Author Topic: Cannot get access to the internet (Read 123810 times)

Shane · « **Reply #50 on:** September 11, 2014, 05:23:54 pm »

Quote

Doing the Kaspersky Rescue DIsk, it was able to connect to the internet and the browser works to

Then we know for sure that the router is fine and the internet is fine and that it is your system. Which explains why the pings worked as the virus is hijacking the port 80 and others but not the ping port.

You must have one hell of a rootkit installed.

So many posts now, I cant remember, but you did combofix.exe and tdsskiller.exe correct?

Shane

rhuffman · « **Reply #51 on:** September 11, 2014, 08:35:04 pm »

Yes shane i ran both combofix.exe and tdsskiller.exe - This is the worst computer hijack i have ever seen. One for the record books for sure.

Shane · « **Reply #52 on:** September 11, 2014, 08:44:34 pm »

You are doing the best thing by scanning the system outside of windows itself. Viruses like this like to fight back when you try to clean the system while windows is running. So the only way to keep them from doing that is to scan the system outside of windows when windows isnt running.

Of course now it just comes down to how new this virus or rootkit that you have is and if any scanner will catch it. That is the things about all antivirus/scanners. they can only detect what they know. Virus makers test their viruses against them all before they put it out.

Worst case, if you want to be 100% sure you are clean, then you have to backup your files that you cant replace, kill the partitions (In case it is a nasty MBR virus) and then install windows fresh. And formatting the drive wont cut it since the MBR doesnt get replaced. You have to delete the partitions, which you can do during the windows install, and the windows install will auto create new partitions.

Shane

rhuffman · « **Reply #53 on:** September 11, 2014, 09:17:13 pm »

Thanks Shane for all the help and everyone else, will keep ya posted on progress. Shane is that your wife or girlfrind in picture, lucky guy. I am lucky to have hot Russian blond girl

for my wife

Shane · « **Reply #54 on:** September 11, 2014, 09:23:33 pm »

My wife of 10 years and counting and 5 kids

Shane

rhuffman · « **Reply #55 on:** September 11, 2014, 09:39:52 pm »

Cool

Hey do you want to chat for a bit on skype, my handle is rick_and_liliya, you can see my wife on the image for that, ill fire up skype now

jraju · « **Reply #56 on:** September 12, 2014, 02:10:09 am »

Hi, Shane, if it is a MBR virus, then aswmbr is available as a tool of avast antivirus . This will scan and if it fixes others or not, there is a button to fix MBR and after an alert it replaces the infected MBR, The tool could be downloaded here
http://public.avast.com/~gmerek/aswMBR.htm
Or instead, one can go to the elevated command prompt and there, could execute fixmbr command and it will fix any infected after alert. Provided it only fixes mbr. But as you rightly pointed out, his computer has variety of rootkits, trojans, and browser objects playing with all the system files. Torrent downloads are risky in nature.
I have already asked about the utorrent kills my internet connection and some fourm members have enclosed a link that it could kill int connection.I could not locate the thread easily in my summary but will enclose that in due course of time. There is possibility of viewing total no of questions individually in this "My summery Posts", but it is a continuous posts, not post wise.

rhuffman · « **Reply #57 on:** September 12, 2014, 10:00:00 am »

Hey Shane microsoft update is trying to run, i clicked on it and it is running files from my external drive. unplugged the drive and updates would not work, virus program for sure doing kaspersky on all drives now see what happens when i get home from work.

Boggin · « **Reply #58 on:** September 12, 2014, 10:14:45 am »

Have you always had the external HDD plugged in ?

You need to get the computer sorted without anything connected as the infection could be residing on the external HDD and I don't think the likes of Combofix etc. would have scanned other than C:

In Kaspersky you have boxes to check for which drive to scan and if you had the one for the external drive checked as well, then it would have gone onto scanning that one as well.

The scan should have completed long before now if it was just set to scan C: on the computer.

Shane · « **Reply #59 on:** September 12, 2014, 06:03:36 pm »

So did the internet start working after you uninstalled the programs I told you to?

Shane

rhuffman · « **Reply #60 on:** September 12, 2014, 06:48:52 pm »

Yes 2 external drives and a flash drive are attached. I ran jasper sky with all ticked and it is saying read errors on some files and the first time I ran it it failed running, it is still running now started it this morning and it is at 34 percent. Sorry forgot the name of programs you asked me to uninstall, had a few beers last night, what were they again.

Shane · « **Reply #61 on:** September 12, 2014, 07:45:34 pm »

AVG, and any and all of the other scanners you have installed, including any tools like hide my ip and anything that touches the network as well

Shane

rhuffman · « **Reply #62 on:** September 12, 2014, 07:51:03 pm »

Ok will do, will keep ya posted.

jraju · « **Reply #63 on:** September 12, 2014, 07:57:44 pm »

In continuation of reply 56 of this post
I request you to see this link, where it is clear that torrent may altogether stop internet connectivity.
http://en.wikipedia.org/wiki/Layered_Service_Provider#Corruption_issues
Did you try microsoft service link for fixing. It include in its virus definition the citadel virus. hence, i recommended

Shane · « **Reply #64 on:** September 12, 2014, 08:25:12 pm »

I have him removing avg and the other scanners because I have had multiple customers who called me saying their internet didnt work any more and it turned out that the firewall in the AV was blocking it even when disabled. When I have them remove the AV the internet started working fine.

So to cover all the bases I am having him do the same. Better to make sure it isnt one of the many many scanners he has installed

Shane

jraju · « **Reply #65 on:** September 12, 2014, 08:41:03 pm »

Hi, Thanks. shane for your information

Boggin · « **Reply #66 on:** September 13, 2014, 02:07:30 am »

All of those programs would have been isolated in Safe Mode with Networking, so perhaps the conflict is from the attached devices ?

Shane · « **Reply #67 on:** September 13, 2014, 03:01:01 am »

I have seen firewall drivers still block even in safe mode with networking. It is a low level driver and depends how it is configured to run. You can set what drivers and services are allowed to run in safe mode via the registry and a lot of the AV's add their drivers to the safe mode sections.

Shane

Boggin · « **Reply #68 on:** September 13, 2014, 06:57:53 am »

Normally without setting other programs to run in Safe Mode with Networking, there's usually only Windows Firewall active - although when on occasions I've booted up into that mode, I've seen my Norton 360 drivers included as the rest were loaded.

AVG can be the bane of Internet at times, especially when its AVG Secure Search add-on is running and uninstalling AVG in favour of something like MSE while trouble shooting is always a good step and using either a good uninstaller program or AVG's uninstaller to ensure no residue remains.

I'm concerned at the amount of external storage media connected while trying to trouble shoot the computer as they add too many variables - and without going back through the thread, don't know if connectivity is possible when wired using the built in LAN and without bitcomet.

Definitely needs the likes of µTorrent uninstalling and would be interested as to what else is installed on the computer.

A copy of the output of MiniToolBx with pretty much all of the boxes checked could tell us a lot - this file can be copied across the same way as the ipconfig /all was. http://www.bleepingcomputer.com/download/minitoolbox/

rhuffman · « **Reply #69 on:** September 14, 2014, 11:27:38 am »

Well i have scanned all drives and am scanning god computer as well (point of note cannot boot into safe mode on good computer - it hangs at the ati file). I have uninstalled avg and adaware, rooming the virus scanners that i was told to try so there will be no virus scanners installed. So far still no internet access.

Boggin · « **Reply #70 on:** September 14, 2014, 01:34:49 pm »

Can you copy across MiniToolBox from the link in my last post, check all of the boxes then post its report on here so we may be able to see what is going on ?

If the "good" computer is otherwise working okay, then the Safe Mode problem can be looked at later as it's best to work on just one machine at a time - but you could download the auto detect and install the graphics drivers if it gives you a download. http://support.amd.com/en-us/download/auto-detect-tool

If it says you're up to date and doesn't, then go Start - All Programs - right click on AMD Catalyst Control Center and select Delete then try the auto detect again.

After the drivers have downloaded, select the Custom install and click on Select All and let it do it's thing - but we need to concentrate on the original Network problem.

rhuffman · « **Reply #71 on:** September 15, 2014, 09:57:54 pm »

Here is the report from Minitool Boggin.

Boggin · « **Reply #72 on:** September 16, 2014, 02:33:21 am »

Thanks for that.

First or all, in Post #40 I asked you to copy across http://support.microsoft.com/kb/972034 and assumed you had run the Hosts file reset.

Unless you have added entries to the Hosts file, additional entries can be the result of an infection and resetting it can resolve Internet connectivity problems.

When you've run the MS Fixit, open a command prompt as an administrator and run these commands (again ?) -

netsh winsock reset catalog
netsh int ip reset resetlog.txt
ipconfig /flushdns
ipconfig /release
ipconfig /renew
ipconfig /registerdns
exit

Now reboot.

Hopefully this should reinstate the Subnet Mask to 255.255.255.0 that it should be and was and reinstate connectivity.

The Teamviewer errors could be because of lack of Internet connectivity.

Sometimes iTunes and Bonjour can cause connectivity problems, so a temporary uninstall of the former and stopping the latter may also need to be done if connectivity hasn't returned.

Has the licence on Stardock Multiplicity 2 expired as that could be the reason for it being stopped and if you no longer need it, then uninstall it.

Have you ever had Counterspy or Vipre installed - that's the only info I can get about SBRE and an incorrect uninstallation of either can leave residue.

I don't know what the E Rawdisk is - perhaps Shane can shed some light on that.

I think you still need to uninstall µTorrent as that could well have been the source of Citadel and can be for any other nasty.

What is the Pendrive for that you have plugged in - Drive J: ?

When connectivity is restored, Firefox, Adobe Flash Player, Adobe Reader and Java need updating.

jraju · « **Reply #73 on:** September 16, 2014, 05:19:04 am »

Hi, Boggins. Other solutions given by you will definitely solve the problem, but uninstalling utorrent. Would it be possible. I already written about my experience in my posts on this thread. It totally stops the int con once it is removed. My modem lights were fine but the blinking light at the back would not blink. Whatsoever you try , like restore , it will not work, as there will be no restore points available. At last i resorted to reinstall the Os not repair. Then only i could see the light, that is internet connectivity. I already enclosed the link about how it could corrupt the DNS server.
What is this mini tool . can any body run like ccleaner?

Boggin · « **Reply #74 on:** September 16, 2014, 05:49:40 am »

Thanks for the bit about uTorrent, I'll have to have a Google about its safe removal.

Anyone can download/run MiniToolBox - it isn't a program like Farbar that security experts use to diagnose malware/networking issues http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

I've never really got the hang of that one - it produces two reports but I've only ever managed to find one of them

Edit

Which method did you use to remove uTorrent ?