No Internet Unless In Safe Mode

Hi to all and Happy Thanksgiving. And prayers for the Californians.. wow.. so bad!

I have a problem. Unsure if it's malware, or else wise. Vista Business on a Dell Optiplex 960, Firefox, MWB Prem, and Avast Internet protection. (None of that was intended as a joke.. but laugh if you must!) I've been on line, looking at data sheets, electronic forums and some video links.. and this morning I can't establish a connection between my computer and the internet.

IP has me pick up a new DSL modem. Upon install, they verify that I have a IP address, and lots of other "ipconfig" related stuff, to verify "their end is functional". MWB can't communicate for updates. And both FF and IE can't get on line. All scans recently were clean, no slow down, etc. Normal boot, I get IPv4 and 6 as local. In safe mode, IPv4 goes to internet.. and here I am typing to the forum.

Recent unknowns? Avast said I had a couple unprotected files, I said, "fix it". And I can't find a un-fix. No idea if that caused the problem. I tried running with MWB and Avast services terminated for a period, including the firewall. It DID show two different items blocked in Avast.. but it said FF was OK to connect. The online troubleshooters can't help, because IF I'm in safe mode, it's working. And if not, well then I'm not on line to use them! Any suggestions were to look, what to fix.. or should I do the Malware scans and report in for surgery? My less than helpful IP tech guy said they were all.. windows 10 only. I'm thinking they were not born yet, when Vista was the then current OS. Yes, yes, I know. But it worked up until yesterday! LOL

A kind thank you to all who have read, or feel the need to assist the nerd.
Jerry

 

Have you tried "Safe Mode With Networking"?

 

Sorry I didn't say that explicitly. I'm running in safe mode with networking.. and it works fine. Not so, under normal boot-up

 

Do you think I should do the malware scans, or is there something simple I'm over looking? I don't believe I changed anything to cause FF (or MWBs) to not be able to communicate with the internet. But clearly the hardware is working (when in Safe mode w/networking).

 

It doesn't seem like malware.

Download and run Tweaking.com - Windows Repair.

Installer:
http://www.majorgeeks.com/files/details/tweaking_com_windows_repair.html

Portable:
http://www.majorgeeks.com/files/details/tweaking_com_windows_repair_portable.html

Take your time and follow the instructions carefully.
It's recommended to run the program in "Safe Mode With Networking". Restart and run the program a second time.

 

Thanks Eldon,
I saw your reply this morning, and have spent the day running it first in Safe Mode, then again with Avast protection shut off, in normal boot. It did take longer the first time, but I never saw any red flags. I half expected disk errors but NONE! 8-]

I did have a Avast update just previous to all of this. And I assume in safe mode Avast and MWB are both shut down. (I can connect perfectly here in safe mode). I did look at the Avast Firewall and what appeared to be lots of IN Block.. but I have no idea how most of that works.. except to assume if all is disabled, I should be able to connect. I see IPv4 as Internet, and IPv6 as local (in safe mode). Both are Local when I boot normally. How do I fix or change that?

I did see this in Event log: Trusted platform module security device not found. TBS not started.
UMDF reflector WUDFPF service not found
DCOM Error 1083 attempt to start WinMgmt
(8BC3F05E-D86B-11D0-A075-00C04FB68820)
DCOM Netman
(and something else about DNS resolving).

Do I need to look at start up to see what loads in normal boot? It looks like it's already wiped MWBs (until I get back on line in normal mode). What else in safe mode will let it all work, and not in normal boot?

Any help greatly appreciated. THX!! Jerry

 

After looking at the Avast forum.. where 2003 seems to be the most recent posts.. AND the note that my AV is due to be terminated from updates as of December.. it was time to chuck it. Upon uninstall, my internet connection immediately returned. Still working on Malwarebytes to get it back into operation. Any suggestions on usable, semi-dependable anti-virus programs? Anyone? Thx, Jerry

 

Is the internet connection now working in normal mode?

Re-install Malwarebytes.

Have a look at this chart.
http://www.av-comparatives.org/comp...2018&chart_month=10&chart_sort=1&chart_zoom=3

 

Hey Eldon...
Yes, I did a uninstall of Avast, and had the internet connection back in normal mode. Malwarebytes didn't survive the Tweaking.com. I went to their web site, started to do a download, but it recognized enough of what was still on my system to reload it.. and it then ran FRST and collected the logs to determine why it was (now) having trouble starting. I do have mb-clean.. guess I could wipe it and reload. But the customer support is nice to have a reply. They may suggest the exact same procedure.

I then "picked two" and loaded AVG AV and ZA firewall.. to have something on here. Interesting chart in your link. So is the Microsoft a stand-alone product? I'd doubt they will support my Vista, but looks promising if it will run on a updated Win 7.

Thx, Jerry

 

AVG is owned by Avast!

Microsoft Defender is available for Windows 8 and later.
You might want to consider Microsoft Security Essentials if you want a Microsoft AV.

 

I thought the GUI looked VERY similar! Price is right.. and I'm still on line in normal mode, so that's good! I have no idea if AVG plans to discontinue Vista support. The Avira was my first choice, but it wouldn't even load when it saw Vista OS! So I just wanted to find ANY (free) AV pgm that would work until I get this upgraded to 7. AVG was the 2nd choice.

Don't think I'll be doing Win 8, and don't want to go to 10 either. I'll need a new/different computer at that point.
Been a long day.. later! Jerry

 

1.You might consider a chromebook. From my reading the ChromeOS is getting better.

2. Another option is an android tablet with a 10" screen. You attach a bluetooth keyboard (I got a $5 one that is almost full sized at the Five Below chain which works on Windows, android and OSX).

3. Finally, learn how to make a linux USB stick. Once you've figured out linux, you could install that in place of the Windows OS in 2020 (for Win 7) or 2023 (for Win 8.1).

I didn't mention buying an iPad. Those, in my biosed opinion, are much too expensive and have other issues which I won't go into. Apple hardware isn't on my list of options.

 

A big draw back for me is using a Autodesk CAD package that (supposedly) won't load or run in 7. And while I have free access to SolidWorks (being a member of an association).. THAT might require a small super-computer (or two?). Did their guy say 12 giga sticks of memory, and a small nuclear power station on site? So I'll probably keep the Vista, and convert another to 7 just to go Krogering. I don't think that any pocket thingies are going to be viable. But linux might work. Do I have to unlearn all the non-info from MS?

As to the health of this one: Malwarebytes responded faster than my mom, with the FRST results, and finding that winmgmt had expired, and then provided a trendy MBRepairCMD tool. That got Premium running again in a snap. (I'm gonna invite them to my Christmas party! wow, amazing customer service!).

I've had two "issues" since then, one to do with firewalls arguing. I may be down to one now(?), and a complete lock-up while on line last night. Not yet figured that one out, but will post again shortly.

I do appreciate all the help here! Jerry

 

I might need some help with this.

Yesterday, the computer just froze.. my only (known/apparent) option was to turn it off.
This morning while writing a email, my ISP webmail just went poof, and I was bounced back to the log on page. If I recall, a block on the screen said iMAP error or update?? Looking at the event viewer, there are a lot of errors. Some like this:

C:\USERS\NEW USER\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\xxxxxx.DEFAULT-xxxxxx\SAFEBROWSING\BASE-TRACK-DIGEST256.PSET> in the hash map cannot be updated. (What is a hash map?) Followed by:
A device attached to the system is not functioning. (0x8007001f)

Event ID 3013 for the Windows Search Service has been suppressed 141 time(s) since 11:32:20 AM.

Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 00xxx8FxxxBFxx. The following error occurred:
The semaphore timeout period has expired.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

And while it says Windows firewall is off, I get:
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Is any of that of concern (famous last words??). Or am I free to move about the cabin? Or to simply wonder while Mr. Gates is rich. It certainly consumes way too much time, current OS or not.. to try and keep one running.

Thx in advance, Jerry

 

You need to disable one of the firewalls.

 

Better to fully uninstall the 3rd party firewall and enable the default firewall, otherwise anything blocked by a 'disabled' Windows firewall will remain blocked.

There are several 3rd party firewalls that are designed to work with the default Windows firewall, I use this.

 

Satrow, Thanks for THAT info! I mean, why apply logic to something "being disabled", and yet still causing issues!?! So.. I will uninstall ZA, turn my Windows firewall BACK ON?? (yes??) and then load EFF? I like their nomenclature for the security levels. My kind of program. I have had several instances where the computer freezes, or page load times seem to be excessively long, or they just don't load at all. Before I dig into those aspects (unless you have other suggestions first).. I'll do the above and see what all that fixes first.

When I said I had two firewalls arguing.. windows fw was turned off with ZA fw loaded.. but somewhere (and I can't find it now), I saw the Windows Firewall "pull-down" settings", and it had 3 or 4 different groups of settings. That may not explain it well. I'd not seen it before.. but it was as if different parts of the firewall could be off or on? Or that it controlled selectively? Before I could resolve which parts were to be on or off (thinking that they should ALL be off, when I had selected that in the Security set-up, I got distracted on other problems, and never found that same configuration box. I don't know if fixing the winmgmt had enabled something new/different than I had seen before. I'll try to find it again. Will be back on here in a few days to let you know how it's going.

And as always, many thanks to all of you here at MGs! Jerry

 

I "think" I found the mystery box that I referenced above. Not sure how I got there originally.. but today, I found in Administrative tools: Windows Firewall with advanced security. (Is this different from the normal FW??)

What is shows is summarized:
In Administrative tools, Windows Firewall with advanced security
Under "Overview" says Windows FW is on
Under "Private Profile is active" says Windows FW is off
Under "Public profile" says Windows FW is on

Monitoring
Domain Profile
Under "Private profile is active" Windows FW is off
Under "Public profile" says Windows FW is on

In looking thru all of the rules, exceptions, need for 3 Masters degrees.. it looks very involved. No idea if I've turned something on that shouldn't be, or vice versa. (I feel good about even finding the mystery box!)

 

The above settings look the same as mine in Control Panel\All Control Panel Items\Windows Firewall (in W7).

From an earlier post, looks like *something* was preventing Firefox' (Google's) SafeBrowsing database from being updated (though it may have been *something nasty* interfering).

SafeBrowsing is a frequently updated block/warn list built into Chrome/Firefox, it's a useful security feature.

 

Satrow,
I'm back to square one. I tried loading EFF, even after seeing where it said Win 10/8/7. If I didn't have some life otherwise, and Christmas, etc.. I'd try to get my Win 7 disk put into one of these junk computers I have here, but I'm still running Vista Business. Even this most recent "whatever it is" has consumed most of a week. Second suggestions for a viable FW? Or just reload ZA?

Re: Your reply above: Should I move this thread to Malware? (or.. the computer to the bit bucket?? LOL). Must leave it soon.. have to be elsewhere. Thanks! Jerry

 

Describe the EFF references please?

ZA's notorious for not uninstalling cleanly, sometimes leaving dregs behind that cause further, or worse, problems.

Anyone have the latest info/uninstaller/routine for ensuring a PC is free of ZA?

 

Satrow,
EFF was the firewall you suggested in the link in #16 above. So I'm running on Windows FW only right now. And to come on here and read your last msg, the computer hung again. This time I waited instead of pushing the power button. I saw a few flickers of the LAN.. but it was locked up otherwise. Maybe 30 seconds, the screen jumped to some hash, then off, and it showed a command prompt briefly.. and I restarted normally. Copied the following:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6002.2.2.0.256.6
Locale ID: 1033

Additional information about the problem:
BCCode: 100000d1
BCP1: 00000000
BCP2: 00000002
BCP3: 00000001
BCP4: 8A859607
OS Version: 6_0_6002
Service Pack: 2_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\Mini112618-01.dmp
C:\Users\New User\AppData\Local\Temp\WER-32073-0.sysdata.xml
C:\Users\New User\AppData\Local\Temp\WER13ED.tmp.version.txt

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

Not sure if I should be on line with Win FW only, so will go off, and check back shortly.
THX! Jerry

 

Thanks, I've not seen it referred to as EFF before, it's still relatively new and I rarely see it mentioned.

That's almost always caused by a 'bad' driver, here ZA is the most likely culprit, esp. if the minidump or BSOD screen points to a network-related driver.

Copy this minidump to your Desktop (it's hidden by default so you'll need to unhide files/folders from Explorer's Options/Preferences) then right-click it and 'Send to Compressed Folder. Attach the resulting zip file to a Reply please.

 

"Send to" only shows my removable disks. I have 7zip but don't know the procedures to compress a file.

 

Learn something new every day!

 

Thanks again for all the help! Will be working on other things for a few days, but .. lets see.. think I've been visiting here for the holidays since 2008! So.. as Arnold might say, "I'll be back!"
Have a good one! Later! Jerry

 

Well, it's certainly affected the networking stack but I don't see any evidence of anything related to ZA loading.

Just in case there's a ZA file/Registry entry lingering, run the ZA Clean tool and reboot before updating the following.

I see you're running an older network card driver, e1k6032.sys from 06/04/2010, there's a 2013 version here which should be more compatible with recent software.

The more recent MBAM/MBAE and/or AVG might be interfering with remnants or each other, also a chance that there's some malware involvement. If the same 0x100000d1 BSOD happens, try fully uninstalling the Malwarebytes software during troubleshooting and upload any more recent minidumps here with a description of recent changes plus the running software when it happened.

 

Hello again.. something not mentioned before: After booting, I hear a .wav that I did not recognize. This began after the winmgmt repair (in post 13) I believe. I might hear it 1-3 times after startup. I determined it was Windows battery Critical.wav, and is assigned to "Critical Battery Alarm" (this is a desktop, not battery powered), and also "Device failed to connect". I changed that one to a new .wav to determine for sure which one is making all the noise ;-). Not certain, if it has gone off since the new driver update.

OK.. I ran ZA Clean, then updated the network card drivers.
I was online (at a previously friendly auction site), and the computer hung, just as I did a right click I believe. I missed the info box, but did find a minidump (zipped it and attached). So at that point Windows Explorer and Firefox were both open, and it crashed again. When it restarted first thing I noticed was Adobe Flash update notice (notice only, I'm not on automatic update), and then I saw the message which I posted in wecrash.txt (attached). As I recall, the last time it crashed, the Adobe updater was present when it restarted THEN also! So possibly it caused the crash(?) I read a few posts here and MB completed a scan, and the findings are in 2ndmbsummary. I did quarantine both files, but the first report didn't show that action. The summary did. Let me know if you need the earlier export.

As in a few other posts, (from MG).. do I need to do the malware song and dance, and move this over there? Yes, Win 7 might be the best option, but I know that will take me a month to do. Not good (holiday) timing, unless a absolute must-do-now. BTW, after mention that ZA firewall may not be the good choice, and removing it, I have no other FW except Windows at this time. Suggestions, for one that will work on Vista Business?

As always, I'm greatly appreciative of the expertise and assistance. Jerry

 

To clarify one instance above.. the Adobe updater notice was showing as the computer recovered. I then RAN the update, which looked fine, until I hit "Finish", and Windows Explorer then crashed.

 

MalwareBytes seems to have (incorrectly) quarantined the ZA Clean Tool, shouldn't be a problem if you'd already run it and rebooted.

The Flash installer appears to have triggered a buffer overflow BEX crash in Explorer, it looks like it was prevented from accessing *something* by lack of Permissions. Try flushing out any Flash dregs with the uninstaller tool, then install the NPAPI version for Firefox, I always use the direct links from the most recent Flash post at Security Garden.

From the first section of the minidump data it's clear that it's a 'bad' driver affecting the networking stack:

You've updated your NIC driver to the latest 20013 version already, I can't see any 'known bad' drivers running. The main 3rd party, network affecting drivers are all AVG/MBAM.

Overall, it feels like we're hovering right around the point of no return here, it might not be possibly to get Vista back into a fully functional form without a reinstall (and all the updating headaches that means).

Try cleaning out Flash and installing it for Firefox, if that succeeds then Run MSinfo32, when it opens, click down through all the subsections to populate them (a small number might not anyway) then Save it as the default NFO type, then zip (Send to compressed folder) and attach the zip.

 

Satrow.. or to whom this concerns ;-)..
When I ran ZA Clean, it was really quick. Is that any indicator that it did not run properly? Should I throttle MB, reload and re-do? No hangs that I know of today.. just weird issues with my ISPs email system.. changing my password, on it's own(?). Even they are puzzled.

As to "permissions".. I was frustrated with the overzealous Vista security a few months ago.. not being able to access obvious things like *MY* Documents, or Photos. And not sure I did that correctly, but I did eventually gain access to the ones I needed. Not sure if I did anything globally.. or in the "not good" way.

I have not heard either of the .wav files mentioned above. But one continues, and often. I have not identified this. To me, it's a 2-beat sound, (like ta-da). It could be described like the click at the end of a LP record, only it's 2 clicks instead of one, or the sound made when someone keys a mic, (squelch opens), and a second click follows (1 sec total time for two audio clicks). Or something like a fingernail tapping twice on a wood surface.

I uninstalled Flash with their utility, then installed the NPAPI version. And ran MSinfo32, zipped, attached. From a glance, I didn't see anything listed as Problem device, etc.. (OK, that should be good for a laugh!!)...

Let me know what you find, or if I should run the malware checks. Truly appreciate the help. This feels deeper than any previous malware issue. Jerry

 

That's enough to suggest a possible malware problem, I think you need to get it checked out next to try to ensure that nothing bad is active.

I'll take a look at the MSInfo data and have another read through the topic, I won't reply tonight, getting late here.

 

If you are still on.. do you want me to run the Malware routines, or wait? Not a rush, but I could get some scans running if needed.

 

Yes, download and run the checks, please.

 

Not sure if I should post these here or not. But if you move the thread to Malware I'll find it. I think all the scans ran OK, but I did have MGtools on here from before. I hope it checked for updates. Let me know if I need to remove/replace for a updated version, and rerun it.

In the course of rebooting, I did get the .wav several times each, which is now assigned to "Device failed to connect". Looks like the scans found several questionable items.

Thanks for all the help! Jerry

 

Good Morning Tim,
After running the scans last night, I did see one big change this morning. My network and sharing center has been showing a "X" between my network and the Internet (but it was working or connected). This morning due to the scans and/or quarantine(?), no X!

I reran Hitman, deleted both PUPs, and have posted the log.

Greatly appreciated you taking a look at the logs, and the instructions! Jerry

 

Jedi humor? Normal?? LOL...
Getting closer. MB came up showing Web protection off. And it would not turn back on when I opened the interface. I turned UAC back on (not knowing), and restarted. MB was now normal, but RogueKiller had been minimized, so start-up had issues with that. (It did show 1 detection, and 4 quarantined from last nights scans).

I still get a .wav at start-up assigned to Device not connected.. but maybe that is a web cam (removed), or something else not of concern (?). It will take a few days to see if the system is running properly or if it hangs again. And I still am running on Windows Firewall. Should I load some 3rd party FW?
THX!!! Jerry

 

Will do.. all good so far today! Many thanks!! Jerry

 

Tim,
The system seemed to run OK yesterday, and today until about 8:48 pm. It froze again. I waited for a while, but then turned it off, and restarted. Firefox was open, online (in what has always been a ok place before).. just waiting. I did find a few things in the event viewer, but they all look like references to the restart. Is there a way to log what it is doing otherwise? Or a alternate way out of a hang? Ctrl-Alt-Del doesn't do much these days (as in NOTHING). Let me know if I can gather any other info, or specific instructions to try. Thanks! Jerry

 

Apparently I had it on my computer from the last time I ran diagnostics (I assume).. so when attempting to use it as a one time free trial, they want money. Any other suggestions?

 

I asked to borrow their lawn mower, and they offered up the program instead. The first questionable item.. no worries to delete. I stuck it there in lieu of a bookmark. But the second one is my email link. And as for Flash Disinfecter.. I had read about it being a problem, but thought I'd loaded that from here! So I didn't delete it. Let me know what next.. that one may have been quarantined already. THX!! Jerry

 

The system may be freezing because you are running two real time protection Programs: Malwarebytes Premium and Avast Internet Security.

Decide on one paid and the other free, without the real time protection then use the free one from time to time to manually scan.

 

Tim.. Thanks for all the help. And if you can answer this, (or anyone?).. Do I need to rerun Zemana and let it quarantine (or delete) Flash Disinfector? As I mentioned above, I had seen several posts (and other sites as well), that FD has apparently caused more problems than fixed. And then I'll need a alternative to manage thumb drive use, scans, and to control auto-starts on anything on those drives.

Plodr,
I have been running MB Premium and Avast Internet together for at least 2, maybe 3 years without any serious problems. Some bad things were found by MB, some by Avast.. so having AV and AM both, seems smart. When I renewed Avast, I noted they would no longer actively support Vista, so I did a uninstall with THEIR cleaner program. However, I have seen that there are still remnants remaining. BUT.. the freebie AV I selected turned out to be AVG.. "owned" by Avast. So I don't know if some of those software parts are used by both programs. Any suggestions on how to selectively clean ALL of the Avast, but retain AVG would be welcome. (Or a different program, if now would be a good time to revise my AV program choice. I think the system is stable enough now to do full uninstalls, and reload.. IF.. that will actually accomplish the task. Knowing how many pop-ups I got from Avast, on program options, renewals, etc.. well, I know they don't want to Quit poking me with a stick. NOT a welcome aspect of their so-called customer service. MB on the other hand.. in a word, AMAZING, in their program and support.

I see a lot of events related to search. I'm not sure where to check, but I may have had some previous issues related to indexing. (I know about enough to really screw stuff up sometimes, while trying to learn, and/or fix as I go.) Would non-indexing cause hangs? And where/how to look/fix?

Clearly I need to find a Win 7 based computer, or start reading about Linx. Or maybe take up underwater basket weaving...?

MANY THANKS!! Jerry