comp keeps timing out.

Um,, Hi PCR..

Dont know if I'm gonna get a slap on the wrist for this, but I just
restored the Registry (scanreg /restore) to a date that was two years
ago...

Before I did it, I add/rem'd Kerio because I think I made a right ol'
balls-up of it.

Yes, I know I am going to be re-configuring for a long time to come, I
already had to make a new internet connection with my latest password etc.

I just couldnt take it anymore, the modem drop outs were driving me
around the proverbial(put in anything you want here).
I dont know if this will fix it, but surely I couldnt do any worse at
this stage.... I'll keep you posted as to what happens.
(Also, any reference to that 'fraudloader' thing shouldnt be there
anymore..... hopefully, or any other thing that may or may not have
been responsible for my problems.)

Now that I know a swag more about Kerio, it will only take a few seconds
to re-load it, and I am going to ask someone I know if they would be
with me when I do it. At least I have all the links to the set-up
sites now, and know where to get the latest definitions from.

S/C

Hi PCR,

Phew, what a wonderful eventful last 2 hours I've had.. ha ha.

Here is my latest good friend::

1)clock was stuffed

2)Avast didnt know who I was

3)Internet connection didnt know who I was.

4)Desktop icons a mess

5)Certain drivers had to be installed by windows.. inc, modem.

6)Anything you can think of pcr that I might have missed??

7)USB stick re-installed..(never told you that i got a new one about 2
months ago, and it supports 98... I didnt have to do a damn thing..
and was cheap tool.)

8)my 'ScanReg Auto' is back in my Msconfig startup..(hasnt been there
for ages, and I didnt want to 'adjust' registry to fix it.. I followed
a post that someone put in here about a year ago who had the same
problem,, and the 'fix' was to mess with the registry, or merge
something or other.. but I didnt want to do it.)
I will probably lose my ability to go back two years because of it, but
at least I now have a virus free computer.

9)Ooops,, forget the above, I just ran SpyBot and it picked up this::
"ZLOB.DNSChanger"
I did all of this while not connected to the internet, plus I went to
the registry to do a Find on Zlob before I told SpyBot to 'fix' it;;
this is what I found in the Registry.::
--------------

HKey\CurrentUser\Software\PepiMK Software\RegAlyzer here it shows
"zlob" nothing more

HKey\Users\Software\PepiMK Software\RegAlyzer shows the same

-----------

SpyBot shows it as
Hkey_Local_Machine\Software\Microsoft\Windows\CurrentVersion\kdid
----------------


RegAlyzer is just a third party version of 'regedit',, something I
downloaded years ago when I thought I was going to be a smarty-bum
technical computer guy/user. Anyhow, its not a problem, and if
anything it may just have logged it.

The 'KDID' seems to be the culprit, and SpyBot has fixed it.

I am sort of at a loss as to what this 'zlob DNSChanger' is doing in my
registry, as I have only been to Kerio sites in the last few days.

I have checked out the '.spop' and 'NpDocBox' thing, and it seems to be
associated with Adobe. (I hate Adobe,, wish people wouldnt use it in
their help files regarding their products... ) Anyway, that was the last
one that we were both suspect about...... it was 012 in HJT.


Damn,,,, there are two other things I wanted to talk to you about,
but I just cant remember them right now.. but sure as heck, if I click
send on the post, I will remember them 10 minutes later,, and I Know
they are very important,, so expect another post soon.

Hey,, PCR, are we getting anywhere? ha ha. You have been a great
person to bounce off,, my castle is your castle,, (I know in the movies
they sort of say it like 'me casa se you casa' or something like that.)

S/C

ps, now to check if this post gets sent, because I have not used the
internet for at least 1/2 an hour... I'm either connected or I'm not.

Me again,,,,,

Well, its now another hour passed, and I am still on the internet, but I
must admit, I have sorta been doing some surfing too, ie, going to
gmail, sending msgs, and etc. (but have been reading too, which takes 10
or 15 minutes per page or perusal of mail,, which is also the time it
takes for me to have a 'host not found' situation.)

Am annoyed that I cant remember the other two things I wanted to
mention, and I know they were important/relevant, but I guess thats what
happens when brain-cells get a bit muddled. (age? bad habits? senility?)

It is late here now, but what I will do is leave the internet on while I
sleep, then when I wake I will see if it stayed on for the full 5
hours,, hmmm, no, thats not going to prove anything because the dang
connection shows its on even though it may or may not have been usable.
Alright, thats not a problem, because I will be home for most of
tomorrow, so I will see if it runs its full course then.
If for some reason it works from now on, (fingers triple crossed) then
this will be a real poser for Franc,, because it will prove whether it
was a registry issue or not,, I think?)

Just realised, I hadnt checked to see if my new Hosts file is still
there, and it is. (I wasnt sure if it may or may not have been since
the registry roll-back.)

Lastly,, the computer 'seems' to be running even better than ever, it
seems to be running slicker and faster, which is quite a statement for
me as it was always fast anyway in regards to opening programs or even
booting up from a re-boot or a power-on start.

Off to bed, will keep you posted.

S/C

square/circle wrote:
> Me again,,,,,
>
> Well, its now another hour passed, and I am still on the internet,
> but I must admit, I have sorta been doing some surfing too, ie, going
> to gmail, sending msgs, and etc. (but have been reading too, which
> takes 10 or 15 minutes per page or perusal of mail,, which is also
> the time it takes for me to have a 'host not found' situation.)

I think ZLOB may have been responsible for those "host not found" error
messages. It might have been dialing out to no longer existing sites or
simply redirecting your clicks to somewhere non-existent. Verify
carefully that SpyBot has fully removed it & there is nothing more to be
done...

http://www.google.com/search?hl=en&source=hp&q=ZLOB.DNSChanger&btnG=Go...e+Searc
Google has about 28,000 for ZLOB.DNSChanger.
I'll read through a few of those myself later.

> Am annoyed that I cant remember the other two things I wanted to
> mention, and I know they were important/relevant, but I guess thats
> what happens when brain-cells get a bit muddled. (age? bad habits?
> senility?)

All right. I'll be here when you do.

> It is late here now, but what I will do is leave the internet on
> while I sleep, then when I wake I will see if it stayed on for the
> full 5 hours,, hmmm, no, thats not going to prove anything because
> the dang connection shows its on even though it may or may not have
> been usable.

Yea, but, when you try to use it, you'd know-- right? Unless, maybe ZLOB
takes command for a while then gives it back in time. Read through that
Google search.

> Alright, thats not a problem, because I will be home for
> most of tomorrow, so I will see if it runs its full course then.
> If for some reason it works from now on, (fingers triple crossed) then
> this will be a real poser for Franc,, because it will prove whether it
> was a registry issue or not,, I think?)

Verify that the connectivity problem is gone, right. That Google search
will say how ZLOB did it, whether it were a file that started from a
Registry call or simply a Registry setting that set a timeout or
whatever.

> Just realised, I hadnt checked to see if my new Hosts file is still
> there, and it is. (I wasnt sure if it may or may not have been since
> the registry roll-back.)

Installed files are not affected by a Registry restore. But any
mentioning of installed files may have been removed. Mentionings of
files that were uninstalled may have been replaced. The HOSTS file (no
filetype) has no Registry mentioning. Hosts.sam & Lmhosts.sam do seem to
be mentioned, but they should still be fine.

Nevertheless-- as MEB mentioned, a two year old Registry is likely to be
far out-of-sync with installed programs. The files that were installed
are still in the system-- but any Registry mentionings are now gone. For
one thing, Add/Remove Programs won't have the required entries to do
uninstalls. You can live with that, but there may be more serious
matters. I suppose some apps may fail to run properly or not load at all
due to missing Registry entries. But looks like you've begun to work
through that.

Nevertheless, ESPECIALLY IF it turns out the connectivity problem
remains unresolved, it may be a good idea to restore the one you've
replaced. Here (I believe) is what experimentation has shown me...

After a "ScanReg /Restore", an RB...cab will show up that appears to
be BLOATED. You can view that as a marker to indicate it is the Registry
that was replaced. The "bloated" one is the
System.dat/User.dat/System.ini/Win.ini that were in effect before you
did the /Restore. It went into the next available Registry number/name &
pushed out the oldest Registry backup. (It may be that the files inside
are not compacted, because DOS will not compact them. It will drop
off as the days pass, & all will be normal sized again.) Until then, it
can be restored just the same as the others not pushed off. You won't
see their size in the /Restore requestor, but its name will be
capitalized & it will be designated "not started". It also should bear
the date of your /restore.

Let us see what you've got....

(1) "START button, Find, F/F, RB???.cab".
Those are the Registry backups, in Sysbckup\. Are there five,
plus an RBbad? Are the dates consistent with each of the last five
days you've successfully boot? What is the date on RBBAD?

(2) "START button, Programs, MS-DOS Prompt". Then...
(a) CD C:\Windows\Sysbckup
(b) DIR RB???.cab /od
(c) Use the "Mark" button, outline text with mouse, "Copy" & post for
inspection.

Here was mine on 09-22-05...

C:\>CD C:\Windows\Sysbckup
C:\WINDOWS\SYSBCKUP>dir rb???.cab /od /a
Directory of C:\WINDOWS\SYSBCKUP
RBBAD CAB 1,593,319 09-08-05 5:22p rbbad.cab
RB001 CAB 1,590,251 09-18-05 3:34p rb001.cab
RB002 CAB 1,589,811 09-19-05 9:15a rb002.cab
RB003 CAB 1,583,534 09-20-05 8:53a rb003.cab
RB004 CAB 1,583,487 09-21-05 10:01a rb004.cab
RB005 CAB 1,583,477 09-22-05 11:54a rb005.cab
6 file(s) 9,523,879 bytes

Note, on 9/8 I did a Scanreg /Fix, which created the RBbad. It is also
created when Windows decides on it's own to replace a Registry with one
of the backups. Then, the Registry that was replaced ends up in RBbad.

One is created at the first successful boot per day, when all is well.
So, check those dates. When Windows detects a Registry corruption at
boot, it will look for one of those backups to replace it with. If there
only is a very old one in there, it would explain a loss of recent
changes to settings at reboot.

> Lastly,, the computer 'seems' to be running even better than ever, it
> seems to be running slicker and faster, which is quite a statement for
> me as it was always fast anyway in regards to opening programs or even
> booting up from a re-boot or a power-on start.

Well, you may want to keep it, then, & pursue the fixes you've begun.
But let us be certain the connectivity problem is gone. All the same,
let's make a backup of your current Registry backups, since they are
volatile in the SYSBCKUP folder. At a DOS Prompt...

MD C:\RegBckUp
COPY C:\Windows\SysBckUp\RB???.cab C:\RegBckUp

That should copy the 5 Registry backups & perhaps an RBBAD.cab to the
new folder RegBckUp. Here is what it looks like...

C:\>COPY C:\Windows\SysBckUp\RB???.cab C:\RegBckUp
C:\Windows\SysBckUp\rbbad.cab
C:\Windows\SysBckUp\rb005.cab
C:\Windows\SysBckUp\rb004.cab
C:\Windows\SysBckUp\rb003.cab
C:\Windows\SysBckUp\rb000.cab
C:\Windows\SysBckUp\rb001.cab

> Off to bed, will keep you posted.

I'll look through your other posts & do some Googling.

> S/C

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp RemoveThis @netzero.net

square/circle wrote:
>> That site is excellent. I've been there more than once, but admit
>> more study is necessary. Stick with it! Don't switch to ZoneAlarm!
>> You'll be able to download a starter Kerio rule set or two at that
>> site that are an improvement to the one that came with Kerio. In the
>> end, you won't have to look at all those alerts. Remember to get
>> your DNS numbers from "WINIPCFG /all" [& hit the elipses (...)] to
>> plug them into your DNS rules when you the get the hang of Kerio. Or
>> study those alerts or the log to discover the DNS numbers. In the
>> end, you don't want the log to be monsterous large-- set the
>> noisiest rules not to log! Then, you & I both must ask our ISP
>> whether these are the intended DNS IPs. Here is a search for more...
>> http://www.dslreports.com/nsearch?q=kerio
>> Seems worthy of study! Can someone have posted the ultimate rule set
>> for Kerio?
> ------------------
>
> Have downloaded the rule set number 3, then went to the
> 'miscellaneous tab' in administrations of Kerio; I then imported the
> file/ruleset into Kerio, It put many sites to block into Kerio, so
> far, so good.
> Problem is, when I went to come back here, and re-read what you said
> about 'winipcfg', (because I was now ready for that step) when I just
> couldnt get in here..... Kerio kept saying that Microsoft wouldnt let
> me in.

I see you've temporarily uninstalled Kerio now. This site explains how
to plug in your DNS numbers...
http://www.dslreports.com/faq/security/2.5.1._Kerio_and_pre-v3.0_Tiny_PFW
I'm pretty sure I downloaded a rule set from there, but it doesn't seem
to be offered anymore.

http://www.dslreports.com/forum/remark,8023708
Here this is it-- take the BlitzenZeus final rule set for Kerio v.2x.
There's a lot less to it than the Yosponge set. Then, plug your DNS IPs
into his Primary DNS Server & Secondary DNS Server rules. You D-Clk them
to modify; then, replace his numbers with yours at the Remote Address
area. Don't forget to turn those rules on by checking them on the left.
You also must turn off the Unrestricted DNS (Log) rule (uncheck it at
left), which otherwise permits & logs everything, meaning for you to
inspect the log to see what the numbers are. But WINIPCFG /all was
quicker.

> I tried and tried many things, including deleting anything
> that related to Microsoft in the new imported list, but it did no
> good at all. I have just switched Kerio off in order to get here,
> but at least I'm still trying. If you have any suggestions, please
> feel free to fire away.

I don't know-- I never permanently installed the Yosponge set(s) but
just downloaded them for study. They seem to have too much! But they are
well worth serious study!

> Also, exactly what do you mean by 'plugging
> in' the two sets of dns numbers? I clicked on the elipses and it
> showed one other set of numbers, but nothing about importing them
> into Kerio.

You manually replace BlitzenZeus's numbers with yours.

>
>> One thing... maybe temporarily disable your HOSTS file...
>>
>> (a) "START button, Find, F/F, HOSTS".
>> (b) You may get 3 or 4 them. LOOK for the one that is just "HOSTS",
>> with NO file type such as ".sam".
>> (c) R-Clk it, select Rename, & name it "xHOSTS".
>> There is no need to reboot.
>>
>> Does the NET work now? If so, the HOSTS file must be closely
>> examined.
>>
> -------------
>
> My Hosts file had nothing in it anyway, just instructions that came
> with it from the initial instal of win98se.
> Earlier today, I went and got a Hosts file from::
> http://www.mvps.org/winhelp2002/hosts.htm

Yea, that's good. I do believe this does the same work as most of the
Yosponge rules. It's another way to prevent malicious sites to work.

> It was an updated verion from only 11 days ago,, and it is 599kb. So,
> at least I have one of those now, plus the half dozen back-ups from
> Spybot that are also in the C:\Windows folder.

Only one can work at a time. I have to take the update at mvps.org--
that may be the better one to go with.

>>
>> Absolutely don't give up! I must go, or I'd do more clicking.
>>
>>> --------
>
> I wont, have come to far now.

Very good!

> -----------
>
>> I read it. Stick with Kerio! I don't recall it being that bad to
>> start. Or -- maybe -- there was one/two rules that had to be set to
>> prevent interminable disturbances. Do the reading.
> ----------------------
>
> Spent most of today reading a combination of 4 sites which all have to
> do with setting up Kerio,, all was going well until I tried to come to
> the n'/gs and reply to you.

The BlitzenZeus ruleset may be easier. The other is worthy of study. I
think I ended up combining elements of the two-- but without the ton
blocks in Yosponge!

> ----------------------
> Download one of the expert's
>> rule sets & adjust for your DNS server(s). In the end, you must not
>> let the DNS server rule to put up an alert or to log-- that would
>> certainly happen a lot!
> ----------------
>
> This is the part I dont quite understand yet, as I mentioned above.
> Maybe you could elaborate on this, and could this be why I cant click
> on posts in here without a warning from Kerio that Microsoft wont let
> me? I can get to the server with no problems, just cant download a
> post while Kerio is running.

It's addressed above.

> ------------------
>
>> I'm hoping to pick up something new in here, myself! Already I have
>> sworn to research my own DNS IPs-- which not long ago changed on
>> their own presumably/hopefully through a NetZero stealth update.
>> Kerio alerted me to it. But I had to accept it -- it seemed -- or
>> how could I connect? Now, I've found a requestor where I can
>> possibly set my own as yours was set. But a bit of research remains
>> necessary.
>
> -----------
>
> Its all a matter of how much free time is available, my quest has
> taken up heaps so far.

Let's keep at it.

> S/C

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp.TakeThisOut@netzero.net

square/circle wrote:
> Um,, Hi PCR..
>
> Dont know if I'm gonna get a slap on the wrist for this, but I just
> restored the Registry (scanreg /restore) to a date that was two years
> ago...

Slap! But it may be understandable seeing as you went batty over the
disconnects.

> Before I did it, I add/rem'd Kerio because I think I made a right ol'
> balls-up of it.

I think the BlitzenZeus ruleset & that HOSTS file is a better start for
Kerio.

> Yes, I know I am going to be re-configuring for a long time to come, I
> already had to make a new internet connection with my latest password
> etc.

Uh-huh. As posted elsewhere, it's possible to go back to the Registry
you replaced. Make a copy of your backups before the replaced one drops
off. The oldest of five (not including RBBAD) drops off upon the first
boot per day when a new one is added. The oldest also drops off should
you "START, Run, ScanReg" & answer to save a new backup. Finally, it
drops off when you do a ScanReg /Restore to make room for the one you
are replacing.

> I just couldnt take it anymore, the modem drop outs were driving me
> around the proverbial(put in anything you want here).
> I dont know if this will fix it, but surely I couldnt do any worse at
> this stage.... I'll keep you posted as to what happens.
> (Also, any reference to that 'fraudloader' thing shouldnt be there
> anymore..... hopefully, or any other thing that may or may not have
> been responsible for my problems.)

I believe that was in an MRU (Most Recently Used) list. If you do a FIND
for it, it will again appear in the list. That's OK. That's so you can
click the D-Arrow in the FIND requestor for it.

> Now that I know a swag more about Kerio, it will only take a few
> seconds to re-load it, and I am going to ask someone I know if they
> would be
> with me when I do it. At least I have all the links to the set-up
> sites now, and know where to get the latest definitions from.

All right.

> S/C

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp.TakeThisOut@netzero.net