xpP & xpH networking problems

[cindy]

CHUCK...

sorry the information from my last post was from the
laptop1 (windows XP Pro version 2002 SP 1) machine

from the Desktop machine (XP Home Edition 2002 SP 1)

Status for domain HOME on transport \Device\NetBT_Tcpip_
{C424CF9F-054E-442B-BB24-C8BBB0146B78}
Browsing is active on domain.
Master browser name is: DESKTOP1
Master browser is running build 2600
2 backup servers retrieved from master DESKTOP1
\\LAPTOP1
\\DESKTOP1
There are 2 servers in domain HOME on transport
\Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
There are 1 domains in domain HOME on transport
\Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}





>-----Original Message-----
>On Thu, 5 Aug 2004 14:36:24 -0700, "CINDY"
>
>wrote:
>
>>Chuck, here is the output for Browstat status:
>>
>>Status for domain HOME on transport \Device\NetBT_Tcpip_
>>{8322D2F4-9FB3-4DC6-9503
>>-53544403C67F}
>> Browsing is active on domain.
>> Master browser name is: DESKTOP1
>>Could not connect to registry, error = 53 Unable
>>to determine build of br
>>owser master: 53
>> \\\\DESKTOP1 . Version:05.01 Flags: 71203 NT
>>POTENTIAL BACKUP MASTER
>>
>> 2 backup servers retrieved from master DESKTOP1
>> \\LAPTOP1
>> \\DESKTOP1
>> There are 2 servers in domain HOME on transport
>>\Device\NetBT_Tcpip_{8322D2F
>>4-9FB3-4DC6-9503-53544403C67F}
>> There are 1 domains in domain HOME on transport
>>\Device\NetBT_Tcpip_{8322D2F
>>4-9FB3-4DC6-9503-53544403C67F}
>
>Cindy,
>
>That's from which computer? Did you run it on the other
computer also?
>
>And what service pack level on each computer?
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>
...


..

[Chuck]

On Sun, 8 Aug 2004 12:02:00 -0700, "cindy" >
wrote:

>CHUCK...
>
>sorry the information from my last post was from the
>laptop1 (windows XP Pro version 2002 SP 1) machine
>
>from the Desktop machine (XP Home Edition 2002 SP 1)
>
>Status for domain HOME on transport \Device\NetBT_Tcpip_
>{C424CF9F-054E-442B-BB24-C8BBB0146B78}
> Browsing is active on domain.
> Master browser name is: DESKTOP1
> Master browser is running build 2600
> 2 backup servers retrieved from master DESKTOP1
> \\LAPTOP1
> \\DESKTOP1
> There are 2 servers in domain HOME on transport
>\Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
> There are 1 domains in domain HOME on transport
>\Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
>
>
>
>
>
>>-----Original Message-----
>>On Thu, 5 Aug 2004 14:36:24 -0700, "CINDY"
>
>>wrote:
>>
>>>Chuck, here is the output for Browstat status:
>>>
>>>Status for domain HOME on transport \Device\NetBT_Tcpip_
>>>{8322D2F4-9FB3-4DC6-9503
>>>-53544403C67F}
>>> Browsing is active on domain.
>>> Master browser name is: DESKTOP1
>>>Could not connect to registry, error = 53 Unable
>>>to determine build of br
>>>owser master: 53
>>> \\\\DESKTOP1 . Version:05.01 Flags: 71203 NT
>>>POTENTIAL BACKUP MASTER
>>>
>>> 2 backup servers retrieved from master DESKTOP1
>>> \\LAPTOP1
>>> \\DESKTOP1
>>> There are 2 servers in domain HOME on transport
>>>\Device\NetBT_Tcpip_{8322D2F
>>>4-9FB3-4DC6-9503-53544403C67F}
>>> There are 1 domains in domain HOME on transport
>>>\Device\NetBT_Tcpip_{8322D2F
>>>4-9FB3-4DC6-9503-53544403C67F}

Cindy,

With the hope of diagnosing your problem thru repeating what we know, I have
quoted the relevant portion of your various statements, with date and time from
my newsreader in my local time. Please correct me if I have misinterpreted any
of your statements.

Some of your reports, frankly, are a little hard to interpret. For instance,
'i can access the shared folder from xph to xpp but i cannot access the xph from
xpp' (7/23 12:43). I am taking this to mean that you CAN access xpp (Laptop1)
from xph (Desktop1), but cannot access xph (Desktop1) from xpp (Laptop1). Your
subsequent report (8/5 8:02) shows that you can access (see) both Desktop1 AND
Laptop1 from Desktop1, but can access (see) NEITHER from Laptop1.

This is an asymmetrical problem, with Laptop1 apparently having the problem.
Laptop1 can't even see itself.

My experience with asymmetrical access (can access or see Computer B from
Computer A, but can't access or see Computer A from Computer B) is generally one
of three problems:
1) Browser / network problem.
2) Incorrectly setup authentication / authorisation.
3) Firewall.

1) IPConfig listings from both computers look normal.
2) Both computers are running Client for Microsoft Networks and File and
Printer Sharing for Microsoft Networks.
3) Both computers have a functioning browser. Desktop1 is the master browser,
with both Desktop1 and Laptop1 listed as backups. Browstat output is
symmetrical for the two computers, with the exception of the 'Could not connect
to registry' bit. I have, however, seen this error in working workgroups.
4) The symptom 'when i go into network places in xpp, and click on workgroups,
nothing happens. there are no instances of workgroups in my "entire network"
there is only "microsoft terminal client" and "web client network" visible'
(7/23 12:43), is not consistent with incorrect authentication / authorisation.
Can't see Computer A from itself?
5) You state that 'xpp is set to simple file sharing' (7/23 12:43). Obviously,
xph is running SFS. And subsequently that 'Guest accounts are enabled on both
machines' (8/5 8:02). So no authentication / authorisation problem.
6) The latter symptom, IMHO, would be best explained by a malfunctioning
firewall. I mentioned firewall as a possibility; you denied that.

First try uninstalling then reinstalling Client for Microsoft Networks, and File
and Printer Sharing for Microsoft Networks, on Laptop1.

Then, having eliminated all of the obvious possibilities, let's look a little
deeper.

There are two diagnostic tools which I use for various purposes. HijackThis
<http://www.majorgeeks.com/download.php?det=3155> is generally used to search
for / remove malware. Everest (aka AIDA)
<http://www.lavalys.com/products/overview.php?pid=1&lang=en> is used for general
(in depth) analysis.

Please download, install, and run both products on both computers.

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. Run HijackThis ("Scan"). Do NOT make any changes. Save
the HJT Log. Post both logs here.

Install Everest per instructions included with the product. Run the product,
generating a full report. Post both reports here.

With patience and persistence, we might yet identify the problem.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[Chuck]

On Mon, 9 Aug 2004 08:32:50 -0700, "CINDY" >
wrote:

>
>Chuck,
>Let me first start by saying THANK YOU MUCH for your
>help. Despite the fact that we have not solved this
>problem conclusively, you have been the only person who
>has really been able to move the bar forward.
>So thanks again!
>
>Your assumptions are correct leading to the re-
>installation of MS Client and File sharing.
>Re-installation did not solve the issue and I went ahead
>and ran the Highjack this and Everest applications:

<SNIP Diagnostic Material>

Cindy,

Well, nothing interesting in either the HJT Log or the Everest log. HJT shows a
few things you should remove, but this is not a spyware problem.

From each computer, test connectivity:
1) Ping the other by name.
2) Ping the other by ip address.
3) Ping itself by name.
4) Ping itself by ip address.
5) Ping 127.0.0.1.
Report success / failure of each test (10 tests total).

Provide static route for each computer.
Start - Run - "cmd". Type "route print >c:\route.txt" into the command window -
Open c:\route.txt in Notepad, copy and paste into your next post. Identify
operating system (by name and version) with each ipconfig listing.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[CINDY]

Chuck
all pings executed successfully - no errors

..
route print for Laptop1
================================================== ========
=================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 b0 d0 a8 c3 fd ...... 3Com 3C920 Integrated
Fast Ethernet Controller (3C905C-TX Compatible) - Packet
Scheduler Miniport
================================================== ========
=================
================================================== ========
=================
Active Routes:
Network Destination Netmask Gateway
Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1
192.168.1.101 20
127.0.0.0 255.0.0.0 127.0.0.1
127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.101
192.168.1.101 20
192.168.1.101 255.255.255.255 127.0.0.1
127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.101
192.168.1.101 20
224.0.0.0 240.0.0.0 192.168.1.101
192.168.1.101 20
255.255.255.255 255.255.255.255 192.168.1.101
192.168.1.101 1
Default Gateway: 192.168.1.1
================================================== ========
=================
Persistent Routes:
None

route print for desktop1
================================================== ========
=================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 30 bd 1c d0 97 ...... Realtek RTL8139 Family
PCI Fast Ethernet NIC - Packet Scheduler Miniport
================================================== ========
=================
================================================== ========
=================
Active Routes:
Network Destination Netmask Gateway
Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1
192.168.1.100 20
127.0.0.0 255.0.0.0 127.0.0.1
127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.100
192.168.1.100 20
192.168.1.100 255.255.255.255 127.0.0.1
127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.100
192.168.1.100 20
224.0.0.0 240.0.0.0 192.168.1.100
192.168.1.100 20
255.255.255.255 255.255.255.255 192.168.1.100
192.168.1.100 1
Default Gateway: 192.168.1.1
================================================== ========
=================
Persistent Routes:
None

>-----Original Message-----
>On Mon, 9 Aug 2004 08:32:50 -0700, "CINDY"
>
>wrote:
>
>>
>>Chuck,
>>Let me first start by saying THANK YOU MUCH for your
>>help. Despite the fact that we have not solved this
>>problem conclusively, you have been the only person who
>>has really been able to move the bar forward.
>>So thanks again!
>>
>>Your assumptions are correct leading to the re-
>>installation of MS Client and File sharing.
>>Re-installation did not solve the issue and I went
ahead
>>and ran the Highjack this and Everest applications:
>
><SNIP Diagnostic Material>
>
>Cindy,
>
>Well, nothing interesting in either the HJT Log or the
Everest log. HJT shows a
>few things you should remove, but this is not a spyware
problem.
>
>From each computer, test connectivity:
>1) Ping the other by name.
>2) Ping the other by ip address.
>3) Ping itself by name.
>4) Ping itself by ip address.
>5) Ping 127.0.0.1.
>Report success / failure of each test (10 tests total).
>
>Provide static route for each computer.
>Start - Run - "cmd". Type "route print >c:\route.txt"
into the command window -
>Open c:\route.txt in Notepad, copy and paste into your
next post. Identify
>operating system (by name and version) with each
ipconfig listing.
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>

[CINDY]

i am not sure if i mentioned this but, there is no
instance of
MS Windows Network in my Network places.
only
Web Client Network
and
MS Terminal services




>-----Original Message-----
>On Mon, 9 Aug 2004 08:32:50 -0700, "CINDY"
>
>wrote:
>
>>
>>Chuck,
>>Let me first start by saying THANK YOU MUCH for your
>>help. Despite the fact that we have not solved this
>>problem conclusively, you have been the only person who
>>has really been able to move the bar forward.
>>So thanks again!
>>
>>Your assumptions are correct leading to the re-
>>installation of MS Client and File sharing.
>>Re-installation did not solve the issue and I went
ahead
>>and ran the Highjack this and Everest applications:
>
><SNIP Diagnostic Material>
>
>Cindy,
>
>Well, nothing interesting in either the HJT Log or the
Everest log. HJT shows a
>few things you should remove, but this is not a spyware
problem.
>
>From each computer, test connectivity:
>1) Ping the other by name.
>2) Ping the other by ip address.
>3) Ping itself by name.
>4) Ping itself by ip address.
>5) Ping 127.0.0.1.
>Report success / failure of each test (10 tests total).
>
>Provide static route for each computer.
>Start - Run - "cmd". Type "route print >c:\route.txt"
into the command window -
>Open c:\route.txt in Notepad, copy and paste into your
next post. Identify
>operating system (by name and version) with each
ipconfig listing.
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>

[Chuck]

On Wed, 11 Aug 2004 12:50:28 -0700, "CINDY"
> wrote:

>i am not sure if i mentioned this but, there is no
>instance of
>MS Windows Network in my Network places.
>only
>Web Client Network
>and
>MS Terminal services

Yeah, I saw that. Which is why I asked you to reinstall Client for Microsoft
Networks.

The only thing besides CMN would be NetBIOS Over TCP/IP (TCP/IP Properties -
Advanced - WINS - NetBIOS Setting. There's a repair procedure for NBT - I've
been looking for it. But if NBT was bad (or off), Desktop1 shouldn't be able to
access Laptop1 IMHO. Likewise for File and Printer Sharing for Microsoft
Networks.

I like challenges like this. But I prefer them when they end with a resolution.

Don't give up just yet.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[CINDY]

thanks for the vote of comfort.......
I really hope we can solve this problem.....!


>-----Original Message-----
>On Wed, 11 Aug 2004 12:50:28 -0700, "CINDY"
> wrote:
>
>>i am not sure if i mentioned this but, there is no
>>instance of
>>MS Windows Network in my Network places.
>>only
>>Web Client Network
>>and
>>MS Terminal services
>
>Yeah, I saw that. Which is why I asked you to reinstall
Client for Microsoft
>Networks.
>
>The only thing besides CMN would be NetBIOS Over TCP/IP
(TCP/IP Properties -
>Advanced - WINS - NetBIOS Setting. There's a repair
procedure for NBT - I've
>been looking for it. But if NBT was bad (or off),
Desktop1 shouldn't be able to
>access Laptop1 IMHO. Likewise for File and Printer
Sharing for Microsoft
>Networks.
>
>I like challenges like this. But I prefer them when
they end with a resolution.
>
>Don't give up just yet.
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>

[Chuck]

On Wed, 11 Aug 2004 12:50:28 -0700, "CINDY"
> wrote:

>i am not sure if i mentioned this but, there is no
>instance of
>MS Windows Network in my Network places.
>only
>Web Client Network
>and
>MS Terminal services

Cindy,

Go into Settings - Network Connections - Advanced - Advanced Settings. In the
Adapters and Bindings tab, highlight Local Area Connection, and look at Bindings
for Local Area Connection.

Does it show:
File and Printer Sharing for Microsoft Networks
Internet Protocol (TCP/IP)
Client for Microsoft Networks
Internet Protocol (TCP/IP)

Are all 4 bindings checked?

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[CINDY]

Chuck
yes to all bindings checked



>
>Cindy,
>
>Go into Settings - Network Connections - Advanced -
Advanced Settings. In the
>Adapters and Bindings tab, highlight Local Area
Connection, and look at Bindings
>for Local Area Connection.
>
>Does it show:
>File and Printer Sharing for Microsoft Networks
> Internet Protocol (TCP/IP)
>Client for Microsoft Networks
> Internet Protocol (TCP/IP)
>
>Are all 4 bindings checked?
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>

[CINDY]

Chuck
yes to all bindings checked



>
>Cindy,
>
>Go into Settings - Network Connections - Advanced -
Advanced Settings. In the
>Adapters and Bindings tab, highlight Local Area
Connection, and look at Bindings
>for Local Area Connection.
>
>Does it show:
>File and Printer Sharing for Microsoft Networks
> Internet Protocol (TCP/IP)
>Client for Microsoft Networks
> Internet Protocol (TCP/IP)
>
>Are all 4 bindings checked?
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>
..

[CINDY]

Chuck
yes to all bindings checked



>
>Cindy,
>
>Go into Settings - Network Connections - Advanced -
Advanced Settings. In the
>Adapters and Bindings tab, highlight Local Area
Connection, and look at Bindings
>for Local Area Connection.
>
>Does it show:
>File and Printer Sharing for Microsoft Networks
> Internet Protocol (TCP/IP)
>Client for Microsoft Networks
> Internet Protocol (TCP/IP)
>
>Are all 4 bindings checked?
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>
...


..

[Chuck]

On Mon, 16 Aug 2004 15:29:44 -0700, "CINDY"
> wrote:

>
>
>Chuck
>yes to all bindings checked

Cindy,

Why is sqlservr.exe running on the XP Pro computer? Are you (were you) running
a server?

Let's summarise yet again what we have observed, to date, with your computers.
Please verify each point carefully, I want to make sure I've not misread
anything you've stated.

1) Your XP Home computer can access shared data on the XP Pro computer, and
upon itself. Your XP Pro computer can access data on neither the XP Home
computer, nor on itself.

2) Your XP Home computer shows shares for the XP Pro computer, and for itself,
in Windows Explorer. Your XP Pro computer shows no shares whatsoever, in
Windows Explorer.

3) Your XP Home computer lists shares for the XP Pro computer, and for itself,
in File - Run (\\ComputerByName etc). Your XP Pro computer lists shares for
neither the XP Home computer, NOR itself, neither by name OR ip address ("ERROR-
Windows cannot find \\laptop1" AND "ERROR- Windows cannot find
\\192.168.1.101").

4) You have no firewall run, or installed, on either computer.

In order for us to carry on this conversation, we both have to be able to read
and write. In order for your computers to share files, they have to be able to
"read" shares (Client for MS Networks), and "write" shares (File and Printer
Sharing for MS Networks).

Your XP Home computer can both "read", and "write". That is, it can "read" its
own shares and the XP Pro shares, and it can "write" its own shares. The XP Pro
computer can "write" (the XP Home computer can, after all, "read" the XP Pro
computer). But it cannot "read".

And what we have tried as diagnostic procedures.

1) You have checked the displays in Windows Explorer. XP Home shows shares for
both itself, and XP Pro. XP Pro shows neither, nor does it show Microsoft
Windows Network in My Network Places.

2) You have checked File - Run shares listings for, and from, each computer.
Shares for both the XP Home and XP Pro computers are visible, but only from the
XP Home computer.

All of the above point, IMHO, to a problem with Client for MS Networks on XP Pro
computer. Yet you have un installed, and re installed, that network component,
with no improvement seen.

3) We have examined the Browser Status, IPConfig, and Static Route data for
both computers. No abnormalities were identified.

4) We have run diagnostic and spyware searching programs Everest and HijackThis
on your XP Pro computer. Cursory examination of output shows no network client
applications, nor any trace of a firewall, that, I believe, could cause problems
with accessing network resources. With exception to "sqlservr.exe".

I'm looking at ways to break Client for MS Networks, without breaking FPS for
Microsoft Networks. Nothing apparent yet.

Find file "C:\Program Files\Microsoft SQL
Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe" in Windows Explorer. Right click
on it, Properties. Under the Version tab, what displays for Company? File
version?

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[CINDY]

Chuck everything you have stated is correct and validated.
I am not sure why the sqlserv.exe is running on the XPpro
computer. Should i remove this?

on the last question you asked the company name is:
Microsoft
and the file version is:
2000.080.0818.00


>-----Original Message-----
>On Mon, 16 Aug 2004 15:29:44 -0700, "CINDY"
> wrote:
>
>>
>>
>>Chuck
>>yes to all bindings checked
>
>Cindy,
>
>Why is sqlservr.exe running on the XP Pro computer? Are
you (were you) running
>a server?
>
>Let's summarise yet again what we have observed, to
date, with your computers.
>Please verify each point carefully, I want to make sure
I've not misread
>anything you've stated.
>
>1) Your XP Home computer can access shared data on the
XP Pro computer, and
>upon itself. Your XP Pro computer can access data on
neither the XP Home
>computer, nor on itself.
>
>2) Your XP Home computer shows shares for the XP Pro
computer, and for itself,
>in Windows Explorer. Your XP Pro computer shows no
shares whatsoever, in
>Windows Explorer.
>
>3) Your XP Home computer lists shares for the XP Pro
computer, and for itself,
>in File - Run (\\ComputerByName etc). Your XP Pro
computer lists shares for
>neither the XP Home computer, NOR itself, neither by
name OR ip address ("ERROR-
>Windows cannot find \\laptop1" AND "ERROR- Windows
cannot find
>\\192.168.1.101").
>
>4) You have no firewall run, or installed, on either
computer.
>
>In order for us to carry on this conversation, we both
have to be able to read
>and write. In order for your computers to share files,
they have to be able to
>"read" shares (Client for MS Networks), and "write"
shares (File and Printer
>Sharing for MS Networks).
>
>Your XP Home computer can both "read", and "write".
That is, it can "read" its
>own shares and the XP Pro shares, and it can "write" its
own shares. The XP Pro
>computer can "write" (the XP Home computer can, after
all, "read" the XP Pro
>computer). But it cannot "read".
>
>And what we have tried as diagnostic procedures.
>
>1) You have checked the displays in Windows Explorer.
XP Home shows shares for
>both itself, and XP Pro. XP Pro shows neither, nor does
it show Microsoft
>Windows Network in My Network Places.
>
>2) You have checked File - Run shares listings for, and
from, each computer.
>Shares for both the XP Home and XP Pro computers are
visible, but only from the
>XP Home computer.
>
>All of the above point, IMHO, to a problem with Client
for MS Networks on XP Pro
>computer. Yet you have un installed, and re installed,
that network component,
>with no improvement seen.
>
>3) We have examined the Browser Status, IPConfig, and
Static Route data for
>both computers. No abnormalities were identified.
>
>4) We have run diagnostic and spyware searching
programs Everest and HijackThis
>on your XP Pro computer. Cursory examination of output
shows no network client
>applications, nor any trace of a firewall, that, I
believe, could cause problems
>with accessing network resources. With exception
to "sqlservr.exe".
>
>I'm looking at ways to break Client for MS Networks,
without breaking FPS for
>Microsoft Networks. Nothing apparent yet.
>
>Find file "C:\Program Files\Microsoft SQL
>Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe" in Windows
Explorer. Right click
>on it, Properties. Under the Version tab, what displays
for Company? File
>version?
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>

[Chuck]

On Mon, 16 Aug 2004 20:46:06 -0700, "CINDY"
> wrote:

>Chuck everything you have stated is correct and validated.
>I am not sure why the sqlserv.exe is running on the XPpro
>computer. Should i remove this?
>
>on the last question you asked the company name is:
>Microsoft
>and the file version is:
>2000.080.0818.00

Cindy,

If the SQL program is indeed Microsoft (and AFAIK, the Properties tab is
reliable), it's not a threat. I was looking for spyware causing your problem.
OTOH, if you don't have a valid reason for running it, it wouldn't be a bad idea
to disable it (MSConfig) and reboot.

Also, what is this:
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll

When you disable the various (a couple) SQL modules from autostart, how about
you note what registry key they are under, and let me know. I don't see any
entries in the HJT log, under O4 or whatever, for SQL. See this tutorial re the
HJT log, written by the author of HJT, if you wish:
<http://www.spywareinfo.com/~merijn/htlogtutorial.html>

How about some history of this computer. Did it used to be a server? MS
Message Queue Server and SQL Server? Is SQL started by MQ?

I don't see any spyware threats, but this server stuff is looking kinda
interesting...

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[CINDY]

I tried to disable some of the sql programs - one of the
sql is related to MS Business contract manager and is
valid.
as for the O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s
mqrt.dll it appears to be:
MsmqIntCert ?
regsvr32 /s mqrt.dll
Microsoft Message Queue Server - Internal Certificate -
see here for more info and here for a potential problem.

this computer was never used as a server, but, that does
not mean there were features enabled by mistake that set
it up as a server (to my knowledge).


is there a way to reset everything? i really am at a
loss as to what to do!!!

would it be better to contact you directly via email?


>Cindy,
>
>If the SQL program is indeed Microsoft (and AFAIK, the
Properties tab is
>reliable), it's not a threat. I was looking for spyware
causing your problem.
>OTOH, if you don't have a valid reason for running it,
it wouldn't be a bad idea
>to disable it (MSConfig) and reboot.
>
>Also, what is this:
>O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
>
>When you disable the various (a couple) SQL modules from
autostart, how about
>you note what registry key they are under, and let me
know. I don't see any
>entries in the HJT log, under O4 or whatever, for SQL.
See this tutorial re the
>HJT log, written by the author of HJT, if you wish:
><http://www.spywareinfo.com/~merijn/htlogtutorial.html>
>
>How about some history of this computer. Did it used to
be a server? MS
>Message Queue Server and SQL Server? Is SQL started by
MQ?
>
>I don't see any spyware threats, but this server stuff
is looking kinda
>interesting...
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>

[CINDY]

I tried to disable some of the sql programs - one of the
sql is related to MS Business contract manager and is
valid.
as for the O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s
mqrt.dll it appears to be:
MsmqIntCert ?
regsvr32 /s mqrt.dll
Microsoft Message Queue Server - Internal Certificate -
see here for more info and here for a potential problem.

this computer was never used as a server, but, that does
not mean there were features enabled by mistake that set
it up as a server (to my knowledge).


is there a way to reset everything? i really am at a
loss as to what to do!!!

would it be better to contact you directly via email?


>Cindy,
>
>If the SQL program is indeed Microsoft (and AFAIK, the
Properties tab is
>reliable), it's not a threat. I was looking for spyware
causing your problem.
>OTOH, if you don't have a valid reason for running it,
it wouldn't be a bad idea
>to disable it (MSConfig) and reboot.
>
>Also, what is this:
>O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
>
>When you disable the various (a couple) SQL modules from
autostart, how about
>you note what registry key they are under, and let me
know. I don't see any
>entries in the HJT log, under O4 or whatever, for SQL.
See this tutorial re the
>HJT log, written by the author of HJT, if you wish:
><http://www.spywareinfo.com/~merijn/htlogtutorial.html>
>
>How about some history of this computer. Did it used to
be a server? MS
>Message Queue Server and SQL Server? Is SQL started by
MQ?
>
>I don't see any spyware threats, but this server stuff
is looking kinda
>interesting...
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>
..

[Chuck]

On Tue, 17 Aug 2004 10:50:45 -0700, "CINDY"
> wrote:

>I tried to disable some of the sql programs - one of the
>sql is related to MS Business contract manager and is
>valid.
>as for the O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s
>mqrt.dll it appears to be:
>MsmqIntCert ?
>regsvr32 /s mqrt.dll
>Microsoft Message Queue Server - Internal Certificate -
>see here for more info and here for a potential problem.
>
>this computer was never used as a server, but, that does
>not mean there were features enabled by mistake that set
>it up as a server (to my knowledge).
>
>
>is there a way to reset everything? i really am at a
>loss as to what to do!!!
>
>would it be better to contact you directly via email?

Cindy,

If you have a current, legit reason for having SQL server, then we shouldn't
disturb it. Probably won't help anyway.

I guess it's time to use email - I'm "rzurcetin AT oohay DOT moc" (look at the
address in the mirror). ;-)

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[CINDY]

I tried to disable some of the sql programs - one of the
sql is related to MS Business contract manager and is
valid.
as for the O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s
mqrt.dll it appears to be:
MsmqIntCert ?
regsvr32 /s mqrt.dll
Microsoft Message Queue Server - Internal Certificate -
see here for more info and here for a potential problem.

this computer was never used as a server, but, that does
not mean there were features enabled by mistake that set
it up as a server (to my knowledge).


is there a way to reset everything? i really am at a
loss as to what to do!!!

would it be better to contact you directly via email?


>Cindy,
>
>If the SQL program is indeed Microsoft (and AFAIK, the
Properties tab is
>reliable), it's not a threat. I was looking for spyware
causing your problem.
>OTOH, if you don't have a valid reason for running it,
it wouldn't be a bad idea
>to disable it (MSConfig) and reboot.
>
>Also, what is this:
>O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
>
>When you disable the various (a couple) SQL modules from
autostart, how about
>you note what registry key they are under, and let me
know. I don't see any
>entries in the HJT log, under O4 or whatever, for SQL.
See this tutorial re the
>HJT log, written by the author of HJT, if you wish:
><http://www.spywareinfo.com/~merijn/htlogtutorial.html>
>
>How about some history of this computer. Did it used to
be a server? MS
>Message Queue Server and SQL Server? Is SQL started by
MQ?
>
>I don't see any spyware threats, but this server stuff
is looking kinda
>interesting...
>
>Cheers,
>Chuck
>Paranoia comes from experience - and is not necessarily
a bad thing.
>.
>
...


..

[Chuck]

On Sat, 21 Aug 2004 15:30:54 -0700, "CINDY"
> wrote:

> I tried to disable some of the sql programs - one of the
>sql is related to MS Business contract manager and is
>valid.
>as for the O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s
>mqrt.dll it appears to be:
>MsmqIntCert ?
>regsvr32 /s mqrt.dll
>Microsoft Message Queue Server - Internal Certificate -
>see here for more info and here for a potential problem.
>
>this computer was never used as a server, but, that does
>not mean there were features enabled by mistake that set
>it up as a server (to my knowledge).
>
>
>is there a way to reset everything? i really am at a
>loss as to what to do!!!
>
>would it be better to contact you directly via email?

Cindy,

I have a few more things to try. Email probably would be better now. I'm
"rzurcetin AT oohay DOT moc" (look at the address in the mirror). ;-)

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[John Woodgate]

In article >, Chuck
> writes
>I'm "rzurcetin AT oohay DOT moc" (look at the address in the mirror).
>;-)

You are 'com TOD yahoo TA nitecruzr' with some of the letters reversed
left-to-right? How do I type that with a normal keyboard (or even an
abnormal one)? (;-)
--
Regards, John Woodgate, OOO - Own Opinions Only.
The good news is that nothing is compulsory.
The bad news is that everything is prohibited.
http://www.jmwa.demon.co.uk Also see http://www.isce.org.uk

[Lou Ramsey]

John,

Although email addresses are sometimes munged in a humorous way, when
posted on Usenet (with either the munged address or the unmunging clue
stated in a frivilous tone), the munging is done with a serious purpose.
That is, to provide one's email address to other Usenet readers,
without actually having it listed in the forum in which it's posted.
The address that is munged is not vulnerable to the many email address
mining efforts that feed spam address lists.

Repeating someone's address, unmunged, in a reply, is rude.

Please read these articles on munging.
http://members.aol.com/emailfaq/mungfaq.html
http://www.mailmsg.com/SPAM_munging.htm

[yo yo]

this means nothing to sertan types of computers because the computers are
built in systems and you talk balls

[Maincat]

"yo yo" <yo yo @discussions.microsoft.com> wrote in message
...
> this means nothing to sertan types of computers because the computers are
> built in systems and you talk balls

Hello planet Earth calling, do you read me?

[Chuck [MVP]]

On Sat, 10 Nov 2007 09:23:01 -0800, yo yo <yo yo @discussions.microsoft.com>
wrote:

>this means nothing to sertan types of computers because the computers are
>built in systems and you talk balls

Please don't smoke that stuff, then post here (unless you're prepared to share).

--
Cheers,
Chuck, MS-MVP 2005-2007 [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.

[HEMI-Powered]

=?Utf-8?B?eW8geW8=?= added these comments in the current
discussion du jour ...

> this means nothing to sertan types of computers because the
> computers are built in systems and you talk balls
>
huh?!


--
HP, aka Jerry

[Lanwench [MVP - Exchange]]

yo yo <yo yo @discussions.microsoft.com> wrote:
> this means nothing to sertan types of computers because the computers
> are built in systems and you talk balls

You're supposed to put the shiny side facing OUTWARDS.

[Richard G. Harper]

Are you sure? I always put the shiny side facing INWARD.

--
Richard G. Harper [MVP Shell/User]
* NEW! Catch my blog ... http://msmvps.com/blogs/rgharper/
* PLEASE post all messages and replies in the newsgroups
* The Website - http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Lanwench [MVP - Exchange]"
oo.com> wrote in message
...
> yo yo <yo yo @discussions.microsoft.com> wrote:
>> this means nothing to sertan types of computers because the computers
>> are built in systems and you talk balls
>
> You're supposed to put the shiny side facing OUTWARDS.
>

[Lanwench [MVP - Exchange]]

Richard G. Harper > wrote:
> Are you sure? I always put the shiny side facing INWARD.

Yes, and look what happened to you, man! ;)
>
>
> "Lanwench [MVP - Exchange]"
> oo.com> wrote in
> message ...
>> yo yo <yo yo @discussions.microsoft.com> wrote:
>>> this means nothing to sertan types of computers because the
>>> computers are built in systems and you talk balls
>>
>> You're supposed to put the shiny side facing OUTWARDS.

[Richard G. Harper]

Okay, valid point. ;-)

--
Richard G. Harper [MVP Shell/User]
* NEW! Catch my blog ... http://msmvps.com/blogs/rgharper/
* PLEASE post all messages and replies in the newsgroups
* The Website - http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Lanwench [MVP - Exchange]"
oo.com> wrote in message
...

> Yes, and look what happened to you, man! ;)

[Hugo]

"cindy" wrote:

> CHUCK...
>
> sorry the information from my last post was from the
> laptop1 (windows XP Pro version 2002 SP 1) machine
>
> from the Desktop machine (XP Home Edition 2002 SP 1)
>
> Status for domain HOME on transport \Device\NetBT_Tcpip_
> {C424CF9F-054E-442B-BB24-C8BBB0146B78}
> Browsing is active on domain.
> Master browser name is: DESKTOP1
> Master browser is running build 2600
> 2 backup servers retrieved from master DESKTOP1
> \\LAPTOP1
> \\DESKTOP1
> There are 2 servers in domain HOME on transport
> \Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
> There are 1 domains in domain HOME on transport
> \Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
>
>
>
>
>
> >-----Original Message-----
> >On Thu, 5 Aug 2004 14:36:24 -0700, "CINDY"
> >
> >wrote:
> >
> >>Chuck, here is the output for Browstat status:
> >>
> >>Status for domain HOME on transport \Device\NetBT_Tcpip_
> >>{8322D2F4-9FB3-4DC6-9503
> >>-53544403C67F}
> >> Browsing is active on domain.
> >> Master browser name is: DESKTOP1
> >>Could not connect to registry, error = 53 Unable
> >>to determine build of br
> >>owser master: 53
> >> \\\\DESKTOP1 . Version:05.01 Flags: 71203 NT
> >>POTENTIAL BACKUP MASTER
> >>
> >> 2 backup servers retrieved from master DESKTOP1
> >> \\LAPTOP1
> >> \\DESKTOP1
> >> There are 2 servers in domain HOME on transport
> >>\Device\NetBT_Tcpip_{8322D2F
> >>4-9FB3-4DC6-9503-53544403C67F}
> >> There are 1 domains in domain HOME on transport
> >>\Device\NetBT_Tcpip_{8322D2F
> >>4-9FB3-4DC6-9503-53544403C67F}
> >
> >Cindy,
> >
> >That's from which computer? Did you run it on the other
> computer also?
> >
> >And what service pack level on each computer?
> >
> >Cheers,
> >Chuck
> >Paranoia comes from experience - and is not necessarily
> a bad thing.
> >.
> >
> ...
>
>
> ..
>
>
>

[improve generic host process for win 32]

"cindy" wrote:

> CHUCK...
>
> sorry the information from my last post was from the
> laptop1 (windows XP Pro version 2002 SP 1) machine
>
> from the Desktop machine (XP Home Edition 2002 SP 1)
>
> Status for domain HOME on transport \Device\NetBT_Tcpip_
> {C424CF9F-054E-442B-BB24-C8BBB0146B78}
> Browsing is active on domain.
> Master browser name is: DESKTOP1
> Master browser is running build 2600
> 2 backup servers retrieved from master DESKTOP1
> \\LAPTOP1
> \\DESKTOP1
> There are 2 servers in domain HOME on transport
> \Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
> There are 1 domains in domain HOME on transport
> \Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
>
>
>
>
>
> >-----Original Message-----
> >On Thu, 5 Aug 2004 14:36:24 -0700, "CINDY"
> >
> >wrote:
> >
> >>Chuck, here is the output for Browstat status:
> >>
> >>Status for domain HOME on transport \Device\NetBT_Tcpip_
> >>{8322D2F4-9FB3-4DC6-9503
> >>-53544403C67F}
> >> Browsing is active on domain.
> >> Master browser name is: DESKTOP1
> >>Could not connect to registry, error = 53 Unable
> >>to determine build of br
> >>owser master: 53
> >> \\\\DESKTOP1 . Version:05.01 Flags: 71203 NT
> >>POTENTIAL BACKUP MASTER
> >>
> >> 2 backup servers retrieved from master DESKTOP1
> >> \\LAPTOP1
> >> \\DESKTOP1
> >> There are 2 servers in domain HOME on transport
> >>\Device\NetBT_Tcpip_{8322D2F
> >>4-9FB3-4DC6-9503-53544403C67F}
> >> There are 1 domains in domain HOME on transport
> >>\Device\NetBT_Tcpip_{8322D2F
> >>4-9FB3-4DC6-9503-53544403C67F}
> >
> >Cindy,
> >
> >That's from which computer? Did you run it on the other
> computer also?
> >
> >And what service pack level on each computer?
> >
> >Cheers,
> >Chuck
> >Paranoia comes from experience - and is not necessarily
> a bad thing.
> >.
> >
> ...
>
>
> ..
>
>
>

[improve generic host process for win 32]

"cindy" wrote:

> CHUCK...
>
> sorry the information from my last post was from the
> laptop1 (windows XP Pro version 2002 SP 1) machine
>
> from the Desktop machine (XP Home Edition 2002 SP 1)
>
> Status for domain HOME on transport \Device\NetBT_Tcpip_
> {C424CF9F-054E-442B-BB24-C8BBB0146B78}
> Browsing is active on domain.
> Master browser name is: DESKTOP1
> Master browser is running build 2600
> 2 backup servers retrieved from master DESKTOP1
> \\LAPTOP1
> \\DESKTOP1
> There are 2 servers in domain HOME on transport
> \Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
> There are 1 domains in domain HOME on transport
> \Device\NetBT_Tcpip_{C424CF9F-054E-442B-BB24-C8BBB0146B78}
>
>
>
>
>
> >-----Original Message-----
> >On Thu, 5 Aug 2004 14:36:24 -0700, "CINDY"
> >
> >wrote:
> >
> >>Chuck, here is the output for Browstat status:
> >>
> >>Status for domain HOME on transport \Device\NetBT_Tcpip_
> >>{8322D2F4-9FB3-4DC6-9503
> >>-53544403C67F}
> >> Browsing is active on domain.
> >> Master browser name is: DESKTOP1
> >>Could not connect to registry, error = 53 Unable
> >>to determine build of br
> >>owser master: 53
> >> \\\\DESKTOP1 . Version:05.01 Flags: 71203 NT
> >>POTENTIAL BACKUP MASTER
> >>
> >> 2 backup servers retrieved from master DESKTOP1
> >> \\LAPTOP1
> >> \\DESKTOP1
> >> There are 2 servers in domain HOME on transport
> >>\Device\NetBT_Tcpip_{8322D2F
> >>4-9FB3-4DC6-9503-53544403C67F}
> >> There are 1 domains in domain HOME on transport
> >>\Device\NetBT_Tcpip_{8322D2F
> >>4-9FB3-4DC6-9503-53544403C67F}
> >
> >Cindy,
> >
> >That's from which computer? Did you run it on the other
> computer also?
> >
> >And what service pack level on each computer?
> >
> >Cheers,
> >Chuck
> >Paranoia comes from experience - and is not necessarily
> a bad thing.
> >.
> >
> ...
>
>
> ..
>
>
>