[smtzl]

I had a topic open in the Malware section and was getting help from Gammo. He directed me to go start a new topic in this section.

After clearing the Malware I cannot connect to the internet. Strange thing is I can't ping google.com or yahoo.com (can’t find the host), but I get a reply from the google IP / yahoo IP address no problem.

Any help would be appreciated.

[Advertisements]

I have read some of your Malware thread.

In view of the fact that the cmd netsh etc. has been tried without result

I recommend you download and run this

http://www.snapfiles...nsockxpfix.html

That is WinsockFix
NOTE please the Blue coloured Download panel to the right - NOT the download below the descritption of the utility., which if you look carefuly you will see is Run a free scan for windows errors - do NOT run that one please.

[Macboatmaster]

I have read some of your Malware thread.

In view of the fact that the cmd netsh etc. has been tried without result

I recommend you download and run this

http://www.snapfiles...nsockxpfix.html

That is WinsockFix
NOTE please the Blue coloured Download panel to the right - NOT the download below the descritption of the utility., which if you look carefuly you will see is Run a free scan for windows errors - do NOT run that one please.

[smtzl]

I wish it was that easy.

I have ran WinsockFix before with no luck. I downloaded it again today and ran it and no luck again.

I am still thinking it might be a registry problem. After removing the malware I had to repair a part of the registry for the laptop to even get an IP address since some of the services were damaged.

A few days ago, I and used System Restore to go back to a date before the malware incident and had no luck. Would that not reset the registry to good settings? Maybe I need to try the original registry settings from the time XP was installed.

What else could it be? A corrupted XP driver? I tried "sfc /scannow" a few times but it din't seem to help.

[Macboatmaster]

1. I never read that you had run WinsockFix.
I did read that you had at cmd prompt run the netsh cmd

PLEASE list ALL you have TRIED.

2.

After removing the malware I had to repair a part of the registry for the laptop to even get an IP address since some of the services were damaged.

Please understand that I am NOT being pedantic, but do you mean YOU, after LEAVING my colleague in the Malware forum or DO YOU mean whilst in the forum.

3.

A few days ago, I and used System Restore to go back to a date before the malware incident and had no luck

Not a good decision, in my opinion, as of course, if that restore point was in any respect corrupted - it is back on the system files.

I have NO knowledge of Malware and ONLY Staff members qualified in that regard may deal with such matters on GeesktoGo.
I will check with the Malware expert who was assisting
NOTE PLEASE I have now checked with Gammo who assisted you in the Malware forum and he has advised that this should be OK

4. Boot to Safe Mode with Networking - TRY there please.

5. Go Control Panel User Accounts, establish a new user account and try that please.

[smtzl]

No problem. Let me explain.
I have been trying to fix this laptop since the end of December, in my spare time, so I don’t exactly remember all the things I tried.

Before I got involved in the forum I managed to clean out the Malware. The laptop would not establish an IP address so after some more troubleshooting I found some of the services were missing or not starting. I tracked it down to damaged registry files. Afterwards, the system would get an IP address and ping other IP’s but I could not get on the internet.

So I figured maybe I didn’t get all the Malware and I signed up and posted a topic in the Malware forums. After a few weeks of that with no clear resolution, I have been directed to post a new topic in this forum. So here I am.

Ok, I used System Restore to go back to the latest save point.

I tried Safe Mode with Networking with no luck. I also created a new user with Admin privileges and no luck connecting.

[Macboatmaster]

If you are using IE, go Start, programs, accessories, system tools and start IE from there NO Add-ons.

If you are using Firefox, open Firefox and then click Help and then click on restart in Safe Mode.

TRY those please.

If that does not work we will when I return about 1800 look at the HOSTS file
IF you wish to proceed , establish a restore point first and then run the FIX IT
http://support.microsoft.com/kb/972034

[smtzl]

Well the hosts file did not even exist, just backups of it. The Microsoft tool created a new hosts file. Then I ran WinsockFix again.

I also tried the explorer with no add-ons and firefox in safe mode with no luck.

Also in windows safe mode I ran msconfig and disabled non-microsoft services and all programs to see if they were blocking the internet with no luck.

Internet explorer still keeps saying up:

WinSock status

info Error attmpting to validate the Winsock base providers: 2
error Not all base service provider entries could be found in the winsock catalog. A reset is needed.
info Redirecting user to support call


HTTP, HTTPS, FTP connectivity

warn HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved
warn HTTPS: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved
warn FTP (Passive): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved
warn HTTP: Error 12007 connecting to www.hotmail.com: The server name or address could not be resolved
warn HTTPS: Error 12007 connecting to www.passport.net: The server name or address could not be resolved
warn FTP (Active): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved
error Could not make an HTTP connection.
error Could not make an HTTPS connection.
error Could not make an FTP connection.

[Macboatmaster]

Start
Run
Reset WINSOCK entries to installation defaults: type
netsh winsock reset catalog
key enter
Wait for response

Reset TCP/IP stack to installation defaults type.
netsh int ip reset reset.log
key enter
wait for response.
type
exit
key enter
REBOOT the computer

then try please.

[smtzl]

Did not work.

I wonder if there are other files missing or corrupted, that are required for me to get on the internet.

[Macboatmaster]

Cannot rememeber now if you have already done this in the Malware forum, go Device Manager click the View tab, click to show hidden devices. Is there any wanring please - TCP/IP protocol driver. or indeed anything else.

1. How are you connected - wireless or ethernet.
If wireless and you can try ethernet.

2. If wireless check that you are NOT using both the wireless adaptor software AND Windows Wireless Zero configuration
If you are disable one of them

3. Uninstall and reinstall the wireless adaptor do not allow windows to reinstall the driver automatically but obtain it from the appropriate place and use that driver on the manual install
Do the same with the eithernet connection. if applicable

4. Reset the modem/router

5. If IE click tools, click connections, click LAN and check that automatically detect settings is checked and that you are not using a proxy server - unless of course you know you are going in through a server.

6. On the adaptor in network connections, click properties and click TCP/IP in the small window then click properties on that window and check that IP address and DNS are both checked automatic.

7. On IE Tools Internet options, advanced tab - reset all to default

8. Cmd prompt
type
ipconfig /release
key enter

ipconfig /renew
key enter

9 .

• Click Start, click Run, type Msinfo32, and then click OK.
• Expand Components, expand Network, and then click Protocol.
• You will have ten sections under Protocol. The section headings will include the following names if the Winsock2 key is undamaged:
• MSAFD Tcpip [TCP/IP]
• MSAFD Tcpip [UDP/IP]
• RSVP UDP Service Provider
• RSVP TCP Service Provider
• MSAFD NetBIOS [\Device\NetBT_Tcpip...
• MSAFD NetBIOS [\Device\NetBT_Tcpip...
• MSAFD NetBIOS [\Device\NetBT_Tcpip...
• MSAFD NetBIOS [\Device\NetBT_Tcpip...
• MSAFD NetBIOS [\Device\NetBT_Tcpip...
• MSAFD NetBIOS [\Device\NetBT_Tcpip...

If the names are anything different from those in this list, the Winsock2 key is corrupted, or you have a third-party add-on, such as proxy software, installed. If you have a third-party add-on installed, the name of the add-on will replace the letters "MSAFD" in the list.

If there are more than ten sections in the list, you have third-party additions installed.

If there are fewer than ten sections, there is information missing


TAKE each step in turn please, rebooting and retrying after each.

[smtzl]

1. How are you connected - wireless or ethernet.
I have tried both wired and wireless.

I reinstalled the wired connection driver before with no luck.

4. Reset the modem/router
Did not help.

5. If IE click tools, click connections, click LAN and check that automatically detect settings is checked and that you are not using a proxy server - unless of course you know you are going in through a server
Tried both auto and not auto with no luck.

6. On the adaptor in network connections, click properties and click TCP/IP in the small window then click properties on that window and check that IP address and DNS are both checked automatic.
Both auto.

7. On IE Tools Internet options, advanced tab - reset all to default
I tried the internet explorer steps and no luck. I don’t think it’s an IE problem since Chrome and FireFox won’t connect either.

9 .Click Start, click Run, type Msinfo32, and then click OK.

[b]I have twelve sections under Protocol. Two extra “MSAFD NetBIOS [\Device\NetBT_Tcpip...”.

I should mention that this laptop had an older version of IE and I installed IE 8 a few weeks ago. Even though I can’t get on the internet the IE setup file somehow managed to get to a Microsoft server and download IE 8. But something like Malwarebytes Anti-Malware gets blocked trying to download an update. Weird.

[Macboatmaster]

1. go start
run
type cmd
when that opens type
ipconfig /all > C:\ip.txt

That will place a txt. file on the root of C drive.
Open it please and copy and paste.


2. What anti--virus and firewall are you using please.

3.

Cannot rememeber now if you have already done this in the Malware forum, go Device Manager click the View tab, click to show hidden devices. Is there any wanring please - TCP/IP protocol driver. or indeed anything else

From my last post - have you please.

4.see this please
http://support.microsoft.com/kb/811259

I know you have service pack2 but please try the method on here as though you do not have the SP2.
My thinking behind this is that the problem you had previously is not allowing the normal reset to work.

5.
See my screenshot please and check that your settings are the same,
[attachment=56084:untitled.JPG]

In otherwords on this one ABOVE you do NOT have NetBios OVER TCP/IP

[attachment=56085:untitled1.JPG]

and on this one above you DO have append primary and connection specific DNS

[smtzl]

1)
Windows IP Configuration

Host Name . . . . . . . . . . . . : kristy
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller
Physical Address. . . . . . . . . : 00-26-18-58-2B-83
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.101
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 24.217.0.5
24.217.201.67
24.247.15.53
Lease Obtained. . . . . . . . . . : Monday, February 13, 2012 5:55:03 PM
Lease Expires . . . . . . . . . . : Tuesday, February 14, 2012 5:55:03 PM

2) Just using windows firewall. I had a few different free anti-virus on here (used to scan for malware when it got infected) but currently they are all uninstalled.

3) The only issue under device manager (with show hidden devices) is the "serial" has a yellow exclamation point.

4)I used the Microsoft "Fix it" (did not work) and then followed the steps and deleted the winsock and winsock2 registry files and created new TCP/IP protocol. No luck again. Frustrating because this is about the third time I tried this step.

5) The setting are exactly like your screen shots.

Ugh. I bet there is one file corrupted or a line of code missing somewhere preventing the internet from working. If I had an XP cd for this laptop I would of wiped it by now.

[Macboatmaster]

Try at a cmd prompt
ipconfig /flushdns

key enter

ipconfig /registerdns

key enter

If that does not work try this
go control Panel
Network Connections
right click on the network adaptor
click properties
in the window scroll to TCP/IP
highlight it and click properties
You said that both IP address and DNS were obtain automatically.
Verify please that is the case.
Click the advanced button.
Click the DNS tab
Are there any DNS server addresses listed in the top box in order of use.
If so make a note of them exactly please.
Now return to the first window, the one before you click the advanced button.
On the lower section DNS
click to check use the following DNS server addresses
In the two boxes you will then see that you have four allocated spaces.
In the top one type
8.8.8.8
In the lower one type
8.8.4.4
Click OK
and then exit all open windows with Apply and Ok as necessary.

REBOOT the computer.


Try now please.

[smtzl]

Ahh the old Google DNS trick. No luck.


There were no other DNS addresses listed in the DNS tab. DNS fulsh did not work also.