internet connection blocked, please help

Hi All,

My daughter's computer has had it's internet connection blocked. She says that she received a message from someone on FaceBook and opened an attachment. :cry

The machine seems to be running OK, except for the loss of Internet. I can ping http://microsoft.com and get a reply so I think that the network card is OK but IE always says that it can't find the page no matter which page I try. The settings reported by IPConfig are all as I'd expect when her PC is connected on my LAN.

I've worked through the ReadMeFirst thread and the logs are all attached in a ZIP. (I hope! :confused)

I've run the programs as Administrator on this XP box but after I'd finished I noticed that I can't see any file or folder permissions on the drive. Also, her Docs and settings folder is locking me out with access denied so (I assume) that the scanning programs will not have been able to scan that folder.

Any help you can give would be very much appreciated
Thanks in advance
DerekJ

 

Hi All...

Just an update to confirm that I can browse FTP sites, so it's just the Internet port that's blocked.

I've turned off all software firewalls on the PC. I've uninstalled all protocols, services and clients then re-installed just TCP/IP, Windows Client and File&Print sharing.

I've re-run all of the software in the ReadMeFirst thread and still have no connection.

So all I can think of is that it's some sort of mallware blocking the Internet port.


Any help would be VERY MUCH appreciated as I'm at the point where I'd re-format the disk and start again.

Cheers
All
DerekJ

 

http://www.majorgeeks.com/images/grenade.gifWelcome to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif


Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

​

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Step 4:
Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

Step 5:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Step 6:
Next I would like you to install the current version of Sun Java: Sun Java Runtime Environment

Step 7:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi bjgarrick

I ran through the instructions as requested. Following your procedure I restarted the PC and tried IE but still have no access. Log ZIP attached.

I also installed WireShark to look at the network traffic and enclosed two screen capture JPGs.

The first shows the DNS traffic as I start IE. It shows the PC looking for the default gateway and then requesting Google.co.uk from the DNS server. The Server replies but there is no further HTP traffic.

The second is more interesting. I left the machine for a while and WireShark captured HTP traffic while IE was not running. It looks like a program was transferring data but I don't know what it was.

Hope this helps,
Derek

 

First thing I see is that you didnt follow some of the steps from my last post. These are still showing in your logs and should not be.

Second, go to the following website and upload these two files one at a time and post the results.

http://virusscan.jotti.org/

 

Hi bjgarric,

That's odd... :confused you show update 4&5 as still in place. I'm SURE I uninstalled these, and remember that the computer did not require a restart after completion. In the enclosed ZIP the screen capture cap-1.jpg shows the uninstall programs window shows only the update 10 that you asked me to install, not 4&5. Is it possible I uploaded an old log file? Or should I have restarted the PC after the uninstall??

I could not upload the two files you requested directly to jotti as the infected PC has no Internet connection. I copied them to a memory stick and uploaded them from this PC. I could not see any "dump log" feature on the jotti page so I enclose them as screen captures:- cap-2.jpg and cap-3.jpg. (I had to do one of them twice as I missed the file name in the JPG. :zzz)


Many thanks for your help, I realy appreciate it as I don't want to have to rebuild this PC. (She's lost the install CD :zzz)

Best regards
DerekJ

 

Everything looks good thus far; about the internet connection problem, download WinSock XP Fix 1.2, save to desktop and run. Reboot once complete.

If problem remains after running this utility, I would recommend the Software or Networking Forum.

 

Thanks for the help bjgarrick,

I'll rey that fix tonight and if it does not work then I'll start a rebuild.:cry

Bye...
Derek

 

[FIXED] internet connection blocked, please help

ARGGGggggg......

I AM AN IDIOT!:-o:-o:-o

bj's last fix did not work, so I started to rip things out just before I did a full re-install.

I found that the daughter had tried to update AVG but it must have failed, so it was running part of a previous version and part of the new one. So when I stopped AVG some of the original services were still running. I uninstalled her update and up popped the Internet. :wave

Why am I an IDIOT? 'Cos I relied too much on what she had said had happened. When I quizzed her about AVG, she said "Oh yes, that happened about the same time too.... but I did not think it was important"

MANY thanks to bjgarrick and ALL of the helpers on this forum. Please keep up the good work.

Best regards
DeekJ

 

If you are not having any other malware problems, it is time to do our final steps:

1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.
2. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
9. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Thanks bjgarrick,

The daughter blows you e-kisses from her computer, and I thank you too for getting her off my case :-D

I'd already followed similar instrictions from other posts and left the machine in just about the state you indicated in your last post.

Thanks again
DerekJ

 

You're Welcome!:major