BS: spam

Subject: BS: spam
From: Ireland
Date: 21 Feb 03 - 08:51 AM

I have been plagues with spam for the last year or so, one common factor is the info below, it always comes up when doing a whois search.

I went to the site which makes monitoring my time there a stipulation to entering the site. Can any one inform me what this site is about, I know it is a daft question,it clearly is about the military, I'm trying to stop the spammer and want to know if the people who the internet was invented for cannot stop the spammer.

The spammer uses false headers and return address such as Yahoo or Bigfoot, and seem to be getting away with it.

Does anyone know if I can take legal action to stop this or if the network is legally responsible?

Yes it is driving me mad!


OrgName: DoD Network Information Center
OrgID: DNIC
Address: 7990 Science Applications Ct
Address: M/S CV 50
City: Vienna
StateProv: VA
PostalCode: 22183-7000
Country: US

NetRange: 6.0.0.0 - 6.255.255.255
CIDR: 6.0.0.0/8
NetName: YUMA-NET
NetHandle: NET-6-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: NS01.ARMY.MIL
NameServer: NS02.ARMY.MIL
NameServer: NS03.ARMY.MIL
Comment: Army Information Systems Center
Comment: U.S. Army Yuma Proving Ground
Comment: Building 2105
Comment: Yuma, AZ 85365-9110 US
RegDate:
Updated: 2002-10-07

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD, Network
OrgTechPhone: [phone]
OrgTechEmail: [e-mail]

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 08:59 AM

Yes you can stop it by installing a mailfilter if you have Netscape or Widerz. Second if you can provide your own admin on the server you can reroute all mail from the sender/s to a null address, indeed with admin privilidges you can ban all traffic from named domains such as
218.0.0.0-218.255.255.255 etc.

Since you are recieving a spoofed tag AND it is USGOV you should really contact Homeland Security @your local FBI office.

If - highly unlikely - a DoD employee was doing this they would be almost shot today with security so tight... you should do something rightaway.

Hope it works out for you

Subject: RE: BS: spam
From: Ireland
Date: 21 Feb 03 - 09:17 AM

Thanks for the advice, I have tried most of what you have said,problem is who ever is doing it gets around all my filters. But I do not think my isp is doing enough to stop it.

Makes you wonder what use the system is and to what purpose it is being used, as I gather this spam,trying to sell DVD copy software etc, is giving my isp real problems.

The monitoring aspect worries me, is some one playing funny buggers.

Subject: RE: BS: spam
From: JohnInKansas
Date: 21 Feb 03 - 01:56 PM

I'm assuming that the "monitoring" notice you got was the same one I found at the YPG website. This is pretty much "boilerplate" that you'll find at any US Department of Defense website, and probably shouldn't be of too much concern.

The same, or very similar, warnings are posted on large signs at the entrances to most US military (or other Department of Defense) facilities. In normal times, very little monitoring is probably done - it's just that it can be, and you need to be aware of it before entering. I suspect that they may be looking a little more closely now, but probably only for "subversive content" or attempts to interfere with the site. - I hope you don't qualify there.

The only overt application of these monitoring rules I've seen was when Boeing (as a DoD contractor) used them to (without warrant) break into cars in their parking lot to confiscate phony parking stickers a few years ago in Seattle.

John

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 02:09 PM

Since this is so irritating and you need to stop it I offer here what is already on the net.

Every time you signon or bootup your machine is probably sending out code - unreported like MS OSes do - to a remote server.

Now for it to do that there HAS to be something in you machine to make it happen so, I am assuming stuff here so if John or Joe O jump on it - ignore my suggestions.

If you are using a Unix system then it is as easy as cake, and you should already know where to look, ie cache directories. If MS Windows you need reboot out into DOS from a Floppy.

Then delete all the temporary folders with deltree/y command.
You can make a lnk file in Unix or a bat file in winderz to achieve this.

Example file for 98
Cleanup.bat
CD \
CD windows
deltree/y cookies
deltree/y history
deltree/y temp
deltree/y tempor~1

Subject: RE: BS: spam
From: Ireland
Date: 21 Feb 03 - 02:25 PM

I have noticed my system goes very slow, and I have been using ad-aware, which checks for programmes that are spy ware as they put it.

This helps in stopping the sluggish performance,until I get another spam email,it could all be coincidence which is more than likely.

Thanks for your advice sorefingers,I use win 98 so I'll do as you advise and see how it goes. FBI in NI relates to feckin big idiots rather than the US boys.

Subject: RE: BS: spam
From: Stilly River Sage
Date: 21 Feb 03 - 02:26 PM

Batch files--DOS--that's going back to basic technology, isn't it?

Ireland, can you describe this in another way? Is it that whenever you visit a particular site for doing a "whois" search that somehow you concurrently receive spam generated by the act of your entering that site? And the spam appears to be from whom? Where does the ARMY.MIL stuff come into it?

SRS

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 02:35 PM

Hi Stilly, sure it's what the great MS still uses ...hehe

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 02:52 PM

Sorry if I left it hanging...

In case somebody uses Muddie to hack me, I am not using my own machine OK... this is a friends and if you break it ... I will be on at the library, hack that one and the cops will nail you ass to the nearest wall...

Finishing off what I wuz on about
Winderz 32 netkernel Oses
Worse case scenario is your HD boot record is compromised, it has a flag to the a hidden 'value' on the drive, one used be able to repair this with a simple sys command but unfortunately these days the hacker is way ahead... in this case one has to 'zero' the drive reformat and reinstall from a clean original CD - and not a priated Chinese copy!

The hidden thingie can be anything from a little bit of data to an entire hidden logical drive compete with its own smpt server and spaming software, some found also included folks personal stuff as well.

Very scary

Subject: RE: BS: spam
From: Stilly River Sage
Date: 21 Feb 03 - 02:58 PM

Supposedly they're getting away from pure DOS, but it's still possible to get there from here. Just takes a little more work than it used to. Some of the DOS commands supposedly don't work on the computers using newer versions of Word. Any truth to this?

I'm still trying to understand the problem outlined above--do you think (as sorefingers has suggested) that there is a file on your computer setting you up for surveilence or receiving this spam, or have you merely fallen into the sights of some company that is out there spamming thousands or millions with targeted email?

SRS

Subject: RE: BS: spam
From: JohnInKansas
Date: 21 Feb 03 - 03:09 PM

Ireland -

If you're noting sluggish operation in Win98 there are two places to do cleanups.

Go to START - PROGRAMS - ACCESSORIES - SYSTEM TOOLS and click on DISK CLEANUP. It will ask which drive to clean, and you pick the one where all your system stuff is installed - usually C:\. If will then search out all the trash that's accumulated - you accept, and it cleans it up. This method will not generally remove cookies, but get most other stuff.

Assuming that you are using Internet Explorer, Click Tools, then Internet Options. There you can delete Temporary Internet files (good idea usually) and/or Cookies (depends on whether you want to log back in everywhere) and Clear History (the list of sites you've been to recently).

Note that "delete cookies" in IE doesn't give you an easy way to choose which ones to delete, and may or may not delete "current" ones.
Both methods clear pretty much the same stuff, but depending on your surfing style, one may work better than the other - but it's pretty quick just to do both.

If you want to clear some cookies but keep some others, you can go to C:\Windows\Cookies and delete any you don't want to keep. The general rule is "if you didn't log in to get them they're junk." Just be careful to keep your mudcat cookie(s) and your bank account.

Later op systems (Win2K and XP esp) put a separate cookie folder under each username in "Documents and Settings;" so you do the same things but may have to go more than one place to delete individual junk items.

There is no reason to "boot to DOS" ever in a Windows system that is working properly, and there are no hidden files that you can't find if you know how and have a reason for needing them. The only reason for "hidden" stuff in Windows is because it would clutter up things so much you'd never get any work done if everything was displayed, and because it helps prevent inadvertent screwups that would trash your system.

John

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 04:06 PM

Awe pooh John, you are winding us up!

Subject: RE: BS: spam
From: JohnInKansas
Date: 21 Feb 03 - 04:42 PM

Stilly -

What commands you have available don't depend on what version of Word you have, they depend on what version of Windows you have. Microsoft doesn't call it DOS anymore, it's all lumped into "Command.exe," and almost all of the old DOS commands are available, with some new and very powerful ones added.

One of the nicer things about WinXP is that they have finally put a complete description of the available commands in the Help file, where you can refer to them if needed. There are a number that I use frequently - from a command window, no need to reboot to DOS.

Ireland -

There's no indication in what you've posted so far that indicates a problem with your machine, or presence of anything hidden on your machine, other than perhaps the normal crap cookies that spammers sometimes use. Someone got your email address, and is using it to send you junk. Eventually, they may get tired of sending you stuff if you don't respond, but they've probably already sold your address to a dozen (or more) other spammers, so you'll get more junk. Unfortunate fact of life on the internet.

There is little that your ISP can do to help you, since spammers almost always use faked return addresses, ghost routing, and change accounts frequently - unless you can identify "filterable content" that will help reject specific kinds of stuff - based on the content. You can also install filters on your own machine - or use ones built into your existing programs, but it's unlikely you'll stop more than a small fraction of the incoming if you're already on their lists.

If you have credible evidence that this stuff is being sent via a DoD network, it's illegal use of government resources, and there is a good chance that an individual who's targeting you could be tracked down, simply because the Fed is sensitive to misuse of resources and might be (willing and) able to track this one guy down. Since he's probably already posted your email addy to the site where he got his "spammer kit," it's unlikely to help much - but the direct approach would be to forward whatever info you have to the CO at YPG, or to the system administrator at whatever site you can clearly identify as a source. It's called "community involvement" and is, like all such, unlikely to produce much in the way of results.

Run a good AntiVirus scan on your machine. Clean up your temp files and cookies. And DELETE IMMEDIATELY WITHOUT OPENING anything that comes in. Eventually this guy will get tired, and you'll get new stuff from the guys who got his list (or from this guy at his new fake address).

John

Subject: RE: BS: spam
From: TIA
Date: 21 Feb 03 - 04:53 PM

Don't know much about computers, but I know the company that the header refers to. It is Science Applications International Corporation (SAIC) in Vienna Virginia (just west of DC, near Dulles Airport, six separate addresses). They are not the US government. They are a huge defense contractor (a private corporation). Look here http://contacts.saic.com/loctblext2.nsf/Virginia?ReadForm&Count=200

Subject: RE: BS: spam
From: Ireland
Date: 21 Feb 03 - 05:47 PM

Thanks all for the help, I got the latest spam last night, it gave a return address as a Bigfoot.com customer, I contacted bigfoot abuse team sending them the headers which came with the email.

The headers were false and the return address was forged, I got the info in bigfoot.com reply to my complaint, the webmaster address was also given for me to complain to. I followed the link and ended up on a site to do with US military.

What has been happening has been described above by JinK, in the spam mail the To line: in the headers are variations of my email address, I do not get any other spam except for this particular product, DVD copy software, the site is http://www.abe10.net/dvd/index.html. I can find no way to contact these people as the page is set up for payment details only. The spam does not coincide with any site, it pops up out of the blue.

I used the link in the bigfoot.com reply, http://geektools.com/cgi-bin/proxy.cgi to look up 6.7.014, the result was:

OrgName: DoD Network Information Center
OrgID: DNIC
Address: 7990 Science Applications Ct
Address: M/S CV 50
City: Vienna
StateProv: VA
PostalCode: 22183-7000
Country: US

NetRange: 6.0.0.0 - 6.255.255.255
CIDR: 6.0.0.0/8
NetName: YUMA-NET
NetHandle: NET-6-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: NS01.ARMY.MIL
NameServer: NS02.ARMY.MIL
NameServer: NS03.ARMY.MIL
Comment: Army Information Systems Center
Comment: U.S. Army Yuma Proving Ground
Comment: Building 2105
Comment: Yuma, AZ 85365-9110 US
RegDate:
Updated: 2002-10-07

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD, Network
OrgTechPhone: [phone]
OrgTechEmail: [e-mail]

The ip(?)number is common to all the previous spam, hope this explains the DOD link.

Sorry for such a long post but I felt that since people are kind enough to help I should try to answer their questions best I can.

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 05:50 PM

To find out finally if there is a Trojan on your machine, in the run box type SHIT press enter, then when the little box pops up telling you there no such a thing, kick the computer with a sledge, that should fix it.

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 06:00 PM

I apologise about my irrevernd post but sometimes doing the most unlikely things can generate unexpected results, the bit about typing things in the run box MAY be of some help, the rest is pure speculation.

If wondering what to type, do a search for 2006 or hacker and chose what they TELL you to type.

Your ISP is Bigfoot ? Ok here is what to do.

Install Netscape and when you get the email, chose VIEW source. The window will show you everything including the real sender's IP, no shit, there is no way a spammer can in advance turn off tagging, IT CANT BE DONE even by the DoD CONTRACTOR, unless as I already guessed you have a Gov trojan, perhaps they like your nickname?

Subject: RE: BS: spam
From: Ireland
Date: 21 Feb 03 - 06:07 PM

Sorefingers my ISP is Tiscali, the bigfoot.com address was forged, as was the Yahoo address. Sorry looks like I'm getting on your nerves.

I have scanned for viruses I use Zonealarm plus, filtered all emails which have dvd anywhere in the subject line, I have filtered yahoo addressed emails and still the bugger gets through.

But if I can identify the originator which I thinks is from the dod network it may stop it.

Thanks for your help it is appreciated.

Subject: RE: BS: spam
From: Stilly River Sage
Date: 21 Feb 03 - 06:54 PM

John, if I said Word that was a typo (write-o?). I was thinking Windows. I use Win2000 Pro, and I think I read that from this version on some of the DOS commands don't do as much as they did before. I don't believe I've even gone into the DOS mode with this computer (though I have had the emergency desktop pop up a couple of times with such low functionality that it might as well be a DOS screen).

Ireland, it sounds like you're trying all of the reasonable avenues.

How large is the file that is coming through? Are you getting any indication that there was a worm attached that your anti-virus software removed? Or that your Internet Provider removed? I was getting a lot of spam for a while because someone who had the klez virus had me in their address book. I don't know who it was, because the "from" file is always bogus, it uses someone else's address in that same address book. Do you suppose that someone with the klex virus . . . nah. . . that probably wouldn't do it either. I'll leave this speculation here just in case it leads you into creative thinking along other avenues.

You've tried the individual filter that is in your email program? I had good luck with the filter when I used Pegasus as my primary mail program. I don't use PMail so much now because the email address I have it dedicated to is going to be phased out eventually (by me--because I get too much spam over there--so I sympathize with your problem). If I went in and set up the filter again to filter out words like "casio" and "sluts" and "penis" and "XXX" and "mortgage" I'd get rid of the stuff that still manages to get past the Earthlink "Spaminator." Spaminator catches a lot of stuff, and has never yet caught anything that was actually legitmate mail. I'm getting rid of that address because it was too easy with my name in it for address generators to come up with it through trial and error. And because stuff still does slip through very regularly. I don't plan to set up any "default" email either, after I get rid of this.

Any email will give you the source information, like sorefingers suggested Netscape will do. It's the entire header, the "Raw" view plus the message, but it sounds like you've already seen that. I think it's time for you to lean on your internet provider and insist their techs backtrack this and complain to the original IP address. Some companies are more diligent about this than others.

SRS

Subject: RE: BS: spam
From: artbrooks
Date: 21 Feb 03 - 08:42 PM

I'd suggest that you send a snail mail complaint (because the government deals better if they have a piece of paper) to Office of the Inspector General, Yuma Proving Ground.

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 21 Feb 03 - 09:22 PM

I tried typing things (run )in my Win95 box and it does some realy weird whirring and buzzing then the screen flickers.. ought to try and find out whats a going oannn huh? Perhaps it is MSN looking for a Gateway? Oh well pity MS could not have been more honest about that registration deal, sure would have made widnerz a far smoother operator.

Talkin about smooth operators, Ireland did you know that IBM sells a PC preloaded with Linux GUI already in and full to the brim with goodies. I think it costs around a grand but hey if you want to cruise in a Rolo, you gots to puts yer stuff out!

Subject: RE: BS: spam
From: JohnInKansas
Date: 22 Feb 03 - 01:49 AM

Stilly -

If you have Win2000 Pro, you can go to Start - Help. Select the index tab and type "Command." On the list that comes up, select "command-line help," and then related topics - "command-line help main page." There you will find a list of all commands that can be run from the "command line" which is the new "equivalent" of DOS. There are a whole bunch of things that were never in earlier versions of DOS.

You can also select "What's New and Different from DOS" to get a full description of commands that were deleted/omitted, commands that were added, and what the commands do differently - and won't have to rely on "what you heard." It's really quite painless, and you may find something new that you can use.

I haven't been there recently in Win2000, but the only "commonly used" command I can think of that went away is DELTREE, and you can do that much more safely in Win Explorer since you can "spread the branches" to see more clearly what you're deleting. DELTREE could be hazardous enough that I usually stepped through emptying each folder individually and then just used RD anyhow.

Artbrooks - good suggestion, and the IG is usually "the man" for problems inside the military, however YPG is a very small installation and probably doesn't have a resident IG officer. Anything sent to YPG addressed to the IG would probably have to be forwarded (and might even be "filtered") by the resident staff, so I'd suggest just writing to the Commanding Officer YPG and/or to the public site webmaster. (If you write to both, they'll undoubtedly discuss it at weekly staff meeting.) Contacts for both are on the YPG Public Web Site. Contact (email) the webadmin on any page, or click on the "Command Staff" button on the left for others.

Ireland - It's probably no consolation to you, but I have one email account that gets, on average, a little over 300 spam messages per week, including at least 2 or 3 dozen for DVD copy scams. My discussion with others indicate that this is not unusual, and there is little you can do once "they" get your address - short of changing your address. Since you have only one cockroach, you may be able to get it stopped, but ANY response to spam merely confirms that the address is "live" and increases the likelihood that it will be sold and distributed to more spammers. If you start getting more - DELETE and IGNORE.

John

Subject: RE: BS: spam
From: Stilly River Sage
Date: 22 Feb 03 - 12:06 PM

John, that's very interesting. At one time I used to be quite conversant in DOS but I haven't used it much for several years. But I have stumbled onto another problem that perhaps this thread can address, since we're all in there poking around under the hood. If there's much to it, I'll go look for a TECH thread to stick it onto.

I have been having difficulties getting my browser and Real or Windows Media Player or Winamp to play clips I find on the Web. There are actually two sorts of functions that I think my Norton Firewall is blocking; sometimes when pages don't view properly I go in and turn off the adblocker and the javascript appears on those pages (this is a real problem at Travelocity, for example). When I can't hear them I try turning off the ad blocker and nothing happens, but I don't want to (in Star Trek lingo) "lower my shields" to everything just to let a sound file through.

SO, I tried updating those audio programs to see if Norton would somehow adapt to their presence, and in the process, Real had me delete the old program. I found Real One to be bossy and annoying so I removed it, and the darned thing asked about deleting shared (but it assured me unused files). I wasn't paying close attention and I let it remove a few before telling to leave them all alone.

You've guessed where this is going, I'm sure: This morning I booted up and found the warning that I'm missing mrbupd.dll. I did a little research and don't see it as something I would ordinarily USE, but I hate those little warning screens that come up forever if you don't do something about them, and that halt the progress of setup until you do answer it. I browsed my Win2000 installation disk and it don't find it in there (I used "Search"). I tried reinstalling Real (I installed it "custom" and kept it really dumbed down and didn't let it be default for playing anything) and the file does come back with it, as far as I can tell. It didn't turn up in Search just now.

In the past I've been able to search the Web and find replacement files when I needed them, but none of those links, when they appear in Google, seem to go to active web sites with those files on store. I'm going to restart the computer and go poke around in the other platform and see if I have a copy of mrbupd.dll over there and copy it, but I'm not holding my breath.

Any thoughts?

SRS

Subject: RE: BS: spam
From: Stilly River Sage
Date: 22 Feb 03 - 12:45 PM

Follow-up: I went into the ME side of my computer and found mrbupd.dll in a couple of places. I copied it to a folder that my platforms have in common, and restarted the computer. I've copied the file to the place where it is supposed to live. I'll test if it "takes" later when I reboot the computer.

I suppose this should serve as a cautionary tale: don't let programs you're uninstalling delete common files. It may be a little extra baggage, but those uninstall programs aren't necessarily the best way to take care of disk cleanup.

SRS

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 22 Feb 03 - 12:50 PM

To find out what MS want's you to know about it's Command file, type the name followed by ? press enter.

Subject: RE: BS: spam
From: JohnInKansas
Date: 22 Feb 03 - 06:03 PM

Stilly -

Hopefully, since you've found your missing file, you're ok now. That kind of search, where you know the filename, incidentally, is one of the sort of things I'd likely use a "Command" (DOS) utility for. If you open a " Command" window (used to be a "DOS" window) and go to root (" CD\ " to C:\) then " DIR filename /S " just seems to run a lot faster than a Win Explorer search. And if you don't find it and suspect it might be "hidden" or something, ATTRIB filename /S " is pretty certain to find it if it's there.

I often use a "redirect" to a .txt to get a result that I can edit and sort, too " DIR filename *.* /S > resultfile.txt ".

sorefingers -

The formal way to get the "instruction" for a DOS command is " command /? " which works in most DOS versions since ver. 3 or so. (A few commands didn't include the text, so it didn't always work.) If you leave off the "/" a few of the older versions don't know what to do, but the stuff in most recent Windows versions knows enough to "punt" and will give you the command format.

The problem is, you have to know 1) that the command exists, and 2) how to spell it - in order to run this query.

Win 2000 and Win XP (I don't know about ME) are the first Win versions that make it easy to get a complete list of the commands that are available - in Help.

John

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 22 Feb 03 - 07:33 PM

John, yup - some version allow one to load at install a complete old dos help file...

If not, perhaps you should just list them for Ireland so he/she can get in there, I mean it saves loading all that goop under debug/assembler and paging through it, IF the MS OS will let you, I darent try it here, not my machine...

Subject: RE: BS: spam
From: JohnInKansas
Date: 22 Feb 03 - 07:48 PM

Sorefingers -

I haven't the foggiest idea what you're talking about, but you're obviously intent on making your own "computer world" life much more difficult than necessary.

If you mean "why don't I list all the Windows Command Line Executables here?" I don't think 20 or 30 pages of something that's in the Help file on any machine where the commands are useful would be appreciated - or very useful. If you don't have the current Help files on your own machine, then you don't have the set of executables described there.

John

Subject: RE: BS: spam
From: Stilly River Sage
Date: 22 Feb 03 - 10:52 PM

John,

I found the file and moved it, but it didn't work. (I thought I posted this already, but it doesn't seem to have been sent). I'll have to see about posting it to a couple of the places where it says the file should be found. Or I could download a new copy of a program that seems to have the file.

SRS

Subject: RE: BS: spam
From: JohnInKansas
Date: 23 Feb 03 - 01:06 AM

SRS -

If you're still getting the "missing .dll" on bootup, take a look and see if there's a "more" or "details" button on the message. Sometimes it will tell you where it's looking, so you'll know where to put it back - and/or it may tell you what file is looking for it.

Second option: look in your Windows Startup folder:

If you're using Win 2000 go to:
"C:\Documents and Settings\...\Start" and also
"C:\Documents and Settings\...\Start\Program Files\Startup"
where the \...\ is where you pick a "user."

In Win2000 there will probably be at least an "Administrator," an "All Users," a "Default User," and likely one with your name on it – if that's how you set up the first time. Check each Start and Startup folder to see if there's anything in there that could be "asking for" the .dll that's supposed to be missing.

The files in Start and Startup are all shortcuts, so you can right-click on one and pick Properties. You may have to pick a "Shortcut" tab after that, but one of them should show your .dll as a target. (Since a .dll can "call" another .dll, its' not absolutely guaranteed that it'll be there, but the odds are pretty good.)

If you move the Shortcut file out of the Startup folder, Windows will quit looking for the .dll when you reboot. (You could delete the shortcut, but if you just move it you can move it back if something quits working.)

Note that the shortcut to the .dll may be in more than one "user" folder, so you have to check them all.

The most likely thing is that when you uninstalled the old Real Player(?) you didn't remove the Startup shortcut that's still trying to load it when you boot. If the new version (or whatever replacement you install) doesn't use the same name for it's starter, or puts it in a different place, you'll keep getting the boot message.

There is another remote possibility to consider, especially since you've tried reinstalling and it didn't put the .dll back. There is a class of virus that typically puts a shortcut to its own .dll into every Startup folder it can find. The typical is that the virus .dll changes your browser home page, often to a porn site but sometimes to a travel agency. The shortcut that it puts in Startup is intended to run the .dll to reset back to the new site everytime you reboot. Norton usually "kills" the virus, but may not block it before it writes the shortcut, and the shortcut itself isn't actually a virus – so your homepage doesn't change, but the shortcut is still trying to run the virus .dll "program" that Norton killed. If that's the case, you certainly don't want to replace the .dll. The "original" version of this virus type was called "Troj/JetHome" and the .dll it called for was sp.dll, but some smart-a.. (omitting other adjectives) could have changed the name.

Since you've found files with "your" .dll name elsewhere, (Norton would have removed it if it was a virus) and it apparently hasn't messed with your machine, I think it's extremely remote that the virus is involved, but you can check it out on any of the AV web sites if you're curious.

John

Subject: RE: BS: spam
From: Stilly River Sage
Date: 23 Feb 03 - 02:57 AM

John, you MUST do this for a living! We could keep you busy full-time just at Mudcat alone. I made note, the last time I booted up, what programs were reporting the missing file (it was on the top of the warning message that conmgr.exe and updatemgr.exe wanted this file). I'll try putting it in their proximity next time I get a chance. There are several good ideas here to work with. Thanks! We should ask Joe to convert this entire thread into a TECH file; it has been helpful on a couple of technical fronts.

Thanks for your help!

SRS

Subject: RE: BS: spam
From: GUEST,sorefingers
Date: 23 Feb 03 - 01:09 PM

Gee John I bet you think you have something that nobody else has.
Ho ho ho.

Try yohkak

Subject: RE: BS: spam
From: JohnInKansas
Date: 23 Feb 03 - 02:24 PM

sorefingers -

GUEST,sorefingers RE: Keyboard into computer 25 Aug 02 You'd think they would've long since made a PC Keyboard with a piano underpart so one could fold away the the kb and then play on the keys beneath.

I was in a CompUSA store a couple of weeks ago, and they were discounting a PC keyboard with a built-in 2.5(?) octave piano (midi) keyboard on the front of it. Didn't fold up out of the way like you suggested – and at "half-price" it was still about $100 (US), but maybe the tried to steal your idea. 'Course if they hadn't screwed it up, they wouldn't have been trying to sell off the ones they got stuck with.

John

Subject: RE: BS: spam
From: Stilly River Sage
Date: 24 Feb 03 - 10:17 PM

A 2 and a half octave piano keyboard is a toy. It wouldn't even hold up my sheetmusic. . .

John, after a couple of tries I finally poked that little file into enough places that I finally hit the right one, and there is no longer an error message.

SRS

Subject: RE: BS: spam
From: JohnInKansas
Date: 24 Feb 03 - 10:39 PM

Good job, Stilly.

I'd agree that the little keyboard wasn't very useful for music - although it might have been nice for punching notes into a notation program, assuming you could octave shift it, which I'd expect.

The problem is, I couldn't see how you could type on the PC part of it without bumping the piano keys. Sort of like those laptops with the touchpad that's right under your thumbs when you type. I never could get two words in a row at the same "insert point" since the danged thing kept "movin' the mouse" while I typed.

Sorefingers had suggested it ought to be a foldback so you could get it out of the way. Obviously Yamaha(? I think it was theirs ?) didn't listen.

Now about all those other places you copied your dll????? As always, its best to clean up while the mess is fresh. They won't hurt anything, except for using a couple of KB per place, but it could save you some frustration later if you get the extra "dead" ones out while you still remember where you put them(?) Or not.

John

Subject: RE: BS: spam
From: Stilly River Sage
Date: 25 Feb 03 - 12:12 AM

John,

I only put it two or three places total. I can do a search for it again and figure out which one is doing the work from when they were put there. The last one is the one that worked!

I have my Dad's old Amiga out in the garage, and I think he had all sorts of gadgets and a keyboard that went with it. I've never turned it on to see what he has in it, but I need to one of these days. Then I'll really test your computer skills! A 6 to 10 (at the very least!) year old Amiga with songs lodged in it. Now that may be a challenge!

SRS

Subject: RE: BS: spam
From: JohnInKansas
Date: 25 Feb 03 - 01:03 AM

Stilly -

The Amiga was even a little before my time. You may have to find someone even older than me for that one (although I think that most of them older than me are sort of ....dead?)

What was that Star Trek episode about the whales, where Scotty cranked up the Mac and gave the guy the formula for transparent aluminum? "Speak directly into the mouse..." or had the mouse been invented when the Amiga was around?

John