Windows XP Won't Save Settings For DSL

[Un4g1v3n]

Well, now that I got rid of the LSASS.exe error, I'm getting another weird problem.

When I click the link to connect my DSL modem to the internet, it says invalid password and username. So I went to check the settings, it was no longer asking for a username and password and certificate, etc... So, I made it so it required me to do that.

I entered my info and put 'Save my username and password' for 'Everyone who uses this computer'.

What's wierd was my username: b1sq43.62.168.192

Anyhow, I changed it, but anytime I disconnect from the internet and close the connection, the settings change back.

Anyone know what's going on?

[icecube]

Part of that user name looks like an IP to me You probably have some spyware on the system. It probably reinstalls itself on reboot.

Go to MS and download their Defender program here is a link

Its free. Note Defender will refuse to install if you have an invalid product key.

Run it and see what it finds

You might also post a hijack log of your system, some of that malware is smart enough to keep Defender from installing.

[Un4g1v3n]

[Un4g1v3n]

[Gecko]

First of all Hijackthis should not be run from a temp directory!
(C:\Documents and Settings\Mat\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe)
Extract hijackthis to your desktop in it’s own folder like this
C:\Documents and Settings\Mat\desktop\hjt\HijackThis.exe

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Once in safe mode
Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
cohk.exe
svchozt.exe
itunesff.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O1 - Hosts: 220.232.149.248 lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 online.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.co.uk
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 www.lloydstsb.com
O1 - Hosts: 220.232.149.248 personal.barclays.co.uk
O1 - Hosts: 220.232.149.248 barclays.co.uk
O1 - Hosts: 220.232.149.248 ibank.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.barclays.co.uk
O1 - Hosts: 220.232.149.248 www.nwolb.com
O1 - Hosts: 220.232.149.248 nwolb.com
O1 - Hosts: 220.232.149.248 hsbc.co.uk
O1 - Hosts: 220.232.149.248 www.hsbc.co.uk
O1 - Hosts: 220.232.149.248 abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.com
O1 - Hosts: 220.232.149.248 www.abbey.co.uk
O1 - Hosts: 220.232.149.248 abbey.co.uk
O1 - Hosts: 220.232.149.248 cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.com
O1 - Hosts: 220.232.149.248 www.cahoot.co.uk
O1 - Hosts: 220.232.149.248 cahoot.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 co-operativebank.co.uk
O1 - Hosts: 220.232.149.248 www.co-operativebank.com
O1 - Hosts: 220.232.149.248 co-operativebank.com
O1 - Hosts: 220.232.149.248 welcome2.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome6.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome8.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 welcome10.co-operativebankonline.co.uk
O1 - Hosts: 220.232.149.248 www.smile.co.uk
O1 - Hosts: 220.232.149.248 smile.co.uk
O1 - Hosts: 220.232.149.248 www.cajamar.es
O1 - Hosts: 220.232.149.248 cajamar.es
O1 - Hosts: 220.232.149.248 www.cajamar.com
O1 - Hosts: 220.232.149.248 cajamar.com
O1 - Hosts: 220.232.149.248 www.unicaja.es
O1 - Hosts: 220.232.149.248 unicaja.es
O1 - Hosts: 220.232.149.248 www.unicaja.com
O1 - Hosts: 220.232.149.248 unicaja.com
O1 - Hosts: 220.232.149.248 www.caixagalicia.es
O1 - Hosts: 220.232.149.248 caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixagalicia.com
O1 - Hosts: 220.232.149.248 caixagalicia.com
O1 - Hosts: 220.232.149.248 activa.caixagalicia.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.es
O1 - Hosts: 220.232.149.248 caixapenedes.es
O1 - Hosts: 220.232.149.248 www.caixapenedes.com
O1 - Hosts: 220.232.149.248 caixapenedes.com
O1 - Hosts: 220.232.149.248 bancae.caixapenedes.com
O1 - Hosts: 220.232.149.248 www.caixasabadell.es
O1 - Hosts: 220.232.149.248 caixasabadell.es
O1 - Hosts: 220.232.149.248 www.caixasabadell.net
O1 - Hosts: 220.232.149.248 caixasabadell.net
O1 - Hosts: 220.232.149.248 www.cajamadrid.es
O1 - Hosts: 220.232.149.248 cajamadrid.es
O1 - Hosts: 220.232.149.248 www.cajamadrid.com
O1 - Hosts: 220.232.149.248 cajamadrid.com
O1 - Hosts: 220.232.149.248 oi.cajamadrid.es
O1 - Hosts: 220.232.149.248 www.ccm.es
O1 - Hosts: 220.232.149.248 ccm.es
O1 - Hosts: 220.232.149.248 www.haspa.de
O1 - Hosts: 220.232.149.248 haspa.de
O1 - Hosts: 220.232.149.248 ssl2.haspa.de
O1 - Hosts: 220.232.149.248 www.dresdner-bank.de
O1 - Hosts: 220.232.149.248 dresdner-bank.de
O1 - Hosts: 220.232.149.248 www.dresdner-privat.de
O1 - Hosts: 220.232.149.248 postbank.de
O1 - Hosts: 220.232.149.248 www.postbank.de
O1 - Hosts: 220.232.149.248 banking.postbank.de
O1 - Hosts: 220.232.149.248 www.sparda-b.de
O1 - Hosts: 220.232.149.248 sparda-b.de
O1 - Hosts: 220.232.149.248 www.bankingonline.de
O1 - Hosts: 220.232.149.248 www.raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 raiffeisenbank-erding.de
O1 - Hosts: 220.232.149.248 www.vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 vr-networld-ebanking.de
O1 - Hosts: 220.232.149.248 www.bnhof.de
O1 - Hosts: 220.232.149.248 bnhof.de
O1 - Hosts: 220.232.149.248 www.deutsche-bank.de
O1 - Hosts: 220.232.149.248 deutsche-bank.de
O1 - Hosts: 220.232.149.248 meine.deutsche-bank.de
O1 - Hosts: 220.232.149.248 www.citibank.de
O1 - Hosts: 220.232.149.248 citibank.de
O1 - Hosts: 220.232.149.248 www.dkb.de
O1 - Hosts: 220.232.149.248 dkb.de
O1 - Hosts: 220.232.149.248 www.sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 sparkasse-regensburg.de
O1 - Hosts: 220.232.149.248 www.berliner-bank.de
O1 - Hosts: 220.232.149.248 berliner-bank.de
O1 - Hosts: 220.232.149.248 www.berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 berliner-sparkasse.de
O1 - Hosts: 220.232.149.248 www.wellsfargo.com
O1 - Hosts: 220.232.149.248 wellsfargo.com
O1 - Hosts: 220.232.149.248 www.bankofamerica.com
O1 - Hosts: 220.232.149.248 bankofamerica.com
O1 - Hosts: 220.232.149.248 www.usbank.com
O1 - Hosts: 220.232.149.248 usbank.com
O1 - Hosts: 220.232.149.248 www.bankone.com
O1 - Hosts: 220.232.149.248 bankone.com
O1 - Hosts: 220.232.149.248 www.citibank.com
O1 - Hosts: 220.232.149.248 citibank.com
O4 - HKLM\..\Run: [Msn Messenger] cohk.exe
O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS\System32\svchozt.exe
O4 - HKLM\..\Run: [itunesff] C:\WINDOWS\SYSTEM32\itunesff.exe -go -c49 -w
O4 - HKLM\..\RunServices: [Msn Messenger] cohk.exe
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {33331111-1131-1111-1111-611111193428} -
O16 - DPF: {43331111-1111-1111-1111-611111195622} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B1E0AF77-1D95-40AD-B706-F442820207AB}: NameServer = 206.47.244.61 206.47.244.89
O17 - HKLM\System\CCS\Services\Tcpip\..\{F813437D-14D9-4C17-9C6D-1777D8502827}: NameServer = 192.168.2.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll


Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\WINDOWS\System32\cohk.exe
C:\WINDOWS\System32\svchozt.exe
C:\WINDOWS\SYSTEM32\itunesff.exe
c:\eied_s7.cab
C:\WINDOWS\System32\vbsys2.dll


Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

[icecube]