[newguy298]

Hey, Ultramon still does not start up on boot, however I do get a file named IcoUltraMon.ico that tries to open in Windows Picture and Fax viewer. Do you still need that log you asked for? If so I need you to tell me how/where to find it.

Also yes, through a router.I believe it is a 2WIRE, however I am not sure.

Edited by newguy298, 14 May 2011 - 02:13 PM.

[Advertisements]

OK, what I recommend then is to delete the file again and try and set the program to run on start-up through Ultramon itself. No, it's OK, the the wont actually tell us anything.

Do you have any other computers connected through the router? If so, are they having any trouble with not reaching sites?

Casey

[Casey_boy]

OK, what I recommend then is to delete the file again and try and set the program to run on start-up through Ultramon itself. No, it's OK, the the wont actually tell us anything.

Do you have any other computers connected through the router? If so, are they having any trouble with not reaching sites?

Casey

[newguy298]

I do not have any other computers at this house, I do however have an ipod touch. For some reason I cannot connect to the wifi. I tried the code(s) on the bottom of the router, and none of them worked. This leads me to believe my ipod is only showing a neighbors 2WIRE, but I am not sure. Is there any way to confirm the name of my router and/or change the password without knowing the current one? I would like to see if these sites load on my ipod.

[Casey_boy]

I think we're going to need to reset your router.

Router Reset

• Please read this: Malware Silently Alters Wireless router Settings
  
  
• Consult this link to find out what is the default username and password of your router and note down them: Route Passwords
  
  
• Then rest your router to it's factory default settings:
  
  

  "If your machine has been infected by one of these Zlob/DNSchanger Trojans, and your router settings have been altered, I would strongly recommend that you reset the router to its default configuration. Usually, this can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds)"

  
  
• This is the difficult part.
  First get to the routers server. To do that type http:\\192.168.1.1 in the address bar and click Enter. You get the log in window.
  Fill in the password you have already found and you will get the configuration page.
  Configure the router to allow you to connect to your ISP server. In some routers it is done by a setup wizard. But you have to fill in the log in password your ISP has initially given to you.
  You can also call your ISP if you don't have your initial password.
  Don't forget to change the routers default password and set a strong password. Note down the password and keep it somewhere for future reference.
  
  
• Please make sure of the following settings:
  • Go to start => Control panel => Double-click Network and Sharing Center.
  • In the left window select Manage network Connection.
  • In the right window right-click Local Area connection and select Properties .
  • Internet Protocol Version 6 (IP6v) should be checked. Double-click on it: Make sure of the following settings:
  • The option Obtain an IP address automatically should be checked.
  • The option Obtain DNS server address automatically should be checked.
  • Click OK.
  • Internet Protocol Version 4 (IP4v) should be checked. Double-click on it.[list]
  • The option Obtain an IP address automatically should be checked.
  • The option Obtain DNS server address automatically should be checked.
• Click OK twice.
• If you should change any setting reboot the computer.

==========

Please run the following command on both the computers and post the logs.

Go to start > Run copy/paste the following line in the run box and click OK.

cmd /c (ipconfig /all&nslookup mbam-cdn.malwarebytes.org&ping -n 2 mbam-cdn.malwarebytes.org&route print) >log.txt&start log.txt

A command window opens. Wait until a log.txt file opens. Please post the content to your reply.



Casey

[Casey_boy]

Hi,

Hopefully you're still with us, but if you do not reply within two days, this log will be closed as stale.

Casey

[Casey_boy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Casey_boy]

Topic re-opened at the request of the original poster.

Please follow the instructions last given and let me know the outcome.

Casey

[newguy298]

The default router password site says account suspended, and http:\\192.168.1.1 is one of the sites that does not load.

I typed cmd in to run, and ipconfig /all in to the prompt, and got that my default gateway is now 98.253.248.0? This is not normal is it?

Update: I tried entering http://98.253.248.0 but it did not load either.

I will continue this with you on Friday, sorry I keep having to go, I am only here at my grandparent's on the weekends. Just post whatever my next instructions are so that I can follow them on Friday.

Edited by newguy298, 29 May 2011 - 08:02 PM.

[Casey_boy]

Did you try resetting, there's normally a hardware button somewhere, first?

There may be some documentation to go with the router - I'd suggest having a look at that.

Casey

[newguy298]

I reset it and got this error


Repair Local Area Connection
Windows could not finish repairing the probelm because the following action cannot be completed:
Renewing your IP adress
For assistance, contact the person who manages your network.

Same sites do not load.

Also my default gateway switched to 67.162.8.1

I read something about changing the MTU size, perhaps this would help? How would I go about doing so?
^
This is where I read it http://www.cisco.com...080093bc7.shtml

Also I found out I only have a modem, no router. I ordered a wireless router from Comcast (ISP) so that I may try loading these sites from my itouch.

Here is the log



Windows IP Configuration



Host Name . . . . . . . . . . . . : Jordan

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : hsd1.il.comcast.net.



Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . : hsd1.il.comcast.net.

Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller

Physical Address. . . . . . . . . : 00-1D-09-07-D8-65

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 67.162.9.215

Subnet Mask . . . . . . . . . . . : 255.255.252.0

Default Gateway . . . . . . . . . : 67.162.8.1

DHCP Server . . . . . . . . . . . : 68.87.72.16

DNS Servers . . . . . . . . . . . : 8.8.8.8

8.8.4.4

Lease Obtained. . . . . . . . . . : Sunday, June 05, 2011 5:38:14 PM

Lease Expires . . . . . . . . . . : Tuesday, June 07, 2011 6:49:02 PM

Server: google-public-dns-a.google.com
Address: 8.8.8.8

Name: mwbyte.vo.llnwd.net
Addresses: 208.111.168.7, 208.111.168.6
Aliases: mbam-cdn.malwarebytes.org



Pinging mwbyte.vo.llnwd.net [208.111.168.7] with 32 bytes of data:



Destination host unreachable.

Destination host unreachable.



Ping statistics for 208.111.168.7:

Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 1d 09 07 d8 65 ...... Broadcom 440x 10/100 Integrated Controller - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 67.162.8.1 67.162.9.215 20
67.162.8.0 255.255.252.0 67.162.9.215 67.162.9.215 20
67.162.9.215 255.255.255.255 127.0.0.1 127.0.0.1 20
67.255.255.255 255.255.255.255 67.162.9.215 67.162.9.215 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
169.254.0.0 255.255.0.0 67.162.9.215 67.162.9.215 20
224.0.0.0 240.0.0.0 67.162.9.215 67.162.9.215 20
255.255.255.255 255.255.255.255 67.162.9.215 67.162.9.215 1
Default Gateway: 67.162.8.1
===========================================================================
Persistent Routes:
None

Edited by newguy298, 05 June 2011 - 05:19 PM.

[Casey_boy]

Hi newguy298,

Many apologies for the delay! I did not receive an email to say that you'd replied. In future, if I haven't replied within two days then please send me a PM.

Repair Local Area Connection
Windows could not finish repairing the probelm because the following action cannot be completed:
Renewing your IP adress
For assistance, contact the person who manages your network.

So I've just Googled this and found something we can try:

Open Services:
Start > Run > Type: services.msc > Click OK > Scroll down to and double click DNS Client > Set to Automatic under Startup type > Click the Apply button > Click the Start button > When it starts click OK.

Do the same for DHCP Client.
Do the same for Remote Procedure Call (RPC).

Also my default gateway switched to 67.162.8.1

That's fine - it checks out as a Comcast IP.

I read something about changing the MTU size, perhaps this would help? How would I go about doing so?

No, I don't think so. It seems some sites might drop out because of this, but this isn't a widespread problem and the major sites certainly wouldn't be affected.

Casey

[newguy298]

All of these were already set to automatic. I received a wireless router from Comcast today, and attempted to install it. After a few issues I got it working, but the Netgear installation will not complete. It tells me

"No Adapter No working network adapter was detected.



The Ethernet adapter is either disabled or no Ethernet adapter is installed on this Computer. Either enable or add an Ethernet adapter and run the application again.

Click Re-try to retest for a working adapter, or click Exit to run this on a computer with a working adapter. "

What should I do next? The sites do load from my ipod with the wireless router, which leads me to believe it is either the computer's fault, or the modem/router's access settings with this computer. Thanks for your time.

[Casey_boy]

It might be worth trying to reinstall your Ethernet driver. We're straying to the edge of my knowledge here (I haven't used XP in a long time) and I'm pretty sure you're malware free (we're just dealing with the consequences of it).

I think this is your driver: http://download.cnet...2_4-176199.html but I would first try updating your driver through Device Manager, details here: http://www.ehow.com/...windows-xp.html

Casey

[newguy298]

Neither of these websites will load for me. Interesting. How do I find my driver for ethernet so that I can look for a mirror?

Also, every time I attempt to connect to irc.rizon.net through icechat, it takes a few minutes, whereas it used to take only about 6 seconds or less. This happened some time after the websites stopped working, not right away. I think this happened around the time I first tried changing my DNS address, I have changed it back to normal a few times. Every now and again every site will stop loading, or will load slowly, usually after I change it back to the top one being 8.8.8.8 and bottom being 8.8.4.4, or from that to automatic, it changes it back to the state it is in now. This usually happens after trying to fix that new router that I got.

Edited by newguy298, 11 June 2011 - 08:37 AM.

[Casey_boy]

I used this from your previous post:

Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller

From ehow:

Right-Click MY COMPUTER.

Click MANAGE.

Highlight DEVICE MANAGER.

Choose the hardware category your hardware relates to and click the + symbol next to it.

Now Right-Click the specific device you would like to install the driver for and click PROPERTIES.

Click the DRIVER tab located at the top of window.

Click UPDATE DRIVER and browse to location where driver files reside. This will install a new driver or update an existing driver for your H/W.

At times, you will see devices in the UNKNOWN DEVICES category. Devices here are hardware recognized by windows, but have no existing drivers installed. It is the same procedure to install drivers for these devices as mentioned in STEP 7.

Read more: How to install drivers in windows XP | eHow.com http://www.ehow.com/...l#ixzz1OyjTXPSV

You're looking for an Ethernet adapter in your network adapters section.

Casey