1 reply to this topic

[Treymac]

Moved from Malware Forum.
LDT


Hey guys. First time here, never actually done a lot of computer servicing. A co-worker recently asked me to look at their computer and see if I can fix it. I've run virus scans, malware scans, ccleaner. The computer doesn't actually have a lot of things on it, not a lot of documents, etc. It was used about a year ago by an exchange student who they suspect may have done something to compromise the computer.

The problem is that applications can't connect to the internet. It's connected to the local network, has ip address and can ping sites and establish a connection through the command prompt this way, but that's it. It does however work with applications being able to connect to websites if I boot into Safemode with Networking turned on. But as soon as I boot into regular windows mode it won't work. One thing that I tried was to uninstall the wireless cards driver and install a new version of the driver. The driver that was being used was from an unknown publisher, not actually from Linksys (I don't think). After I uninstalled the driver and tried to look for the new Linksys driver, it wouldn't use it. What actually ended up happening was that I restarted and the original driver was still there, even after I uninstalled it. I really don't know if this is something that I made a mistake on, maybe I really didn't uninstall the original driver, although I'm pretty sure I did because I checked the device manager and the network card wasn't listed anymore; until I restarted an the original driver was back. The driver I think is RaLink, but it just occured to me that this may be a driver provided by Windows, instead of the actual Linksys driver.

So anyways, I'm completely out of ideas. I ran HiJack this and provided the log and the startup list. If anybody could look this over, I would really appreciate it. If this doesn't work I'm going to have to reformat the drive :/


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:37:26 AM, on 1/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Attached Files

•  Treymac.txt   22.87KB   656 downloads

[Ztruker]

Hi Treymac, welcome to WhatTheTech.

Since the computer works correctly when booted to Safe Mode, something is starting during a normal boot that is causing the problem.

Use msconfig to determine what is causing the problem.

These are good tutorials on using msconfig in XP or Vista:
How to use msconfig in Windows XP
How to use msconfig in Windows Vista

Click on Start then Run, type msconfig and press Enter.
Click on the Startup tab, record what is currently starting then click the Disable All button.
Reboot and see if it runs normal.
If yes then use msconfig to enable several items at a time till you find the culprit.

If no, boot to Safe Mode again, start msconfig and click on the Services tab.
Check the Hide All Microsoft Services box, record what is currently starting then click the Disable All button.
Again, do a regular boot, see if it runs normal.
If yes then use msconfig to enable services till you find the culprit.

Once you've found the culprit, uninstall it or find out how to eliminate it from your system.
Simply disabling it in msconfig is a temporary fix at best.
Enable everything else you disabled.

Please let me know how you make out with this.