Computer acting weird and no Internet Access

[SuperDave]

Please give me an update about your computer?

[mecka]

No Internet access ,system appears to reacting quicker.Did you find something on my system and how does it appear to you from thr logs provided.

[SuperDave]

Did you find something on my system and how does it appear to you from thr logs provided.

As you can see from the logs there were some infections. Let's work on the internet access.

Please download MiniToolBox to Desktop and run it.



Checkmark the following boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• List content of Hosts
• List IP Configuration
• Lst Last 10 Event Viewer Errors
• List Users, Partitions and Memory Size
[/b]

Click Go and copy/paste the log (Result.txt) into your next post.

[mecka]

OK thanks,here is the MiniToolbox Log

MiniToolBox by Farbar  Version: 18-01-2012
Ran by Keith  Cochrane (administrator) on 29-03-2012 at 23:40:59
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Could not flush the DNS Resolver Cache: Function failed during execution.




========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================
::1       localhost

127.0.0.1       localhost

========================= IP Configuration: ================================


WARNING: Could not obtain host information from machine: [KEITHS]. Some commands may not be available.
The RPC server is unavailable.



# ----------------------------------
# Interface IP Configuration         
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



        Host Name . . . . . . . . . . . . : keiths

        Primary Dns Suffix  . . . . . . . :

        Node Type . . . . . . . . . . . . : Broadcast

        IP Routing Enabled. . . . . . . . : No

        WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection:



        Connection-specific DNS Suffix  . :

        Description . . . . . . . . . . . : 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)

        Physical Address. . . . . . . . . : 00-B0-D0-18-01-50

        Dhcp Enabled. . . . . . . . . . . : Yes

        Autoconfiguration Enabled . . . . : Yes

        IP Address. . . . . . . . . . . . : 0.0.0.0

        Subnet Mask . . . . . . . . . . . : 0.0.0.0

        Default Gateway . . . . . . . . . :

        DHCP Server . . . . . . . . . . . : 255.255.255.255

Server:  UnKnown
Address:  127.0.0.1

Ping request could not find host google.com. Please check the name and try again.

Server:  UnKnown
Address:  127.0.0.1

Ping request could not find host yahoo.com. Please check the name and try again.

Server:  UnKnown
Address:  127.0.0.1

Ping request could not find host bleepingcomputer.com. Please check the name and try again.



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 b0 d0 18 01 50 ...... 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1     1
  255.255.255.255  255.255.255.255  255.255.255.255               2     1
===========================================================================
Persistent Routes:
  None

========================= Event log errors: ===============================

Application errors:
==================
Error: (03/26/2012 09:29:52 PM) (Source: Application Error) (User: )
Description: Faulting application hpqanon.exe, version 2.0.0.138, faulting module hpqswiz.dll, version 2.0.0.138, fault address 0x0000b340.
Processing media-specific event for [hpqanon.exe!ws!]

Error: (03/24/2012 01:01:55 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 01:01:24 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 01:01:08 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 00:59:22 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 00:56:34 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 00:55:53 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 00:54:39 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (03/24/2012 00:54:12 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.

Error: (02/26/2012 08:51:42 PM) (Source: .NET Runtime 2.0 Error Reporting) (User: )
Description: EventType clr20r3, P1 wdsmartware.exe, P2 1.1.1.6, P3 4ad642c6, P4 tanagra.dataclad, P5 2.0.0.1, P6 4a8c3c56, P7 4f2, P8 2e, P9 clr20r30, P10 clr20r31.


System errors:
=============
Error: (01/27/2012 09:25:19 PM) (Source: Service Control Manager) (User: )
Description: The WMI Performance Adapter service failed to start due to the following error:
%%1053

Error: (01/27/2012 09:25:19 PM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 milliseconds) waiting for the WMI Performance Adapter service to connect.

Error: (01/26/2012 10:51:59 PM) (Source: 0) (User: )
Description: 0.0.0.0:2869

Error: (01/26/2012 10:51:59 PM) (Source: 0) (User: )
Description: 0.0.0.0:2869

Error: (01/26/2012 07:53:39 AM) (Source: Service Control Manager) (User: )
Description: The IMAPI CD-Burning COM Service service failed to start due to the following error:
%%1053

Error: (01/26/2012 07:53:39 AM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

Error: (01/26/2012 02:51:29 AM) (Source: Service Control Manager) (User: )
Description: The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the DCOM Server Process Launcher service, but this action failed with the following error:
%%1726

Error: (01/26/2012 02:49:59 AM) (Source: Service Control Manager) (User: )
Description: The Terminal Services service terminated unexpectedly.  It has done this 1 time(s).

Error: (01/26/2012 02:49:59 AM) (Source: Service Control Manager) (User: )
Description: The DCOM Server Process Launcher service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

Error: (01/24/2012 10:46:36 AM) (Source: SideBySide) (User: )
Description: Generate Activation Context failed for C:\WINDOWS\system32\browseui.dll.
Reference error message: The operation completed successfully.
.


Microsoft Office Sessions:
=========================
Error: (03/26/2012 09:29:52 PM) (Source: Application Error)(User: )
Description: hpqanon.exe2.0.0.138hpqswiz.dll2.0.0.13 80000b340

Error: (03/24/2012 01:01:55 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 01:01:24 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 01:01:08 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 00:59:22 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 00:56:34 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 00:55:53 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 00:54:39 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (03/24/2012 00:54:12 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL

Error: (02/26/2012 08:51:42 PM) (Source: .NET Runtime 2.0 Error Reporting)(User: )
Description: clr20r3wdsmartware.exe1.1.1.64ad642c6ta nagra.dataclad2.0.0.14a8c3c564f22epjayx 3agobqlpv3dblszxe2utv3bxvztNIL


========================= Memory info: ===================================

Percentage of memory in use: 36%
Total physical RAM: 511.07 MB
Available physical RAM: 324.95 MB
Total Pagefile: 1250.18 MB
Available Pagefile: 919.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1993.84 MB

========================= Partitions: =====================================

2 Drive c: () (Fixed) (Total:149.04 GB) (Free:58.44 GB) NTFS
5 Drive g: (Lexar) (Removable) (Total:14.9 GB) (Free:14.9 GB) FAT32

========================= Users: ========================================

User accounts for \\

Administrator            Guest                    HelpAssistant           
           
SUPPORT_388945a0         


**** End of log ****

[SuperDave]

Is this a wireless connection to the mode? If it is, did you try hardwiring the computer to the modem? Did you reset the modem? Disconnect the power supply for at least 30 secs.

Please download Farbar Service Scanner and run it on the computer with the issue.

• Press "Scan".
  
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

[mecka]

The computer is hard wired to the internet,but since the issues with the virus i have lost connection to the internet.

[mecka]

Here is the FSS lOG

Farbar Service Scanner Version: 01-03-2012
Ran by Keith  Cochrane (administrator) on 06-04-2012 at 13:40:49
Running from "G:\"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open Dnscache registry key. The service key does not exist.
Checking LEGACY_Dnscache: Attention! Unable to open LEGACY_Dnscache\0000 registry key. The key does not exist.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp: "%SystemRoot%\system32\dhcpsvc.dll".


Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returend error: Yahoo IP is unreachable

RpcSs Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to retrieve start type of RpcSs. The value does not exist.
The ImagePath of RpcSs: "%SystemRoot%\system32\svchost.exe -k rpcss".
The ServiceDll of RpcSs service is OK.
Checking LEGACY_RpcSs: Attention! Unable to open LEGACY_RpcSs\0000 registry key. The key does not exist.


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit

[SuperDave]

DNS Client Service

• Go to Start and click on Run.
  
• Type Services.msc in the Run command box.
  
• A window listing all the services will popup. Search for a service called DNS Client.
  
• Double click on the listed DNS Client service and click Stop. Similarly, you can restart it by clicking Start.
  

Please let me know if there's any change. If not, please run FSS again and post the log.

[mecka]

Ok i ran the Service.msc and i could not find the DNC client.On the bottom of the pprogam it has extended which had o listed but when i clicked on standard it listed about 69 services none osf the one we are looking for.

Just to add when i try to launch Internet Explorer nothing happens but when i try to load Outlook Express i get the following meassage.

he host 'pop3.live.com' could not be found. Please verify that you have entered the server name correctly. Account: 'pop.mts.net', Server: 'pop3.live.com', Protocol: POP3, Port: 995, Secure(SSL): Yes, Socket Error: 11001, Error Number: 0x800CCC0D


Thanks Keith

[SuperDave]

Just to add when i try to launch Internet Explorer nothing happens

Do you get the "page cannot be displayed" message?
Let's try a couple of things.

Let's try to uninstall/reinstall TCP/IP stack.

1. Download winsock.zip
Unzip it.
Right click on Winsock.reg, click "Merge".
Allow registry merge.

2. Restart computer.

3. Go to Start ==> Control Panel.  Double-click Network Connections. Right-click Local Area Connection, and select Properties.

• On the General tab, click Install a popup window opens.
  
• Select Protocol from the list and then click Add.
  
• A new window opens, click Have Disk....
  
• In the browse... box type c:\windows\inf
  
• Click OK.
• Select Internet Protocol (TCP/IP), and then click OK.
  
• Restart and check the connection.

************************************************
Please download RenewMyDNS by DragonMaster Jay.

•Save it to your Desktop.
•Right-click on the file and select Extract All...
•Choose a location to save extracted files and keep pressing Next until Finished.
•Double-click RenewMyDNS folder, then double-click RenewMyDNS.bat to start the program.
•Follow the prompts, and when finished it will launch a log.
•Post that log in your next reply.
•After posting the log, delete the folder RenewMyDNS.

[mecka]

Do you get the "page cannot be displayed" message?
Let's try a couple of things.

When i click on the Internet Explorer the hourglass appears and disappears quickly after and nothing happens.

When i go to Internet Connections,it looks like i am missing my old connections .I also do not have LOCAL AREA CONNECTION.


So i was unable to complete the 3rd step.


Thanks

[SuperDave]

Please download them on another computer and transfer them using a CD-RW or a USB memory stick.

[mecka]

I did download both winsock and renewmydns to my memory stick thats not the problem ,when i go into my Network connections i do not have the Local Connections.

[SuperDave]

when i go into my Network connections i do not have the Local Connections.

I'm not sure why you need Local Connections. When you insert your USB memory device can you see it? If you can, copy them to your computer and run them.

[mecka]

Ok sorry i am miss understanding your instructions,i can download to to memory stick all programs ,and i can complete  numbers 2 and 3 but  when i am trying to follow your instructions on#3 this is where i can't because i do not have Local Area Connections in my Network connections its missing,therefore unable to complete #3 as per your instructions.
 


Keith







Let's try to uninstall/reinstall TCP/IP stack.

1. Download winsock.zip
Unzip it.
Right click on Winsock.reg, click "Merge".
Allow registry merge.

2. Restart computer.

3. Go to Start ==> Control Panel.  Double-click Network Connections. Right-click Local Area Connection, and select Properties.
•On the General tab, click Install a popup window opens.

•Select Protocol from the list and then click Add.

•A new window opens, click Have Disk....

•In the browse... box type c:\windows\inf

•Click OK.
•Select Internet Protocol (TCP/IP), and then click OK.

•Restart and check the connection.
************************************************
Please download RenewMyDNS by DragonMaster Jay.

•Save it to your Desktop.
•Right-click on the file and select Extract All...
•Choose a location to save extracted files and keep pressing Next until Finished.
•Double-click RenewMyDNS folder, then double-click RenewMyDNS.bat to start the program.
•Follow the prompts, and when finished it will launch a log.
•Post that log in your next reply.
•After posting the log, delete the folder RenewMyDNS.