Unable to connect to internet

Hi, I recently had a malware, rootkit installed and I am trying to get rid of it. I think most of it is out running some final checks. Once this issue happened, my IE would start launching by itself and then I completely lost connection with the internet. I have my laptop that is connected to the same modem and that is working fine. My desktop PC is also directly connected with the modem but I don't see any activity. I see that the pc is has been assigned a valid ip address and has the right DNS servers and the gateway. Attached is the HJT log file and output from SIW.exe, lists all the system information in html. Any help is appreciated. -Jim

Jim, until your computer is certified as malware free, we can;t be of any help here.

Go to the HijackThis™ Logs and Infections Removal forum, read the info there and follow the posted directions. Once you receive a clean bill of health, come back here if you have any additional questions or concerns.

Please be patient as that is a very busy area. If you do not receive a response in 5 days, post a message here: http://forums.whatthetech.com/What_Do_If_Y…ays_t78698.html

Hi, I believe all malware issues have been cleaned up. Guys at spybot were very helpful. Where should I start looking at to resolve the internet connection issue.?

Can you post a link to the Spybot thread so I can read through it? That may help to understand what happened.

Here is the link http://forums.spybot.info/showthread.php?t=49181

I can see any reason that he can not connect.

Thanks little eagle. I had to register at Spybot then I was able to download and combine his SIW info.

sickofvirus, this is what SIW showed for your network hardware setup:


Card 1 (Not Connected) Intel® PRO/100 VE Network Connection
Card 2 (Connected) 1394 Net Adapter
Card 3 (Connected) Realtek RTL8139 Family PCI Fast Ethernet NIC

So it you have a Realtek PCI card that you use4 and your onboard Intel connection is disabled.

What does Device Manager show under Network Adapters? Are there any yellow or red marks?
Please post the output of ipconfig /all from a command prompt.

• Click on Start then Run
• Type cmd and press Enter or click OK
• Type ipconfig /all and press Enter
• Right click on the command prompt window title bar, select Edit then Mark
• Use the mouse to select all the output from the ipconfig command, them click the right mouse button. This will copy the data to the clipboard.
• Start a new post here and paste the data you copied into it.

Should look something like this:

Windows IP Configuration

Host Name . . . . . . . . . . . . : desktop
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : router

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . : router
Description . . . . . . . . . . . : Intel® PRO/100 VE Network Connection
Physical Address. . . . . . . . . : 00-E0-18-4F-1D-57
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.2.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1
DHCP Server . . . . . . . . . . . : 192.168.2.1
DNS Servers . . . . . . . . . . . : 208.67.222.222 208.67.220.220
Lease Obtained. . . . . . . . . . : Friday, June 12, 2009 7:10:02 PM
Lease Expires . . . . . . . . . . : Saturday, June 13, 2009 7:10:02 PM

Hi, Device manager doesn't show anything wrong with the network adapters. Also, its not showing realtek adapter. Here's the output from ipconfig - C:\Documents and Settings\HP_Administrator>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : sia Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Unknown IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter {F7829C73-6E95-4A00-BAC2-6E446936FCA3}: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Nortel IPSECSHM Adapter Physical Address. . . . . . . . . : 44-45-53-54-42-00 Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Autoconfiguration IP Address. . . : 169.254.241.150 Subnet Mask . . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . . : Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel® PRO/100 VE Network Connecti on Physical Address. . . . . . . . . : 00-13-D4-C1-0E-BD Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : [removed] Subnet Mask . . . . . . . . . . . : 255.255.252.0 Default Gateway . . . . . . . . . : [removed] DHCP Server . . . . . . . . . . . : [removed] DNS Servers . . . . . . . . . . . : [removed] 69.60.160.196 Lease Obtained. . . . . . . . . . : Friday, June 12, 2009 7:37:39 PM Lease Expires . . . . . . . . . . : Saturday, June 13, 2009 7:37:39 PM

I'm confused. The Spybot thread shows you using the Realtek adapter, not the Intel onboard adapter but your ipconfig output shows just the reverse.

Can you take a picture of your Network Connections window and post it here please? See the following for info on doing this:

http://forums.whatthetech.com/How_capture_…ots_t96099.html
http://forums.whatthetech.com/How_upload_I…ead_t96285.html

Here's the screenshot.

Here's the latest siw.exe's log. The weird thing is I am able to ping www.google.com from command prompt with 0% loss.

After looking into this some more, I can connect to internet when booted in safe mode with networking but in the normal boot. Any suggestions?

Very strange indeed. If you can ping then your network connection is good, so this looks like a DNS problem.

First try flushing the DNS resolver cache, see if that helps:

Open a Command Prompt and enter: ipconfig /flushdns

If you get Could not flush the DNS Resolver Cache: Function failed during execution.

• Click Start, click Run, type services.msc, and then click OK.
• In the list of services, click DNS Client.
• Make sure that the Status column displays Started and that the Startup Type column displays Automatic.
• If the service is not set to Started or if the startup type for the DNS Client service is not set to Automatic, follow these steps:
• Right-click DNS Client, and then click Properties.
• In the DNS Client Properties dialog box, click the General tab, and then click Automatic in the Startup type list.
• Click Start, click Apply, and then click OK.

If that doesn't fix it, try changing to the Open DNS servers, see if they fix the problem. See here: http://www.opendns.com/

If yes, then you need to contact your ISP and let them know you are having a problem with their DNS servers.

I use OpenDNS all the time. I think they give me faster web browsing then my ISP's DNS servers (Bright House).

Hi, I don't think its a problem with the DNS as my laptop is connected to the same dsl modem via ethernet and is working fine. Anyway I tried flushing the DNS and that didn't help. My DNS client is running. Any other ideas?

Sorry, you're absolutely right. I don't know what I thought I read in one of your response, but being able to pig www.google.com says the DNS is working fine.

I see you have Google Chrome installed. Can you browse with it or does it suffer from the same problem that IE has?

Please try starting IE without Add-ons. From the Run box, enter iexplore -extoff and press Enter. You should get a Internet Explorer is currently running without add-ons message. Click on Home and see if it works. If yes, then you need to find the Add-on that is causing the problem. Click on Tools then Manage Add-ons and start disabling them until you find the culprit.

From your HJT log, it looks like you have quite a few IE toolbars installed. Do you actually use all of them? If not, disable and uninstall them.

Edit: or, you can reset IE to it's install state: See here: http://support.microsoft.com/kb/923737/en-us

The MS Fix It For Me site has some good info and fixes.

I tried browsing from chrome, firefox and IE, they all seem to suffer from the same problem. Edit: Double checked that I don't have any proxy settings that may be messing this.