Author Topic: internet connection problem?...could it be due to a virus or something? (Read 18548 times)

kaigan · « **on:** August 20, 2008, 09:28:41 AM »

I was suggested to go to the malware removal guide and then post here when i posted a topic in the Networking section...(topic link is http://www.computerhope.com/forum/index.php/topic,64032.0.html) so i have now finished doing everything suggested in the guide and i have included all the logs here.

[Note: When the SUPER antispyware scan had finished, i selected all files(that is bearshare) to quarantine, and it said it had to restart the computer so i clicked yes... but when it was shutting down it didnt actually shut down by itself....it kept on saying windows is shutting down for quite a longer time than usual so i manually shut it down by pressing the power button. Is that okay? I did another full system scan after that and the results of that scan (the second scan) are attached.]

EDIT

After doing all the scans and posting them here, out of curiousity i just switched on WLAN on the laptop and checked if i could connect to the internet using internet explorer 7 and it seemed to be working fine now!...but i still dont mind doing what is recommended or adviced by the malware removal specialists if it will make things better.

[recovering disk space -- attachment deleted by admin]

evilfantasy · « **Reply #1 on:** August 20, 2008, 11:07:55 AM »

Bear share is known to contain malware. We don't condone using these type of P2P clients but if you do use one then it is suggested to pick another. Clean/Infected P2P Programs. Note Just because the software is clean it does not mean what you download with it is!

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Download the Norton Removal Tool (SymNRT) to your Desktop.

Once downloaded please close ALL open browsers, also save any work because this may require a restart.

Go to your desktop and double click on the removal tool and then click Setup.
Once open Click Next
Accept the license agreement and click Next
Type in the letters/numbers that you see into the text box then click Next.
Then click Next and the tool will start running.
Once finished restart the PC and run the tool again to ensure everything has been removed.

.
----------

How is everything now?

kaigan · « **Reply #2 on:** August 20, 2008, 12:03:24 PM »

Well...the internet seem to be connected and working fine as well.

But since the problem had started a few days ago, the computer seemed to be getting stuck or crashing on startup (on the welcome screen) or some random places...but after the scans and whatever we have done so far it has got better although it still comes sometimes... any ideas on what could be causing this problem or how to fix it?

thanks for helping so far!...

EDIT!!!
when i checked just right now the problem seemed to have come back...i think its got to do with the getting stuck or crashing bit..after i ran the norton tool once it got stuck when it restarted and also when i tried to boot again..on the third time it seemed ok...also when i ran the tool the second time it got stuck starting up once but was ok the second timw...but the main thing is that the connection is same like before (says its connected but cant connect) as soon as it had been fixed!

evilfantasy · « **Reply #3 on:** August 20, 2008, 12:06:34 PM »

Do you have an XP CD?

If so, place it in your CD ROM drive and follow the instructions below:

Click on Start > Run and type sfc /scannow then press Enter (note the space between scf and /scannow)
- Let this run undisturbed until the window with the blue progress bar goes away

SFC - Which stands for System File Checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.

If you want to see what was replaced, right-click My Computer and click on Manage.
In the new window that appears, expand the Event Viewer (by clicking on the + symbol next to it) and then click on System.

kaigan · « **Reply #4 on:** August 20, 2008, 12:12:31 PM »

no i dont have an xp cd (packard bell does not give extra cd's as it gives a software pre-loaded which formats the hard drive and keeps only the operating system and the stuff that came with it...)..but is it okay if i can use any other xp cd..(i think we have one which came with my dad comp)...

Edit:

I just checked and found out that the recovery cd that came with my dads comp (which is a toshiba) only works for toshiba laptops...so i dont think i have any xp cd's...

kaigan · « **Reply #5 on:** August 20, 2008, 01:02:53 PM »

here is a little detialed explanation of the startup crashes....

On the first startup or restart it loads the windows xp logo and loading part and only uptil the blue screen saying "Windows is starting up..." and then it gets stuck there...
On second attempt after the windows xp logo and loading part, the screen turns black and there is only the arrow in the middle of the screen but it does not show the welcome screen...
On third try i think it works ok as i can log on properly...

After that the internet just says its connected but cant open any websites. i think its because of some virus or something... can u please help me with this?

thanks.....

evilfantasy · « **Reply #6 on:** August 20, 2008, 01:05:49 PM »

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

Open the folder and run Dial-a-fix.exe
2 windows will open. Close the one in the background labeled Restrictive Policies
On the main window, check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked
Check all boxes in Section 5, labeled Registration Center.
Click Go
OK any error messages if received, but write them down and post them here.
Restart the computer when done

Let me know if IE behaves properly.

kaigan · « **Reply #7 on:** August 20, 2008, 01:28:50 PM »

ok...when i ran the tool "restrictive policies" does not open but the main thing does...the fix goes properly and even the restart...then i click on internet explorer only the defaulf home page loads for once...then if i type any other website it displays the same old "the page cannot be displayed" message...it looks as if everything is fixed but its actualy not.....

evilfantasy · « **Reply #8 on:** August 20, 2008, 01:34:18 PM »

Open Dial-a-fix and click the hammer icon. Select Flush DNS and click Go
When complete, select Repair Permissions and click Go
When complete, select Repair/reinstall IE and click Go

Reboot when complete and let me know if there's any change.

----------

You may need to try this also if the Dial a fix step doesn't work.

Download to your desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.

kaigan · « **Reply #9 on:** August 20, 2008, 01:53:44 PM »

umm...here is what happened so far...
Avast antivirus denied access to change some registry entries during "repair permissions" and During IE reinstall there was a "Error in iesetup.dll - Missing entry: IEAccessSysInst" and then after that it just shows that it is reinstalling ie but the system doesn't seem to be doing anything...

[p.s. - i actually have to go now...it is late night here...so its ok if i cancel the thing..right..? i will be back tommorow...sorry for the stop and thanks for helping so far!]

kaigan · « **Reply #10 on:** August 21, 2008, 01:05:19 AM »

ok...today when i started the computer it got stuck (black screen with only arrow), then the second time it also got stuck...the third time it came ok...but i could only see my account! the other one and the guest account was gone!! this is the first time ever something like this has happened to me...the other two accounts for the comp had totally been deleted or vanished...and i know i had not done it...do u think all that which has happened so far could be the work of a hacker or someone or something??...also when i did whatever you told me to in your last post, and i restarted the comp(which was successful on the first time) there seemed to be nothing changed in the internet connecting bit...when i started internet explorer(which was the older version) the same error message came...(same with mozilla firefox)...please help!

$:-\$

thanks........

evilfantasy · « **Reply #11 on:** August 21, 2008, 01:35:03 PM »

I am beginning to think that your hard drive is going out. Do you have the means (money) to take it to a shop so they can properly diagnose the problem and get your PC running again?

kaigan · « **Reply #12 on:** August 21, 2008, 07:57:52 PM »

Hmm...I dont know if it could be a hardware problem but i'll see about that....but i think that there is some sort of DNS virus or spyware which does not allow the computer from going on the internet...(the first avast scan which i did found a dns trojan in the system32 folder...and it deleted it) so i think we should run all the scans again which may solve the problem temporarily. Also i have noticed one thing that when i open internet explorer, it says its "waiting for reply..." and then it says "connecting to website..." and then it says "redirecting to ___" where ___ is the address of the DNSERROR.htm page on the computer. so does that mean something? well anyway i'm gonna to do the scans now and tell you if anyting's better...

thanks again.

evilfantasy · « **Reply #13 on:** August 21, 2008, 08:17:53 PM »

When hardware starts going bad weird things can happen.

Download to your desktop ISeeYouXP.exe by ShadowPuterDude
Next double-click on ISeeYouXP.exe on your Desktop.

ISeeYouXP.exe will self-extract ISeeYouXP to C:\ISeeYouXP and place a .bat file on your Desktop.

Double-click ISeeYouXP.bat to run the script.

Once complete a log will be saved to the Desktop named ISeeYouXP.txt.

Upload the file to Savefile.com
There is no need to Register
Select Browse and locate the file.
Fill in the Title and Description and security code then click Upload
Copy the download link next to Your link to the file: and post the link back here.

If the ISeeYouXP .bat file does not extract to the Desktop. Double-click My Computer on the Desktop and navigate to the ISeeYouXP folder located in the C: drive. Double-click the ISeeYouXP.bat file to run the program.

kaigan · « **Reply #14 on:** August 21, 2008, 08:38:29 PM »

Actually i am doing a boot scan with Avast antivirus right now....umm...is it okay if i finish all the scans and then do the Iseeyouxp thing? or is it neccasary to do what you have told right now?

evilfantasy · « **Reply #15 on:** August 21, 2008, 08:46:01 PM »

Take your time. I'm skeptical it is a virus but well know for sure after the next log.

kaigan · « **Reply #16 on:** August 21, 2008, 09:39:26 PM »

well i cancelled the boot scan and did the thing you told me and here is the log. hope this helps!

[recovering disk space -- attachment deleted by admin]

evilfantasy · « **Reply #17 on:** August 21, 2008, 10:12:48 PM »

Don't know what else to say. I don't believe this is a malware problem.

Delete the following from your Desktop (If they exist)
ISeeYouXP.exe
ISeeYouXP.txt
ISeeYouXP.lnk (Shortcut for ISeeYouXP.bat)

----------

Does this behavior persist if you start IE7 in No Add-ons mode?

IE7 in No Add-ons mode

Troubleshooting and Internet Explorer’s (No Add-ons) Mode:
http://blogs.msdn.com/ie/archive/2006/07/25/678113.aspx

RIES
Does the problem persist if you Reset IE7 Settings (RIES)?
http://support.microsoft.com/kb/923737 <- Read before using!

kaigan · « **Reply #18 on:** August 21, 2008, 10:29:55 PM »

no, internet explorer cant connect in no-addon mode as well as normal mode. but after all that we have done mozilla firefox can connect to the internet and display websites. Maybe internet explorer is not properly configured or installed...do you know how to completely remove internet explorer and then i could re-install it? maybe that would solve the problem? also most of the programs cant connect to get updates so is there any way to reset internet settings or firewall settings to allow access to connect to the internet or something? and do you think reformatting the computer using the recovery software that packard bell gives on the computer could help to resolve this problem?

evilfantasy · « **Reply #19 on:** August 21, 2008, 10:33:40 PM »

A recovery would likely fix it.

Try turning off the firewall and see if IE connects.

To re-install IE 7

First go here to Download IE 7 to the desktop. (Don't install it yet)

Uninstall the version of IE you have installed now, to do so follow these steps:
Click Start
Click Control Panel
Double click Add or Remove Programs
Scroll down until you find Internet Explore
Then click Change/Remove, and follow the prompts.

Note: If you are unable to see IE7 in Add or Remove Programs follow these steps:

Click Start
Click Run
Type or copy and paste, into the text box:

%windir%\ie7\spuninst\spuninst.exe

Then Press Enter
Restart your computer.
- Install the fresh version of Internet Explorer 7.

[/list]

kaigan · « **Reply #20 on:** August 21, 2008, 10:40:13 PM »

ok i turned the firewall off and tried internet explorer and now it can connect ok. but the internet explorer in version 6 so i will also do the uninstall and reinstall now...i'll tell you what happens then.

thanks for helping so far!

evilfantasy · « **Reply #21 on:** August 21, 2008, 10:42:02 PM »

What firewall are you using? Windows?

kaigan · « **Reply #22 on:** August 21, 2008, 11:00:33 PM »

for now, yes i am using the windows firewall. i had the norton 360 firewall but i uninstalled the program. umm..do u have suggestions for better protection softwares?

evilfantasy · « **Reply #23 on:** August 21, 2008, 11:03:56 PM »

Run this again to be sure Norton is gone. Windows firewall shouldn't be blocking you and it would seem that Norton is still hanging around.

Download the Norton Removal Tool (SymNRT) to your Desktop.

Once downloaded please close ALL open browsers, also save any work because this may require a restart.

Go to your desktop and double click on the removal tool and then click Setup.
Once open Click Next
Accept the license agreement and click Next
Type in the letters/numbers that you see into the text box then click Next.
Then click Next and the tool will start running.
Once finished restart the PC and run the tool again to ensure everything has been removed.

.
----------

For a good free firewall listed below. I have used (and like) Online Armor, Comodo and PC Tools.

I've heard that Online Armor is very good at the moment.

1) Comodo (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" if you choose this one)
2) Online Armor
3) Sunbelt/Kerio
4) Agnitum
5) PC Tools Firewall Plus

kaigan · « **Reply #24 on:** August 21, 2008, 11:16:54 PM »

well i uninstalled IE7 and then restarted and installed it again but after restarting after that the problem has come Back! Even mozilla cant connect now! and also when it was installing it said it could not update windows internet explorr and told to restart the computer and then open IE7 and go tools>windows update. but i cant connect to them! i dont know whats happening...once it connects and then next it doesn't!...

evilfantasy · « **Reply #25 on:** August 21, 2008, 11:21:19 PM »

Click Start > Run and copy and paste the following line into the run box:
regsvr32 urlmon.dll
Press OK
Once it is completed you will get this message DllRegisterServer in urlmon.dll succeeded, repeat the above steps, but replace regsvr32 urlmon.dll with the following: (enter each line one at a time selecting OK after each)

regsvr32 actxprxy.dll
regsvr32 shdocvw.dll
regsvr32 mshtml.dll
regsvr32 browseui.dll
regsvr32 jscript.dll
regsvr32 vbscript.dll
regsvr32 oleaut32.dll

When finished restart your computer.

kaigan · « **Reply #26 on:** August 21, 2008, 11:45:08 PM »

i did all of the run commands you gave but only mshtml.dll gave an error of some sort (which i forgot)...and when i restarted and checked it seemed to be working only it got stuck while loading and i have restarted the computer now...ok on the second try it only loads a few pages (google, computerhope and msn) and then both mozilla and ie stop loading pages...this is weird.

evilfantasy · « **Reply #27 on:** August 21, 2008, 11:46:27 PM »

Have you tried resetting the router? Unplug it for about 10 seconds then plug it back in.

kaigan · « **Reply #28 on:** August 21, 2008, 11:55:14 PM »

i did that and it's still the same.

evilfantasy · « **Reply #29 on:** August 21, 2008, 11:56:59 PM »

I'm running out of ideas.

kaigan · « **Reply #30 on:** August 22, 2008, 12:01:28 AM »

this is new for me as well....this is one of the biggest problems i have faced! umm...i still think that we should try and do the scans again...because it was working that time but i guess maybe it will turn out to be just a few websites which will work...but still.

evilfantasy · « **Reply #31 on:** August 22, 2008, 12:02:03 AM »

Try running this.

WinSock XP Fix http://majorgeeks.com/download4372.html

kaigan · « **Reply #32 on:** August 22, 2008, 12:04:46 AM »

i have ran the winsock fix tool before...(one of the first things i did to try fix this...) but i'll still try again.

evilfantasy · « **Reply #33 on:** August 22, 2008, 12:14:40 AM »

I'm really out of clues. One more thing is cleaning everything really good including the Prefetch and Cache. Don't use this cleaner on a regular basis.

Download ATF Cleaner by Atribune to your Desktop.

Alternate download link

Note: Vista users must use Run As Administrator

Under Main: Select Files to Delete choose: Select All.
Click the Empty Selected button.
If you use Firefox browser click Firefox at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
If you use Opera browser click Opera at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords click No at the prompt.
Click Exit on the Main menu to close the program.

Note that your system will run slower for a reboot or two after having used this tool so don't panic.

Important: Restart the computer before continuing.

----------

Download and install CleanUp!.exe

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click Options...
Move the arrow to Standard CleanUp!
Uncheck the following: (if checked)
- Delete Newsgroup cache
- Delete Newsgroup Subscriptions
Click OK

Click the CleanUp! button to start the program. Reboot/logoff when prompted.

kaigan · « **Reply #34 on:** August 22, 2008, 12:27:10 AM »

well i ran winsock fix but no prevail. then after i finished running ATF cleaner it took ages to shutdown so i manually shut it down and started the computer again....and the computer does feel a little slower...well i think its quite late the place where you are so why dont you get some sleep now, i will finish doing the other thing and tell you later. For now, Good night!

evilfantasy · « **Reply #35 on:** August 22, 2008, 12:56:15 AM »

I'm out of ideas. Maybe try making a post in the Windows forum so more people will see it. Not many will be willing to read through 3 pages here to try and help now.

kaigan · « **Reply #36 on:** August 22, 2008, 01:02:41 AM »

Ok. Thanks for helping anyway. But what other things are there to do?

Anyway, see you later and once again thanks for trying to help me!

evilfantasy · « **Reply #37 on:** August 22, 2008, 01:03:25 AM »

I don't know but someone new will surely have some fresh ideas.

kaigan · « **Reply #38 on:** August 22, 2008, 01:05:59 AM »

Ok i will post a new topic in the windows forum with shortened details and links to this and my original topic with Carbon Dudeoxide. Thanks.

evilfantasy · « **Reply #39 on:** August 22, 2008, 01:07:30 AM »

No problem and good luck. I hate sending you off without positive results but I have suggested everything I can think of.

Carbon Dudeoxide · « **Reply #40 on:** August 22, 2008, 01:09:22 AM »

From Me to the Malware Specialists and back to the Windows Forum. Yikes!

kaigan · « **Reply #41 on:** August 22, 2008, 01:11:33 AM »

I know...thanks to both of you anyway!

evilfantasy · « **Reply #42 on:** August 22, 2008, 01:13:10 AM »

A real puzzler!!!

kaigan · « **Reply #43 on:** August 22, 2008, 02:00:11 AM »

i have now posted a new topic in the windows forum relating to this...the link is http://www.computerhope.com/forum/index.php/topic,64348.0.html
just wanted to inform you two about that.

The following is copied from that post. Hope it helps in fixing this.
UPDATE:
As i was posting this i felt like checking again so i did....as for now internet explorer 7 and mozilla firefox still cant open any webpages. In safe mode or no-addon mode internet explorer cant open any site, BUT when i checked with mozilla firefox (safe mode) it COULD connect and open websites. Hope this will help...

Computer Hope Forum

News:

Author Topic: internet connection problem?...could it be due to a virus or something? (Read 18548 times)

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

kaigan

evilfantasy

Carbon Dudeoxide

kaigan

evilfantasy

kaigan