Jump to content

Another User having the Internet connection problem.

VirtuablueAm2

By VirtuablueAm2
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Replies 114
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

kevinf80

kevinf80

Posted
Posted

What makes you think you`re doing something wrong, i`ve seen this kind of problem many times. Sometimes we get a fix first shot, other times it does drag on....

 

Is it possible you can try a connection wired to the router?

 

One other scan for me please... Open an elevated command prompt, at the prompt type or copy/paste ipconfig /all hit enter..

 

A log will be created, look to the top left corner of the command box, you will see a small box with c:\_ inside, right click on that icon > select > edit > select all. The full script should go white. Right click on the small icon again, then select > edit > copy.

 

The full text will be copied to the clipboard. Open Notepad, right click into the text field and select paste. Post that log to your next reply...

 

Thanks,

 

Kevin....

Link to post
Share on other sites
VirtuablueAm2

VirtuablueAm2

Posted
  • Author
Posted

I have the log made, but I can't access my back-up right this instant. (Once again, posting from Wii.)

But so this post is not completely pointless. I went through the trouble of looking at my system restore points. One of them (And this one was set by HitmanPro) dates back to 9/15/15. Should I keep this one in mind?

Link to post
Share on other sites
VirtuablueAm2

VirtuablueAm2

Posted
  • Author
Posted

Okay, A few things about this next post.

 

 

First off, I got the date of the System restore wrong, It was actually from 9/7/15.

 

 

Second, I managed to get the Dns Log.

 

 

And Third, I managed to get a new flash drive with much more storage space.

 

 

So now I can try the Portable Windows Repair Method now.

 

 

I will give that log and Let you know how it goes.

Dns_Log_for_VirtuaBlue.txt

Link to post
Share on other sites
VirtuablueAm2

VirtuablueAm2

Posted
  • Author
Posted

Okay, I want to keep the topic flowing, and I also want to make sure it's here just incase I can't access this backup laptop in the future.

 

So I'm posting twice in a row.

 

 

I finally ran the Portable Windows Repair.

 

 

It fixed some small things.

 

But not the Internet connection.

 

Anything else I can attempt?

_Windows_Repair_Log.txt

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

The DNS log shows that the connection is actually made, there must be something blocking the connection, possibly Norton Firewall.. I want you to fully uninstall Norton security via Programs and Features, lets see if NIS is blocking the connection.

 

There is also an tool to remove all remnants here: https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us?abproduct=home&pvid=f-ho

 

If possible have Microsoft Security Essentials available to install, d/l the installer from here: https://www.microsoft.com/en-gb/download/details.aspx?id=5201

 

It will also be necessary to turn on the Windows Firewall: http://windows.microsoft.com/en-gb/windows/turn-windows-firewall-on-off#turn-windows-firewall-on-off=windows-7

 

Let me know if that makes any difference...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

There is nothing to miss, after you hide all MS services you disable whatever is left, obviously any that relate to your internet connection (if present) must be left active....

An image of mine is attached.... when disable all is selected all 3rd party services will be unticked, mine are currently ticked..

 

When that action is completed re-boot, the system starts with only MS services active...

post-3601-0-45285200-1444860789_thumb.jp

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

They look good, nothing related to your connection... This is a ball breaker for sure, the ipconfig /all log shows a positive connection, yet we hit a brick wall..

As the clean boot makes no difference you may aswell enable the 3rd party services, re-boot. Then we are back where we started. From there can you try to boot into Safemode with Networking, see if we have a connection in that mode...

 

http://support.eset.com/kb2268/

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Can you reset your router, instructions available here if required: http://setuprouter.com/networking/how-to-reset-your-router/

 

Next,

 

Download DNS jumper from here:  http://www.sordum.org/dns_jumper/downloads.php'>http://www.sordum.org/dns_jumper/downloads.php

 

Transfer to Desktop of sick PC, tool is portable no installation needed..

 

Instructions for the tool here:

 

http://www.sordum.org/7952/dns-jumper-v1-0-6/

 

Run the tool, from the main interface select dropdown arrow under "Choose a DNS server" from the list either select Google DNS or Open DNS, Now select "Apply DNS"

 

Re-boot your computer. See if the connection is good...

 

Thank you,

 

Kevin..

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

There is every possibility of hidden malware/infection, usually infections need an active connection to harvest data, zero access infection did mash connections when found, kind of trip wire I guess...

 

See if you can d/l and run the following:

 

1.Download Malwarebytes Anti-Rootkit from this link:

 http://www.malwarebytes.org/products/mbar/

2. Unzip the File to a convenient location. (Recommend the Desktop)
3. Open the folder where the contents were unzipped to run mbar.exe

Image1.png

4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:

mbarwm.png

5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

6. The following image opens, select Next.

Image2.png

7. The following image opens, select Update

Image3.png

8. When the update completes select Next.

Image4.png

9. In the following window ensure "Targets" are ticked. Then select "Scan"

Image5.png

10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed.

MBAntiRKcleanA.png

11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process.
12. If no threats were found you will see the following image, Select Exit:

Image6.png

13. Verify that your system is now running normally, making sure that the following items are functional:


  •      
  • Internet access
         
  • Windows Update
         
  • Windows Firewall



14.  If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder.

15. Select "Y" from your Keyboard, tap Enter.

16. The fix will be applied, select any key to Exit.

17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder:

System - log
Mbar - log   Date and time of scan will also be shown

Thanks,

Kevin...
 

Link to post
Share on other sites
VirtuablueAm2

VirtuablueAm2

Posted
  • Author
Posted

Is an update required?

 

Because I already have Anti-Root-kit on board my machine.

 

And This problem affects everything that uses internet, so I'm getting a Dns error every time because it can't connect to internet.

 

But anyway, The scan I just ran says No malware was found. But I'm not 100% sure that's true.

 

 

Does this info help any?

 

 

mbar-log-2015-10-15 (15-27-10).txt

system-log.txt

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

MBAR is a very thorough tool, i`m sure if ther was a hidden active rootkit on your system it would have found it....

 

Do you have the means to create the following tool by Kaspersky. This will run from outside of windows, so any hidden infection has no means to protect itself.

 

Information on Kaspersky rescue disk 10
http://media.kaspersky.com/downloads/consumer/kasp10.0_rescuedisk_en.pdf

Download Kaspersky Rescue Disk (iso)

  • Burn it to a cd or dvd, if you need a program to burn an ISO...use  Active@ ISO Burner
  • Configure your computer to boot from CD/DVD

    Note : If you do not know how to set your computer to boot from CD/DVD follow the steps here
  • Once you have the CD/DVD created, boot the computer up using it
  • Press any key to enter the menu
  • Select your language
  • Press 1 to accept the End User License Agreement
  • Select Kaspersky Rescue Disk. Graphic Mode
  • Click on the Start button located in the left bottom corner of the screen
  • Run Kaspersky WindowsUnlocker to remove Windows system and registry changes made by Malware/Virus (Only needed if you were locked out of Windows by Ransomware or similar)


    krd5.jpg

    If you can't find Kaspersky WindowsUnlocker, go to Terminal instead > type > windowsunlocker > choose 1 - Unlock Windows > Enter

  • When it's done, click on the Start button and start Kaspersky Rescue Disk utility
  • Click on My Update Center tab and press Start to download the latest update
  • Next, select the Object Scan tab
  • Put a check next to C:\ and any other local drives
  • Then click Start Objects Scan
  • Quarantine any malware found
  • Restart your computer and see if it boots up normally....



When booted back into Windows Navigate > Start > Computer > C:\Kaspersky Rescue Disck 10.0. Open the folder, inside is log from KRD run named "ScanObject" copy/paste that file to your reply.

 

Cheers,

 

Kevin...
 

Link to post
Share on other sites
VirtuablueAm2

VirtuablueAm2

Posted
  • Author
Posted

Hmm, Is this a sure-fire way to be sure if it's hidden malware messing with my connection?

 

Besides that question, I might need some time to get a cd to burn.

 

So this will probably be my last post for now until I get it.

 

But I will give the word when I will need more time to obtain the cd to burn.

 

(This problem is tiring me out, by the way.)

 

 

Oh, I also want to ask this in advance so I don't have to bring it back up.

 

Should the Rescue disk not work, Should I reconsider another method that I skipped? (Like the Previous FRST Method.)

 

 

 

 

 

 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Obviously we are in tunnel with no light at the end yet. The ipconfig /all log did show promise as the connection is there and made, something on your system is blocking the connection.

Usually a security system can be resposible, or malware has messed up registry settings. As I said ipconfig /all proves that settings are good, removal of NIS also clears that possibility.

The only other possible cause could be SpyBot S&D, one of its settings is to run your connection through a proxy, to be honest i`ve seen no reference to any confirmed proxy on your system...

 

Can you totally remove Spybot S&D, see if anything changes...

 

https://www.safer-networking.org/faq/how-to-uninstall-2/

 

The FRST method offered previously will revert registry changes to the date confirmed in the log, I see nothing wrong in trying that option if the uninstall of spybot makes no difference....

 

Cheers,

 

Kevin...

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.