Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Server Not found, FireFox & IE randomly.not DNS


  • Please log in to reply

#106
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Looking at that file --- looks like autoplay for when you put DVD movies in your DVD Rom.

It don't look bad anyways. :)

Upload this file now:

c:\windows\system32\drivers\freedom.sys

Same place as you uploaded autoplay :)

Looks like the Freedom I was talking about .. but wanna make sure.

R3 Freedom (FREEDOM Miniport) - c:\windows\system32\drivers\freedom.sys <Not Verified; Zero-Knowledge Systems Inc.; Freedom>

Leme see your new uninstall list from Hijackthis.
Open Hijackthis> config> misc tools.
Open uininstall manager
Save list> post results.

Also new Hijackthis log please.

Thanks :)
  • 0

Advertisements


#107
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
Attached File  uninstall_list.txt   7.18KB   71 downloads

Attached File  hijackthis2.txt   7.64KB   58 downloads

and the freedom submited

Edited by harveybacon, 27 May 2008 - 10:00 PM.

  • 0

#108
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Thanks :)

I see we finally got rid of that Earthlink :)

Click start> run> type cmd and hit enter.
Type sc delete freedom and hit enter.
Should get success message.

Reboot

Delete c:\windows\system32\drivers\freedom.sys

Wal-Mart Connect <-- can you uninstall this? If not --- what error you get trying?

Question...
I see Skype stuff in your Hijackthis log.
I don't see it in your add/remove list.
Still have that app or no?

Thanks :)
  • 0

#109
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
cannot unints wal-mart, file not found. No skype app/not used.
  • 0

#110
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Open Hijackthis
Click config
misc tools
Open uninstall manager
Hilight Wal-Mart Connect
Copy/paste back here whatever is in the "uninstall command" box

Thanks :)
  • 0

#111
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
baaaaaddd.... :) freedom was necessary. I had to do a couple restore points to get back. Don't know, but I guess most of everything we've done today was reversed.


C:\Program Files\Common Files\wmshare\wmunins_us.exe

this is wal-mart connect

new hijack log:
Attached File  hijackthis3.txt   7.63KB   59 downloads

also not able to load irc chat. getting "X" image in irc frame

Edited by harveybacon, 27 May 2008 - 11:28 PM.

  • 0

#112
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
uninstall java and downloading it

works now.

Edited by harveybacon, 27 May 2008 - 11:52 PM.

  • 0

#113
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Ouch!
Interesting about that freedom driver... :)

Good to hear you got it back up & running OK.
Not all that much to re-do.
ATF.exe to clear out temps and Java cache as indicated in this post:

http://www.geekstogo...26#entry1248326

Open Hijackthis
Click "config"
Click misc tools
Click "open uninstall manager"
Hilight Wal-Mart Connect and click "remove this entry".
OK the prompt.
Click the "back" button so back at main Hijackthis screen.

Fix these entries with Hijackthis:

O4 - .DEFAULT User Startup: Earthlink.lnk = ? (User 'Default user')
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL


Or delete file "earthlink" file from here if Hijackthis won't fix it:

C:\Documents and Settings\Default User\Start Menu\Programs\Startup

No need to repeat the flush dns stuff --- I don't think that was the problem.

---------------------------------

I want to test something.
I wonder if your Hosts file is conflicting with McAfee firewall or something.
Go to this folder:

C:\Windows\system32\drivers\etc

Locate file called Hosts (no extension)
Right click it & choose "rename"
Call it Hosts.old

Now open Hijackthis
Click "config"
Click "misc tools"
Click "open hosts file manager"
Click Yes at the message regarding missing hosts file.
Exit Hijackthis.

Restart browser to take effect.

SNF ??
  • 0

#114
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
all that is done. When I reopened browser, immediately got SNF, refresh and back up.
  • 0

#115
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Ok...

Put the Hosts file back.
Delete this file:

C:\windows\system32\drivers\etc\hosts <-- no extension.

Make sure you can see all file extensions..
Open "folder options" in control panel
Click "view"
Under "hidden files and folders" have UNchecked "hide file extensions for known file types.
Apply & OK settings if you had to change em.

Back to this folder:

C:\windows\system32\drivers\etc\

Right click hosts.old and hit "rename"
Call it Hosts (no extension)
File types: All files
Then OK.
The hosts file should look like the others there --- a generic icon that windows typically shows when it dunno what to do with file.

Spybot put a bunch of sites in restricted zone for IE so lets clear that out and see what happens.
We can always put em back later.

download http://www.mvps.org/.../DelDomains.inf and place it on desktop.
Close IE
right click the file and select install, that will reset the zone settings.

Let's do this too. Won't hurt:

Download: ResetProtocolDefaults.reg
http://www.mvps.org/...colDefaults.reg

Close IE

Locate "ResetProtocolDefaults.reg"
Right-click and select: Merge (Ok the prompt)
'
REboot & test.

SNF or ... ??

Still both FF & IE doing it?

Question:

Does your firewall have a list of sites it blocks? Typically advert sites...
I ask because in the last set of screeny's you provided showed one of google ad-sense URLs.
When you refreshed after doing the screeny -- you would have been on the site you were after (I think here)
If still getting SNF --- can you try to disable the advert blocking component in your firewall then reboot & test please.

I think all this trouble is some conflict between one or more of your protection apps.
I don't think its malware. If its malware its gotta be the stealthiest one ever!!
With all the logs I made you do -- i think we're pretty safe on that end.
Just not sure what one(s) are conflicting -- so its gunna take a bit of playing around to pin-point it.
Eventually we'll find it! LOL!
  • 0

Advertisements


#116
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
Okay. Neither of the links work, and I am not sure how to disable what you wanted (blocking). I only got this firewall (mcafee) and others since I've been on Geekstogo. I only had MS firewall before. I did not change anything when all this started. It was just a random occurrence near the end of my online school.

I did not have any real-time protection when this happened. I would have restored to a point before this all started, but I didn't think of it fast enough, and the restore point was gone.

Edited by harveybacon, 29 May 2008 - 01:22 PM.

  • 0

#117
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Hi,

Links should work..
Right click> choose "save target as" > save em to the desktop.

Try those 2 files first before doing the McAfee thing.
  • 0

#118
Blender

Blender

    Malware Expert

  • Member
  • PipPipPip
  • 187 posts
  • MVP
Doing OK?

Still getting SNF errors?
  • 0

#119
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
yes I am still getting them. thanks for keeping up.
  • 0

#120
harveybacon

harveybacon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 83 posts
still have same prob. I have gotten my wisdom teeth out. Sorry I've been away. Let me know if you have any other ideas. Thanks!
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP