Author Topic: Cannot get access to the internet (Read 121942 times)

Boggin · « **Reply #25 on:** September 04, 2014, 04:56:14 pm »

Article on the Virtual WiFi Mini Port Adapter, but you can disable it if you aren't going to use it as it can sometimes cause connectivity problems, but never has done for me. http://helpdeskgeek.com/windows-7/what-is-microsoft-virtual-wifi-miniport-adapter/

You just enter tracert at the command prompt instead of ping and it lists the Hops it would take to resolve the address - give it a try with www.google.com - it takes 11 hops for me from the UK to resolve with a ping of 30ms but as you are much closer it won't take so many.

There's one other thing that you can try and that is to right click on either the LAN and/or Wireless adapters in Network and Sharing Center/Change adapter settings (depending upon what you have enabled) and select Properties then uncheck the box for TCP/IPv6 - OK - Close then reboot.

Is what you posted about Server what was in Event Viewer or when you clicked on it in services ?

rhuffman · « **Reply #26 on:** September 04, 2014, 06:36:49 pm »

It was in services, what would i look for in event viewer? Took me 10 hops ranging from a low of -1 to a high of 43 ms. Turning off TCP/IPv6 had no effect.

jraju · « **Reply #27 on:** September 05, 2014, 02:21:22 am »

Hi, Rhuff Please see this link
From
http://wiki.bitcomet.com/add_port_mapping_in_nat_router, where your problem have been analysed and workarounds are given. It specifically dealt with half internet connectivity.

Boggin · « **Reply #28 on:** September 05, 2014, 03:40:48 am »

In Event Viewer when it has read the logs, you will have listings for Critical, Error and Warnings etc.

Click on Error then on View All Instances of These Events in the right pane.

Clicking on each that are listed will produce a brief description in the lower window - check to see if any relate to connectivity and let us know what they are together with the Event ID No. if any.

On the affected computer open a command prompt and enter ipconfig /all then right click in the text area and click on Select all then press enter.

Open Notepad or Wordpad and paste the output into there and Save_as then copy that across to your working computer and copy & paste into the reply box.

Can you also run the ipconfig /all command on your working computer and note that the preferred IP address for whichever adapter you are using for the Internet on that one is not the same as either of the Wireless or Ethernet of the affected one.

If you are getting a DHCP address assigned on the affected computer, then you can try assigning the affected computer with a static IP address for it either in the router or in the computer's TCP/IPv4 Properties - but we'll need to see the output of the ipconfig /all first.

As you are able to ping 8.8.8.8 then you could try using that DNS address in the computer's TCP/IPv4 Properties.

Check the radio button for Use the following DNS server addresses and enter an 8 into each of the boxes in the top row and then 8.8.4.4 into the lower row - check the box for Validate settings upon exit - OK - Close and that should activate the Troubleshooter - let us know if that reports anything other than couldn't find a problem and then reboot.

Can you also check back with your ISP to see if they can still detect Citadel from your IP address.

Shane · « **Reply #29 on:** September 05, 2014, 12:46:00 pm »

The part that makes this confusing is the fact that the pings work, and even have really good response times.

Cant remember if you tried this yet or not, but download the newest version of my Windows Repair tool, make sure to do a clean boot and then run all of the repairs.

Also download teamviewer from another computer and put it on yours and see if it is able to get an id and password. If it is able to get online I could connect to you and take a look as well. Mainly because I am freaking curious how pings work nice and fast yet nothing else does lol

Shane

Boggin · « **Reply #30 on:** September 05, 2014, 01:29:01 pm »

That is the puzzler

I'd like to see the info I've requested but also wondering if creating a Kaspersky Rescue Disk on the working machine and letting it have a look at the files. http://support.kaspersky.co.uk/4162

It may be able to get an Internet connection to update itself when you wire up but it should have sufficient in its armoury to scan for any infection.

Not sure if you could boot up the working machine with it and let it update itself on that and then boot up the affected machine with it, but once you start the Scan C: you are stuck with it until completion and that scan took a little over 9hrs on this laptop and then initiated a chkdsk /f.

If you've gotten rid of Citadel somehow but it has left some files damaged, then this ESET Tool could repair/replace those http://www.trishtech.com/2013/11/restore-missing-services-after-malware-infection/

Edit
After a bit more brain storming, here's a couple of more things to check -

Go into services.msc and check that Base Filtering Engine is showing as Started and Automatic (this is one of the services that ESET repairs)

Also check that IP Helper is showing as Started and Automatic - also that IPsec Policy Agent is Started and Manual.

I think I once came across where .NET Framework was causing a problem so download/Save the repair tool and copy it across to the affected machine where it can then be executed http://www.microsoft.com/en-gb/download/details.aspx?id=30135

rhuffman · « **Reply #31 on:** September 05, 2014, 11:40:01 pm »

Here are the ipconfigs.

rhuffman · « **Reply #32 on:** September 05, 2014, 11:47:28 pm »

Ipsec Policy Agent is not started, turning it on now. (Nothing happens no connection)

rhuffman · « **Reply #33 on:** September 06, 2014, 12:08:53 am »

Did the ip thing 8.8.8.8 and 8.8.4.4 no errors / problems found

Boggin · « **Reply #34 on:** September 06, 2014, 07:08:42 am »

I forgot to ask if you could also run the command route print and post the output of that as well.

Looking at the ipconfig /all of the good computer, it looks as if that has had connectivity problems as well, as Windows creates a MS ISATAP adapter whenever it has problems getting an Internet connection - which is why there are quite a few duplicated ISATAP adapters.

At your leisure on the good machine, go Device Manager/View/Show hidden devices/Network adapters then right click on all but the original ISATAP and select Uninstall.

There won't be much point in doing that on the affected computer yet, but I noticed there weren't as many duplicated ISATAP adapters on that one as there were on the good one - which could either mean that Windows was able to connect or that function was no longer working ??

Were you able to run the ESET and/or the .NET Framework Repair Tools and have you contacted your ISP yet to see if you are still broadcasting Citadel.

As a DHCP IP address has been assigned to the Network adapters and that you can't still connect in Safe Mode with Networking, would suggest a firewall and the only firewall still active in that mode is Windows Firewall.

Depending upon the results of ESET, .NET and your ISP, you may be able to play around with the firewall settings, but I'll leave Shane to advise on those. http://www.howtogeek.com/112564/how-to-create-advanced-firewall-rules-in-the-windows-firewall/

Probably best to create a restore point first should Shane wish to eliminate the firewall as the cause.

I don't think at this point it is worth assigning a static IP address, but MAC Filtering in the router for the affected computer could be something worth looking at where you add its MAC address to the filter, which is sometimes a requirement for Internet connectivity but being able to ping Google throws a lot of diagnostics out of the window.

This program has had some success if none of the above have restored connectivity - thing is, it doesn't tell you what it has fixed when it has and we would still be in the dark http://www.majorgeeks.com/files/details/complete_internet_repair.html

jraju · « **Reply #35 on:** September 07, 2014, 04:09:23 am »

Hi, Shane ,
Did you see my link?. Bitcomet downloader explains you will only receive half of the internet functions.
If you are connected to the Internet through a wireless modem (usually a USB stick) which uses mobile phone wireless telecommunications technology (such as GPRS, EDGE, EVDO, HSPA, UMTS, etc.) most likely your Internet connection will be firewalled at the ISP site by default (so you basically get only half of an Internet connection, without the possibility of successful incoming connections). Short of contacting your ISP to ask if there is a possibility to get full Internet connections on the same device or changing your Internet subscription plan for one that has incoming connections unfirewalled by default (all xDSL, cable or FiOS providers usually offer unfirewalled connections), there is nothing you can do on your side to unblock incoming connections, therefore there is no point in following this guide or any other port-forwarding guide, for that matter, because you will still have incoming connections blocked on all your ports!

Shane · « **Reply #36 on:** September 08, 2014, 02:15:39 pm »

Quote

Hi, Shane ,
Did you see my link?. Bitcomet downloader explains you will only receive half of the internet functions.
If you are connected to the Internet through a wireless modem (usually a USB stick) which uses mobile phone wireless telecommunications technology (such as GPRS, EDGE, EVDO, HSPA, UMTS, etc.) most likely your Internet connection will be firewalled at the ISP site by default (so you basically get only half of an Internet connection, without the possibility of successful incoming connections). Short of contacting your ISP to ask if there is a possibility to get full Internet connections on the same device or changing your Internet subscription plan for one that has incoming connections unfirewalled by default (all xDSL, cable or FiOS providers usually offer unfirewalled connections), there is nothing you can do on your side to unblock incoming connections, therefore there is no point in following this guide or any other port-forwarding guide, for that matter, because you will still have incoming connections blocked on all your ports!

This problem is with bitcomet though and has to do with his browsers.

rhuffman, did you download teamviewer on another system and put it on your troubled system and see if it is will get online? I want to see if I can connect to it and take a look

Shane

Boggin · « **Reply #37 on:** September 08, 2014, 03:34:15 pm »

I think rhuffman is just using bitcomet as an alternative means of connection as the original problem was that Citadel was being broadcast from his IP address on one computer.

jraju · « **Reply #38 on:** September 09, 2014, 04:02:43 am »

Hi, Boggin
Let me know what is the citadel virus. Ofcourse, the TO has said and some discussion on the previous posts. But would a virus could stop the internet connection? I also surfed the net to get some cure. But it seems to be a major attack on compromised system.
I thought that bit comet downloader is the culprit and by disabling or removing this would possibly get him the full connection.

jraju · « **Reply #39 on:** September 09, 2014, 05:06:45 am »

As an attempt try to scan to get rid of this
http://www.microsoft.com/security/scanner/en-us/sysreq.aspx
I hope that this fix it.
Update: please download in some other machine and then scan. I found that this thread has been fixed in the latest security scanner by Microsoft

Boggin · « **Reply #40 on:** September 09, 2014, 05:30:32 am »

I don't think Citadel is stopping connectivity as it requires that to spread its malevolence.

Subsequent anti malware scans have found no sign of that or any other infection and while his ISP could block his connectivity because of it, as other machines are working okay, I'm not sure if they could have blocked just this computer's MAC address - which is why rhuffman needs to contact his ISP to see if it's still broadcasting Citadel.

Because other machines can connect, then this would normally eliminate the router - and it's assigning a DHCP address anyway.

Without going back through the thread, I don't think we've tried running IE without add-ons yet, but as there's some sort of connection with bitcomet (although I'm not familiar with it) then it's not likely to be a malicious add-on

There's one thing that an infection can do and leave after it has been removed and that is to corrupt the Hosts file, but MS has a Fixit to reset that back to default, which can be downloaded and copied across http://support.microsoft.com/kb/972034 - so that is something else to try.

jraju · « **Reply #41 on:** September 10, 2014, 02:18:24 am »

Hi, Rhuffman,
Did you see my post dated september 9 and try the microsoft scan

rhuffman · « **Reply #42 on:** September 10, 2014, 02:50:16 pm »

Sorry guys i did not reply over the last few days, have been busy with work. Reading posts now and will reply soon.

rhuffman · « **Reply #43 on:** September 10, 2014, 03:51:17 pm »

Contacted Telus and their response is "We have not seen any new activity since Aug. 22nd. It is possible that the scans you tried resolved the issue already.
". Ponit of note no browsers at all will connect on this computer and yes i tried running iexploer with all addons turned off. I installed EMSISOFT Anti-Malware as suggested and fired up Bitcomet, it immedialtly bloced bitcomet.exe and it detected it trying to access FALCOWARE.COM. I have run the MSERT.exe file as well. Any virus or malware was deleted. (Point of not alot of the files these virus scanners have said were infected were keygens for various programs (all false positives) they also have said my warcraft mouse files were possibly an issue as well as my wow64.exe file to launch the game. I think i am getting alot od wrong diagnosies from these programs. None of these virus programs have detected anything to do with Citadeal. Here is the route file and bitcomet running in background all files are saying connecting and do not download since the block.

Boggin · « **Reply #44 on:** September 10, 2014, 05:22:19 pm »

You didn't get back to us if you had checked Event Viewer - Post #28 describes how to check for the errors.

It was interesting that bitcomet.exe was trying to take you to Falcoware.com so you could have something malicious on there.

Either with the partial connectivity or you can save and copy across - download AdwCleaner http://www.bleepingcomputer.com/download/adwcleaner/

Click on Scan and when that has completed, it may show items in the lower box that you can uncheck if you want to keep.

Click on Report and that will show what it has found - if it has found any files that it wants to delete, close the Report and click on Clean.

It will produce another report after the reboot as to what it has deleted and then see if you can connect through Telus.

If that still fails then I think you should use the link in Post #30 to create a Kaspersky Rescue Disk and boot up with that.

It may be able to get an Internet connection if you wire up so that it can update itself when you choose that option and then have it Scan C:

This will take a number of hours and when it has completed, click on Shutdown to see what it does then - it initiated a chkdsk /f on mine but it may take another path for you as I had a different problem when I used it..

rhuffman · « **Reply #45 on:** September 10, 2014, 07:01:37 pm »

Boggin do you use skype, if so lets connect and chat about this my handle on skype is rick_and_liliya, skype is online right now.

jraju · « **Reply #46 on:** September 10, 2014, 09:07:01 pm »

http://wiki.bitcomet.com/bitcomet_client_issues_and_possible_solutions?&#all_my_other_internet_applications_either_slow_down_or_say_they_can_t_connect_when_i_use_bitcomet_what_s_going_on_and_how_can_i_fix_this
Please see this link. It takes much of your source and resources.
If you could get rid of torrent exe, then you may have to loose your internet connection altogether.
I have come across the same problem, and i have to format my Os to get rid of this monster torrent. Torrent downloads are from computer and it is possible that citadel would have crept in your computer thro this computer to computer transfer of downloads. It takes your sources and resources. If it is possible to not to kill but to destabilize the torrent exe, then you are having a chance of getting the proper internet links to connect.

Update: if you still insist that you have to have bit comet and other internet connection do the following tip. If it fixes ok, otherwise, i think that disabling if possible the torrent may restore your internet connection.
The tip
Change the Connections in BitComet

1. Go to Tools and select Options (or press CTRL+P) to bring up the preference options.

2. Go to Advanced and click on “network.max_connections”.

3. Change the value from 0 (unlimited) to a more usable connection number (100) in the “Value:” box below, then click Apply.

rhuffman · « **Reply #47 on:** September 10, 2014, 11:50:43 pm »

Ok so how do i disable the torrent.exe

rhuffman · « **Reply #48 on:** September 11, 2014, 01:34:41 am »

Doing the Kaspersky Rescue DIsk, it was able to connect to the internet and the browser works to. 19 hours to go

Boggin · « **Reply #49 on:** September 11, 2014, 08:01:32 am »

Quote from: rhuffman on September 11, 2014, 01:34:41 am

Doing the Kaspersky Rescue DIsk, it was able to connect to the internet and the browser works to. 19 hours to go

The Scan C: only took ~9.5hrs on mine which was long enough, but it would depend upon how much you have on your computer.

Kaspersky won't be using Telus to connect to the internet http://www.howtogeek.com/howto/36403/how-to-use-the-kaspersky-rescue-disk-to-clean-your-infected-pc/