP there may be a slightly different version for xp
then when you run it, there will be different tabs, the last one is 'startup'
in there thee is a list of files that run on startup, if you uncheck the box next to it, it will no longer run on startup.
you will then have to reboot to activate the new settings, you should then delete the offending file (do a search of the harddrive to find it)
good luck | |
| Tarzanboy 2003-09-24, 12:21 pm |
| XP has msconfig, 2k does not, but it can be put on.
Cheers,
TB | |
| enforcer 2003-09-24, 12:23 pm |
| quote:
Originally posted by Tarzanboy
XP has msconfig, 2k does not, but it can be put on.
Cheers,
TB
I knew 2000 didn't wasn't sure of XP.
thanks for the update | |
| FsuJDPhD 2003-09-25, 9:04 am |
| Thanks to everyone who helped with this! That nasty little spyware is gone! Have a great day! | |
| allencf 2003-09-29, 12:06 pm |
| Ad-aware can remove any and all spyware located on your pc. Which is what this sounds like. It can be found at www.downloads.com. It is FREE. Awesome program.
Craig | |
| Papiya 2003-09-29, 12:32 pm |
| Spybot is also quite handy. | |
| FsuJDPhD 2003-09-29, 12:40 pm |
| Hi again! Actually, I tried both Spybot and Ad-aware. Neither caught this nasty little bug. However, taking the msconfig route solved the problem. Just FYI. Thanks anyway for the suggestion, and have a great day!
Krista
quote:
Originally posted by allencf
Ad-aware can remove any and all spyware located on your pc. Which is what this sounds like. It can be found at www.downloads.com. It is FREE. Awesome program.
Craig
| |
| firerider1 2003-09-29, 9:21 pm |
| I know others have said to check your task manager, but I'm not sure what you've tried yet.
Does it look like an application window or an internet browser window?
If it's a file web page that's been written to your hard drive to launch, you may be able to find and delete it by doing a text search for shit. Then you'll get an error message saying the shortcut couldn't be located which may tell you what to delete from startup.
-- Never mind. I saw you fixed this. | |
| Helen of Troy 2003-09-30, 7:45 am |
| There's a pop up that say's on the title bar: "Shit" and on the message it say's "connection failure". This a kids computer and I'd rather not get this message. I ran Spybot and Norton AV and it still pops up. Anybody know where it's located so that I can be rid of it?
Thanks
---------------------------------------------
Backup + Format = ShXtFree Environment
[You decide not me.] |
|
|
|
|