Computer acting weird and no Internet Access

[Malware Removal Specialist]

Do you have the link Super Dave?

There are three links in Reply # 8

There are 3 links to combo-fix but i have that on my flash drive already,its when the combofix is running the prompt is coming up to download Windows Recovery but thats where i cant because i do not have internet access.Sorry i am not very computer savy.

[Malware Removal Specialist]

but thats where i cant because i do not have internet access.Sorry i am not very computer savy.

Sorry, I didn't realize you couldn't access the net.

Please download this file from Microsoft and save it on your desktop.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU

Next, please drop/drop it onto Combofix, and Combofix will install the recovery console.



Once that is done, Combofix will ask if you want to continue to scan. Select no, and then let me know once you have gotten this far.

Well have another issue ,i can download only a shortcut of combofix and windows bootdisk buto the desktop.Ithen try to move the windows xp recovery onto the combofix and it wont move.For that matter i cannot arrange any of my desktops?

[Malware Removal Specialist]

Let's see what's up with your internet connection.

Please download MiniToolBox to Desktop and run it.



Checkmark the following boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• List content of Hosts
• List IP Configuration
• Lst Last 10 Event Viewer Errors
• List Users, Partitions and Memory Size
[/b]

Click Go and copy/paste the log (Result.txt) into your next post.

Ok thanks,here is the Mini Log

iniToolBox by Farbar  Version: 18-01-2012
Ran by  (administrator) on 05-02-2012 at 21:06:41
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Could not flush the DNS Resolver Cache: Function failed during execution.




========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================

127.0.0.1       localhost

========================= IP Configuration: ================================


WARNING: Could not obtain host information from machine: [KEITHS]. Some commands may not be available.
The RPC server is unavailable.



# ----------------------------------
# Interface IP Configuration         
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



        Host Name . . . . . . . . . . . . : keiths

        Primary Dns Suffix  . . . . . . . :

        Node Type . . . . . . . . . . . . : Broadcast

        IP Routing Enabled. . . . . . . . : No

        WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection:



        Connection-specific DNS Suffix  . :

        Description . . . . . . . . . . . : 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)

        Physical Address. . . . . . . . . : 00-B0-D0-18-01-50

        Dhcp Enabled. . . . . . . . . . . : Yes

        Autoconfiguration Enabled . . . . : Yes

        IP Address. . . . . . . . . . . . : 0.0.0.0

        Subnet Mask . . . . . . . . . . . : 0.0.0.0

        Default Gateway . . . . . . . . . :

        DHCP Server . . . . . . . . . . . : 255.255.255.255

Server:  UnKnown
Address:  127.0.0.1

Ping request could not find host google.com. Please check the name and try again.

Server:  UnKnown
Address:  127.0.0.1

Ping request could not find host yahoo.com. Please check the name and try again.

Server:  UnKnown
Address:  127.0.0.1

Ping request could not find host bleepingcomputer.com. Please check the name and try again.



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 b0 d0 18 01 50 ...... 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1     1
  255.255.255.255  255.255.255.255  255.255.255.255               2     1
===========================================================================
Persistent Routes:
  None

========================= Event log errors: ===============================

Application errors:
==================
Error: (01/27/2012 08:31:30 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (01/27/2012 08:24:50 PM) (Source: WmiAdapter) (User: Administrators)Administrators
Description: Open of service failed.

Error: (01/26/2012 10:04:11 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (01/26/2012 04:43:39 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x001545f2.
Processing media-specific event for [iexplore.exe!ws!]

Error: (01/26/2012 06:54:34 AM) (Source: Application Error) (User: )
Description: Faulting application winlogon.exe, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x005824ae.
Error in creating result PEAP-TLV in response to received PEAP-TLV (winlogon.exe!ld!)

Error: (01/26/2012 01:51:26 AM) (Source: Application Error) (User: )
Description: Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x005824ae.
Processing media-specific event for [!ws!]

Error: (01/26/2012 01:46:25 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x00150dca.
Processing media-specific event for [iexplore.exe!ws!]

Error: (01/25/2012 09:32:14 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x00000000.
Error in creating result PEAP-TLV in response to received PEAP-TLV (iexplore.exe!ld!)

Error: (01/24/2012 11:57:48 PM) (Source: Application Error) (User: )
Description: Faulting application explorer.exe, version 0.0.0.0, faulting module , version 0.0.0.0, fault address 0x00000000.
Processing media-specific event for [explorer.exe!ws!]

Error: (01/24/2012 09:22:24 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x001523eb.
Error in creating result PEAP-TLV in response to received PEAP-TLV (iexplore.exe!ld!)


System errors:
=============
Error: (01/27/2012 08:25:19 PM) (Source: Service Control Manager) (User: )
Description: The WMI Performance Adapter service failed to start due to the following error:
%%1053

Error: (01/27/2012 08:25:19 PM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 milliseconds) waiting for the WMI Performance Adapter service to connect.

Error: (01/26/2012 09:51:59 PM) (Source: 0) (User: )
Description: 0.0.0.0:2869

Error: (01/26/2012 09:51:59 PM) (Source: 0) (User: )
Description: 0.0.0.0:2869

Error: (01/26/2012 06:53:39 AM) (Source: Service Control Manager) (User: )
Description: The IMAPI CD-Burning COM Service service failed to start due to the following error:
%%1053

Error: (01/26/2012 06:53:39 AM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

Error: (01/26/2012 01:51:29 AM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the DCOM Server Process Launcher service, but this action failed with the following error:
%%1726

Error: (01/26/2012 01:49:59 AM) (Source: Service Control Manager) (User: )
Description: The Terminal Services service terminated unexpectedly.  It has done this 1 time(s).

Error: (01/26/2012 01:49:59 AM) (Source: Service Control Manager) (User: )
Description: The DCOM Server Process Launcher service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

Error: (01/24/2012 09:46:36 AM) (Source: SideBySide) (User: )
Description: Generate Activation Context failed for C:\WINDOWS\system32\browseui.dll.
Reference error message: The operation completed successfully.
.


Microsoft Office Sessions:
=========================
Error: (01/27/2012 08:31:30 PM) (Source: Application Hang)(User: )
Description: iexplore.exe8.0.6001.18702hungapp0.0.0. 000000000

Error: (01/27/2012 08:24:50 PM) (Source: WmiAdapter)(User: Administrators)Administrators
Description:

Error: (01/26/2012 10:04:11 PM) (Source: Application Hang)(User: )
Description: iexplore.exe8.0.6001.18702hungapp0.0.0. 000000000

Error: (01/26/2012 04:43:39 PM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.6001.18702unknown0.0.0. 0001545f2

Error: (01/26/2012 06:54:34 AM) (Source: Application Error)(User: )
Description: winlogon.exe0.0.0.0unknown0.0.0.0005824 ae

Error: (01/26/2012 01:51:26 AM) (Source: Application Error)(User: )
Description: 0.0.0.0unknown0.0.0.0005824ae

Error: (01/26/2012 01:46:25 AM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.6001.18702unknown0.0.0. 000150dca

Error: (01/25/2012 09:32:14 PM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.6001.18702unknown0.0.0. 000000000

Error: (01/24/2012 11:57:48 PM) (Source: Application Error)(User: )
Description: explorer.exe0.0.0.00.0.0.000000000

Error: (01/24/2012 09:22:24 PM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.6001.18702unknown0.0.0. 0001523eb


========================= Memory info: ===================================

Percentage of memory in use: 63%
Total physical RAM: 511.07 MB
Available physical RAM: 183.99 MB
Total Pagefile: 1249.17 MB
Available Pagefile: 786.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1993.9 MB

========================= Partitions: =====================================

2 Drive c: () (Fixed) (Total:149.04 GB) (Free:90.4 GB) NTFS
5 Drive f: (Lexar) (Removable) (Total:14.9 GB) (Free:14.88 GB) FAT32

========================= Users: ========================================

User accounts for \\

Administrator            Guest                    HelpAssistant           
           
SUPPORT_388945a0         


**** End of log ****

[Malware Removal Specialist]

Please navigate to Start>Run and type cmd

in the window that pops up type ipconfig /flushdns

***************************************************
Please download Farbar Service Scanner and run it on the computer with the issue.

• Press "Scan".
  
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Ok after i typed in the ipconfig/flushdns i got a message could not flush dns resolver cache function failed during exsecution.

Also the log file for Farbar is as follows:

Running from "F:\"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking LEGACY_Dnscache: Attention! Unable to open LEGACY_Dnscache\0000 registry key. The key does not exist.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp: "%SystemRoot%\system32\dhcpsvc.dll".


Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returend error: Yahoo IP is unreachable

RpcSs Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to retrieve start type of RpcSs. The value does not exist.
The ImagePath of RpcSs: "%SystemRoot%\system32\svchost.exe -k rpcss".
The ServiceDll of RpcSs service is OK.
Checking LEGACY_RpcSs: Attention! Unable to open LEGACY_RpcSs\0000 registry key. The key does not exist.


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
Attention! C:\WINDOWS\system32\svchost.exe is missing.
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) PSched(7) SYMTDI(1) Tcpip(4)
0x0700000005000000030000000400000001000 000080000000600000007000000
IpSec Tag value is correct.

**** End of log ****

[Malware Removal Specialist]

Please download SystemLook from one of the links below and save it to your desktop.

Link # 1
Link # 2

Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double-click SystemLook.exe to run it.

Copy the contents of the following codebox into the main textfield.

Code: [Select]

:filefind
svchost.exe
Click the Look button to start the scan.

Note: The scan may take some time so please just let it do its work and be patient (or do something else unrelated to the computer).

When finished, a notepad window will open with the results of the scan. Please post the log. The log can also be found on your desktop entitled SystemLook.txt

ok i can not seem to fnd the norton 360 icon in my system tray or toolbar to disable it,i try to click on the 360 i
on the desktop an it just locks up at internet connection problem?

[Malware Removal Specialist]

These instructions won't work for you?

NORTON ANTIVIRUS (by Symantec)
Please navigate to the system tray on the bottom right hand corner and look for a sign.
•right-click it -> chose "Disable Auto-Protect."

•select a duration of 5 hours (this assures no interference with the cleanup of your pc)

•click "Ok."

•a popup will warn that protection will now be disabled and the sign will now look like this:

NORTON 360
•Right-click the Norton 360 Premier Edition icon in the system tray and select Disable Antivirus Automatic-Protect.

•You will get a new dialog box with five options: 15 minutes, 1 hour, 5 hours, Until system restart, Permanently.

•Choose 5 hours.

ok i can not seem to fnd the norton 360 icon in my system tray or toolbar to disable it,i try to click on the 360 i
on the desktop an it just locks up at internet connection problem?

Please try to access Norton from Start, All Programs. You should be able to open the program from there.

ok i have tried both ways once again and i can not see the little icon on the bottom system tray/toolbar and when i tried to get into norton 360 i come up with a error 85 something ...something  . I tried to remove norton from computer but only way to do it was in safe mode.I then ran system lock and have atttached the log

dministrator - Elevation successful

========== filefind ==========

Searching for "svchost.exe "
C:\WINDOWS\$NtServicePackUninstall$\svchost.exe   -----c- 14336 bytes   [02:18 11/04/2009]   [12:00 04/08/2004] 8F078AE4ED187AAABC0A305146DE6716
C:\WINDOWS\ServicePackFiles\i386\svchost.exe   -----c- 14336 bytes   [05:32 05/09/2008]   [00:12 14/04/2008] 27C6D03BCDB8CFEB96B716F3D8BE3E18

-= EOF =-

[Malware Removal Specialist]

Go to Start > Run > type Notepad.exe and click OK to open Notepad.

Copy all of the text in the below Code box into Notepad.

Code: [Select]

@echo off
copy C:\WINDOWS\ServicePackFiles\i386\svchost.exe | c:\svchost.exe
exit
In Notepad go to File > Save as, choose to save it to your desktop and name it event.bat

Now double click the event.bat file you just created and let it finish.

Please FarBar Service Scanner again and post the log.(Reply # 21)

Here is the Farbar Scanner log

Running from "F:\"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking LEGACY_Dnscache: Attention! Unable to open LEGACY_Dnscache\0000 registry key. The key does not exist.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp: "%SystemRoot%\system32\dhcpsvc.dll".


Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returend error: Yahoo IP is unreachable

RpcSs Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to retrieve start type of RpcSs. The value does not exist.
The ImagePath of RpcSs: "%SystemRoot%\system32\svchost.exe -k rpcss".
The ServiceDll of RpcSs service is OK.
Checking LEGACY_RpcSs: Attention! Unable to open LEGACY_RpcSs\0000 registry key. The key does not exist.


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
Attention! C:\WINDOWS\system32\svchost.exe is missing.
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x0600000005000000030000000400000008000 0000600000007000000
IpSec Tag value is correct.

**** End of log ****

[Malware Removal Specialist]

You will need to download ComboFix to your desktop, install the Recovery Console and post the full log. There are things there that we need to fix before we can go any further.

Please download SystemLook from one of the links below and save it to your desktop.

Link # 1
Link # 2

Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double-click SystemLook.exe to run it.

Copy the contents of the following codebox into the main textfield.

Code: [Select]

:filefind
explorer.exe
winlogon.exe
i8042prt.sys 
Click the Look button to start the scan.

Note: The scan may take some time so please just let it do its work and be patient (or do something else unrelated to the computer).

When finished, a notepad window will open with the results of the scan. Please post the log. The log can also be found on your desktop entitled SystemLook.txt