Curse

jjdefan · Jun 03, 2008, 03:05 PM // 15:05

Quote:

Originally Posted by Chthon

After a full reformat and reinstall, that virus should be totally dead. That leaves the DSL people as the source of the connectivity problem. Keep after them.

It could also be a hardware issue. It could very well be something wrong with his network adapter and/or associated drivers.

Painbringer · Jun 03, 2008, 03:06 PM // 15:06

Ok one last tidbit for any networking Guru could be barking up the wrong tree but what the heck

If I go to Control Panel double click on Network Connections I show 2 different Connections Local Area and another one can’t think of name

Checking Status I have Packets from Local Connection that are 1000 range down to 100

The other connection has 0/0

(I use Charter Cable for Internet)

At work (different system different computer the packets are 308,000 / 324,000)

Not sure if this means anything?

I disconnected the Ethernet cord and reconnected I was able to restore my anti-virus (This was a pretty quick download?) but browsing still has long waits on page loads etc. Guild wars would not download for me it timed out.

I also did some more CMD prompt pings Google 4 for 4 / yahoo 4 for 3 / guild wars 4 sent 0 replys / Ebay 4 for 0 / MSN 4 for 2

Could a bad Ethernet cord be to blame?

After my system restore I noticed my D drive has a new name called RECOVERY Could that little virus still be in there?

jjdefan · Jun 03, 2008, 04:09 PM // 16:09

Quote:

Originally Posted by Painbringer

Ok one last tidbit for any networking Guru could be barking up the wrong tree but what the heck

If I go to Control Panel double click on Network Connections I show 2 different Connections Local Area and another one can’t think of name

Checking Status I have Packets from Local Connection that are 1000 range down to 100

The other connection has 0/0

(I use Charter Cable for Internet)

At work (different system different computer the packets are 308,000 / 324,000)

Not sure if this means anything?

I disconnected the Ethernet cord and reconnected I was able to restore my anti-virus (This was a pretty quick download?) but browsing still has long waits on page loads etc. Guild wars would not download for me it timed out.

I also did some more CMD prompt pings Google 4 for 4 / yahoo 4 for 3 / guild wars 4 sent 0 replys / Ebay 4 for 0 / MSN 4 for 2

Could a bad Ethernet cord be to blame?

After my system restore I noticed my D drive has a new name called RECOVERY Could that little virus still be in there?

My guesss is your second connection is a 1394 connection which is Firewire. It's good that your machine is using Local Area and not that one. The packets are telling you how much information has been sent/received through the connection. The numbers you have listed are not good. You can try using a different network cable and see if that helps, you can pick them up just about anywere for just a few dollars.

I think I recall you saying that your internet provider checked their infrastruction for problems and saw nothing abnormal and they probably said they could see your modem. That tells me that from one side of the modem out, things are good. That leaves stuff from the network connection side of the modem to your computer as the culprit. As stated you can try a new network cable from the modem to your network card.

I would start with a fresh copy of the network adapter's drivers. Find a computer you can use to download them from the manufacturer's site (http://www.emachines.com/support/pro...es&model=T6524) and then uninstall the device (not physically) just using device manager. Then reinstall and force the system to install the new ones you downloaded. If that doesn't solve your issues, then that leaves few options.

At that point it is either the Modem, the network adapter or the motherboard. It appears that your adapter is integrated with the motherboard, so you can't try moving to a different slot. I would try using a different network adapter, again easy to find and not to expensive. Your last option would be the modem, they can be fairly expensive and it will require another phone call to your provider to register it. If none of these options work, then I am at a loss and maybe someone else can give some ideas.

Chthon · Jun 03, 2008, 04:22 PM // 16:22

Quote:

Originally Posted by jjdefan

It could also be a hardware issue. It could very well be something wrong with his network adapter and/or associated drivers.

I would assume that, since it was working before, the hardware probably did not just happen to go faulty at the same time he reformatted. Drivers are a more likely issue, but windows tends to be able to install a network card just fine without the user's assistance.

Quote:

Originally Posted by jjdefan

I think I recall you saying that your internet provider checked their infrastruction for problems and saw nothing abnormal and they probably said they could see your modem. That tells me that from one side of the modem out, things are good. That leaves stuff from the network connection side of the modem to your computer as the culprit.

You are wrong in assuming that (1) the ISP people were competent enough to detect a problem on their end if it existed, and (2) the ISP people care enough to be bothered to fix a problem when they can just as easily ignore it by saying "it must be on your end." In my experience, both of those assumptions are usually wrong.

jjdefan · Jun 03, 2008, 07:07 PM // 19:07

Quote:

Originally Posted by Chthon

I would assume that, since it was working before, the hardware probably did not just happen to go faulty at the same time he reformatted. Drivers are a more likely issue, but windows tends to be able to install a network card just fine without the user's assistance.

You are wrong in assuming that just because it worked before it has to now. Electronics fail, and yes, sometimes with no apparent reason. I was only pointing out that there are still other possibilities for the connectivity issues. The OP could just as easy sit there and say, it was working before so it can't be my equipment, it has to be the service provider.

I do however agree with you that drivers are a more likely culprit than anything else, hence the reason I provided a link to the site to get a separate copy. The rest of the information is there for things to look at if drivers do not work. If Painbringer can get his sister to hook up to his connection, it would be a definitive test of the providers connectivity.

lakatz · Jun 04, 2008, 03:12 AM // 03:12

Quote:

Originally Posted by Painbringer

After my system restore I noticed my D drive has a new name called RECOVERY Could that little virus still be in there?

http://www.tech-recipes.com/windows_tips8.html

Tarun · Jun 04, 2008, 03:57 AM // 03:57

The above link may be good if none of your previous restore points work, but if you're just trying to remove an infection it's easier to make a new "Clean OS" restore point and then use the Disk Cleanup to remove the old system restore points. It lets you remove all except the most recent. In the case mentioned earlier in my post, this would be the new, clean OS point you made.

Lord Sojar · Jun 04, 2008, 04:11 AM // 04:11

Yes, most viruses and worms are programmed to embed themselves in the system restore files, so when you do a restore in a panic, the virus actually makes the infection worse. Evil little buggers.

lakatz · Jun 04, 2008, 05:05 AM // 05:05

Quote:

Originally Posted by Rahja the Thief

Yes, most viruses and worms are programmed to embed themselves in the system restore files, so when you do a restore in a panic, the virus actually makes the infection worse. Evil little buggers.

I was thinking it had to do with the fact system restore is stupid and can't tell a viral invasion from a software install and makes a backup of the virus/worm and a new restore point just like it does for every new software install. Betcha a nickel that one of his restore points is the precise moment the bug entered his system. It's seemed very possible to me that he's still got the virus/worm/hijacker by the way his system is acting.

Painbringer · Jun 04, 2008, 02:45 PM // 14:45

If you are talking about turning the Windows system restore off then running the system in safe mode and then running the virus checker with the modem shut off I did this. Many times I ran both full system scans from Norton and also a special Vundo designed removal Tool I ran both over and over in safe and normal mode ran at least 4 times in both settings. Before I reinstalled the sytem again.

I wonder if I had a hardware fail do to all the activity I have put my system through in the last few weeks. At least I really hope it is something like this.

I am really hoping this will tell someone what is wrong I found a network tester in Windows XP Media edition

I ran it and found a fail

DHCP Server Fail (hesitant to give the full description may contain hackable material)

There are no options except to save a log from this

Again Devise Manger of course says the card is fine so I am wondering if this makes any sense to any one.

Again it was almost like a light switched reduced (slower) internet then it went to almost stopped
when it was slow and the virus was doing its thing the hardrive was whirling but now its not.

lakatz · Jun 04, 2008, 04:19 PM // 16:19

Sounds like you found a backdoor on your system?
http://www.sophos.com/security/analy...w32rbotpr.html click on the "more information" tab.

Try turning off DHCP Server and see how that works. Also if I were in your shoes, I'd educate myself thoroughly about the backdoor (and it's extended family) that I found on my system and how to clean it properly. Often, once they've turned your system into a 'server,' they invite their friends in.

EDIT: The more I read about backdoors, the more I understand how difficult they are to detect and clean. For instance, I was reading up on the Brontok family and it says they automatically close or terminate any program with the following name: Registry, Command Prompt, System Configuration, Anti-virus programs (etc: AVG, Avast, Trendmicro) and other specific names including Process Explorer. I imagine, for obvious reasons, that can be said about most backdoors.

The Way Out · Jun 04, 2008, 04:30 PM // 16:30

Quote:

Originally Posted by Tarun

So, I started reading this post to see what was going on and try to find the issue. I only got as far as:

That right there is your biggest problem. In fact, it's probably the entire problem. Get rid of Norton/Symantec products. Uninstall them COMPLETELY.

You'll need SymNRT to fully remove everything. It'd be a good idea to use Dial-a-fix after you've used SymNRT to remove Norton, that way anything that Norton broke during uninstall/removal (like Windows Updates, SSL, etc.) can get repaired.

You can use avast which is free and does far better than Norton.

I am agreeing with Tarun. However, here is a good link. Run this and tell me how things work out for you.

http://www.snapfiles.com/get/winsockxpfix.html

Cheers!!!

Chthon · Jun 04, 2008, 05:16 PM // 17:16

Backing up a minute, just to be clear, when you said you "reformated," did you do a total reformat (that deleting everything on the drive) or did you just reinstall windows over the top of itself?

Tarun · Jun 04, 2008, 05:21 PM // 17:21

LSPFix can also resolve issues with Winsock.

The Way Out · Jun 04, 2008, 05:28 PM // 17:28

Quote:

Originally Posted by Chthon

Backing up a minute, just to be clear, when you said you "reformated," did you do a total reformat (that deleting everything on the drive) or did you just reinstall windows over the top of itself?

Sounds like he punted his system. Good thing too, he will get better performance out of it.

Painbringer · Jun 04, 2008, 05:33 PM // 17:33

Quote:

Originally Posted by Chthon

Backing up a minute, just to be clear, when you said you "reformated," did you do a total reformat (that deleting everything on the drive) or did you just reinstall windows over the top of itself?

When I saw D marked as recover I am questioning myself as well. (Would it not say D: Drive Just like C: Drive) But I have never done one in XP May have clicked hasty i was in a bad mood at the time

The Way Out · Jun 04, 2008, 05:36 PM // 17:36

Quote:

Originally Posted by Painbringer

When I saw D marked as recover I am questioning myself as well. (Would it not say D: Drive Just like C: Drive) But I have never done one in XP May have clicked hasty i was in a bad mood at the time

When you did a format, what were the steps you took? Sounds like you booted off of a recovery partition and did a generic restore, keeping all of your files and settings.

Painbringer · Jun 04, 2008, 05:38 PM // 17:38

popped in restore windows disk shut off and turned it on there was two options. Maybe i should do it again ?

I have done other ones and remeber a reformat process that takes a bit of time don't remember one this last time

The Way Out · Jun 04, 2008, 05:42 PM // 17:42

Quote:

Originally Posted by Painbringer

popped in restore windows disk shut off and turned it on there was two options. Maybe i should do it again ?

I have done other ones and remeber a reformat process that takes a bit of time don't remember one this last time

First, do you have your files backed up? Second, if not, back them up to DVD or CD. Third, do a factory restore (or Destructive restore). That will get your back to factory settings.

Painbringer · Jun 04, 2008, 05:53 PM // 17:53

Quote:

Originally Posted by The Way Out

First, do you have your files backed up? Second, if not, back them up to DVD or CD. Third, do a factory restore (or Destructive restore). That will get your back to factory settings.

I will try this again I save the important stuff to a CD before the initial recovery

What if when I am done I still have the problem with the internet
Run the Winsock tool?