Hi guys, i have had problems with winme shutdown for a while now and we just sortta "lived with it" as i couldnt find a fix. now my cable internet keeps dropping out and the only way to get it back is to reboot - so now that previous problem is really getting annoying. when the shutdown problem first started, maybe a month or so ago, there were 2 things that happened at about the same time 1) we installed a new epson printer 2) we got look2me (i succesfully got rid of it with kill2me). i have tried scans with avg, spybot 1.4, housecall online scan and all come up clean, but the puter just doesnt seem to be acting right. i have been in touch with my internet provider and they say (when my internet drops out) that they can see my modem but not my computer. i have a feeling my shutdown problem may be my printer driver not uninstalling properly on shut down but the internet problem is driving me nuts! i am running avg free and zone alarm. as you may already know i am really crap at explaining things so i hope this all makes sense.

[Reply or follow-up to this message]

Assuming your Cable modem is connected by an Ethernet adapter, have you looked for and installed the latest Ethernet device driver for your Ethernet chip set? The common Realtek chip set has a known problem with most of its older device drivers that cause shutdown problems with Windows ME, even when it is not being used. Other Ethernet chip set drivers might have the same type of problem.

All it takes is one "back level" or bad device driver to cause shutdown hangs. The fact that they see your modem but not the Ethernet MAC address connected to it indicates either a defective Ethernet cable (replug it several times at both ends) or a problem with the Ethernet card or its device drivers.

If you have had any version of the Look2ME Trojan, then there is a good chance you might still have a newer version of the Look2ME Adware Trojan that the kill2ME program does not know how to find or remove. The Computer Associates OnLine AV scan can detect and remove the newest version of Look2ME if you have it. Try: CA eTrust 'Scan for Virus'

[Reply or follow-up to this message]

jack you are a legend! doing that scan now and sure enough it found canbede which it says (amoungst other things) that it tries to connect to look2me. dont know yet whether problem is fixed cause scan is still running, but i will let you know shortly

[Reply or follow-up to this message]

Canbede is Computer Associates name for this new version of the Look2ME Adware Trojan. It is a DLL module that auto-loads, so there are no normal startup entries for it. It is one of the most advanced and stealth Adware Trojans. It hides itself very well and causes very few problems other than a few AD's now and then, and some Internet performance problems. However, it has the ability to tunnel under your firewall and download updates and anything its creators want to do with your system. It has been very "quite" for several months.

I suspect your problems might be because of conflicts between this Adware Trojan and your Firewall software.

I have sent copies of it to Lavasoft, Spybot, TrendMicro and several other AV houses several months ago, but they have not included detections for this new version yet. Computer Associates and Kaspersky AV seem to be the only ones detecting and removing it for the last three months.

After cleaning this off of your system, I would recommend doing the following search after rebooting. Do a Start - Search - Files and Folders... In first field leave it blank, and in the Containing text: NicTech and do a search of your C: drive. It would be normal to find the companies name (NicTech Networks) that made the ADware Trojan in your USER.DAT file (due to the search), but not in any program file on your disk drive.

[Reply or follow-up to this message]

the scan didnt allow me the option to clean or delete the file so i manually deleted it then started going thru the registry deleting the keys that they said then after about a dozen of them i thought "hey i really dont know for sure what i am deleting here" and stopped and rebooted. so far it doesnt look like anything has been ruined by my editing the registry but who knows. i did a search on that name you said and it came up with nothing.

[Reply or follow-up to this message]

I would recommend rebooting and then re-running the AV scans again when you have time, to make sure you got rid of all of the copies of this ADware Trojan. The Registry entries are not really a problem if the executable code has been removed. Unless they are the ones that restrict access to things in the Control Panel.

As to how you got infected in the first place. Think back about a week before you first noticed or detected the problems. Did you download anything, such as a screen saver or background image?

[Reply or follow-up to this message]

well my puter is clean now, however i still have the same troubles with restarting and internet dropping out. i have tried a number of ways to update the driver for the network card (it is a realtek RTL8139 according to device manager), but when i restart the computer, it has reverted back to the original driver every time. any ideas?

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum