Before trying to solve the network problem, I’d be happier if we could eliminate the possibility of your computer being infected.
I’m going to ask someone nearer your time zone to take over but meanwhile I’d like to try and get aswMBR to run.
Download/run Rkill:
Please download Rkill from one of the following links and save to your Desktop:
Link One Link Two Link Three Link Four
Double click on Rkill.
A command window will open then disappear upon completion, this is normal.
Please leave Rkill on the Desktop until otherwise advised.
Note:If you get an alert that Rkill is infected, ignore it. The alert is a fake warning given by the rogue software which attempts to terminate tools that try to remove it. If you see such a warning, leave the warning on the screen and then run Rkill again. By not closing the warning, this sometimes allows you to bypass the malware's attempt to protect itself so that Rkill can perform its routine.
You may have to make repeated attempts to use Rkill several times before it will run as some malware variants try to block it.
You'll be able to tell when rkill has done its job when your desktop (explorer.exe) cycles off and then on again.
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
extract the contents of the zipped file to desktop.
double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
if it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO.
[external image: Posted Image] Click the image to enlarge it
in the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
then click the Scan button & wait for it to finish.
once done, click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Satchfan asked that I have a peek at this. I'm a bit closer in time zones, I'm on the left side of N.A.
Since all computers seem to be effected and the problem can be resolved by connecting to a different modem this appears to be a router/modem hijacking. Please be patient we may be revisiting/redoing some steps. Remember I'm playing catchup.
Is your modem and router one unit or are they separate? What is the brand and model number of it/them?
Let's try this for a quick look to see if we can resolve this temporarily. If this works we will work on a permament fix. note: this fix will only apply to the computer we are working on.
Go to Start > Control Panel, and choose Network Connections.
Right click on your default connection, usually Local Area Connection for cable and DSL or your wireless connection if we are working on a wireless problem and choose Properties.
Click on the Internet Protocol (TCP/IP) item.
Click Properties
In the lower box, click the box beside Use the following DNS server addresses
In the first box type 208.67.222.222
in the second box type 208.67.220.220
Click OK
Next
OTL should run, I toned the fix down a bit.
Run OTL
double click on the icon to run it.
copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL
:Services
:OTL
FF - prefs.js..browser.search.defaultenginename: "iMesh Web Search"
FF - prefs.js..browser.search.order.1: "iMesh Web Search"
:Files
ipconfig /flushdns /c
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
OMG you fixed it. Even if only temporary. ONE post, I cant believe it this has been going on sooooo long OMG. My router and modem are one I beleive. It is a ACTIONTEC MI424WR supplied by my internet and cable provided Verizon. Here is OTL
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: "iMesh Web Search" removed from browser.search.defaultenginename
Prefs.js: "iMesh Web Search" removed from browser.search.order.1
========== FILES ========== < ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Heidi Seitz\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Heidi Seitz\Desktop\cmd.txt deleted successfully.
OTL by OldTimer - Version 3.2.33.1 log created on 02282012_065858
OK. I reset the router and the temporary fix is broken. I have not made any changes to the router since we've had it. Everything is default Verizon settings.
Go to Start > Control Panel, and choose Network Connections.
Right click on your default connection, usually Local Area Connection for cable and DSL or the wireless connection if that is what we are working on and choose Properties.
Click on the Internet Protocol (TCP/IP) item.
Click Properties
In the lower box, click the box beside Obtain DNS server addresses automatically
Click OK
Next
Now go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: cmd
Hit Enter.
In the command window, type, NSLOOKUP
hit enter
Please post the results
To copy the results
right click in the black window and click select all
Wow. So nice to see g-mail. Have we fixed ALL 5 of my computers? Is this permanant? Most important question - How did this happen and how can I prevent it from happening again?
Ok i checked all the computers and yes they are all working. You are amazing. I reset that router many times. Please explain how you fixed this, how it happened in the first place, and how to prevent it.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
Looks good. Have you tried any searches?