A Truly Weird Problem

Toasterwoman · May 31, 2009

I'm going to do my best not to make this too confusing. I have 3 computers. One is a mini-lap that runs on XP2. It's very new and I haven't downloaded any programs to it except for Avast and Malwarebytes.

My second computer is a regular lappy and runs on XP (never updated it as it runs fine).

My main PC is my desktop which runs on W2000P.

Four days ago I noticed on my PC that when I typed a url into the address bar, it took forever to load. I use Google as my search. I also run a forum on Yuku. That started taking forever to load. Everything else worked fine.

Yesterday (on my pc) Google disappeared. I got a 404 and then a white page. This is using IE6. And of course my Yuku forum was like being on a 14.4 dial-up connection. Ran into the same thing with Firefox.

I ran Spybot, Malwarebyes, and Avast. No problems.

I started up both my lappys and I had the same problem. All are connected by a wireless router. Thinking it might be an ISP problem I did a dns dump on the PC. Voila! It worked. But not for long.

This morning I'm back with the same problem on my PC. I'm using my laptop because sometimes Google loads and sometimes it doesn't. Everything was fine on here this morning, so I decided I must have some infection on the PC. However, the problem cropped up again. I rebooted and Google was loading again.

One other thing I did notice was on my homepage where I have my bookmarks. Google is one of them. If I click on the Google link, it will read, "opening www.google.com." That's when Google opens. However, sometimes I'll get this long string with a bunch of numbers and the Google Url at the end. That's when it doesn't open.

Is this an ISP problem? Could 3 computers have the same infection? Am I losing my mind?

Any and all help would be greatly appreciated. I just can't figure this one out.:cry

Toasterwoman

TimW · Jun 2, 2009

Welcome to Major Geeks!

You may have a DNSChanger infection that would require you to reset your router back to factory settings. We need to see the logs generated by doing the below. But you also need to start a seperate thread for each computer.

Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.

TDSSserv Non-Plug & Play Driver Disable

READ & RUN ME FIRST. Malware Removal Guide

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

[*]Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

Toasterwoman · Jun 2, 2009

You know...you are the first person who has said anything that makes sense. I've never heard of a DNS changer infection. Something new to learn every day.

Since it was Goggle that was driving me crazy and causing so many problems, I finally did a ping test. Three out of four packets were being lost. I called up Comcast explaining the problem and got the usual, "Huh?" Second guy checked everything and said he had no problem getting Google using my IP. So I shut down everything, disconnected the router, and he did a reset on the modem. So far everything seems to be working OK.

I'm saving your instructions, as I have a sneaky suspicion I haven't heard the last of this. If it should happen again, I'll do everything you suggested and get back to you.

I am now going to educate myself on DNS changer infections. I come here a lot to read and learn. You guys really know your stuff. Thanks for everything.

TW

TimW · Jun 4, 2009

Attach the logs when you are ready.

Log in or Sign up

A Truly Weird Problem

Toasterwoman Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Toasterwoman Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member