Cannot connect to the internet *via browser

Macers

Hi guys,

Updating a laptop for a friend.

About a 4 year old PB Easynote MX running Vista.

It had never been on the internet prior to today. I set it up to my Wifi to update Windows etc. Can download updates et.c and MSE can download updates also.

However, if I try to connect to the net via IE or FF I keep getting 'Internet Explorer cannot display the webpage' (and FF with equivalent). I changed the DNS setting to OpenDNS with no joy and Windows Firewall doesn't seem to be blocking anything.

Anyone got any suggestions? Head wrecked

Opinicus

Might be in no way connected to your problem. I had a virus/trojan a few weeks back and it changed my connection settings in all my browsers to "use a proxy". I changed it to "Automatically detect". Worked perfect afterwards.

Eoinite

Silly question but is the browser in offline mode?

Macers

Auto Detect is on.

I downloaded Malware AB on a USB and installed it (I can't update it) but even now it has found 15 objects.

Could be a virus after all...strange since it was never connected to the net.

Will do a few passes of MSE, MAB and Spybot and see it that cures it.

Macers

Eoinite wrote: »

Silly question but is the browser in offline mode?

No - same result with IE and FF - both cannot connect

pickarooney

Can you ping www.google.ie ?

Macers

pickarooney wrote: »

Can you ping www.google.ie ?

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Whats strange is when I type in google.ie - it comes back address is not valid - ([url]http:///[/url])

bhickey

Macers wrote: »

Will do a few passes of MSE, MAB and Spybot and see it that cures it.

How did these go?

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

When you tried to ping www.google.ie, did it resolve the address, i.e. did it first say something like this :

Pinging www.l.google.com [209.85.143.99] with 32 bytes of data:

Macers

bhickey wrote: »

How did these go?



When you tried to ping www.google.ie, did it resolve the address, i.e. did it first say something like this :

Pinging www.l.google.com [209.85.143.99] with 32 bytes of data:

Hi,

Apologies - it did pinged like you said but with slightly different IP address.

Done the scans in Safe Mode. MAB got 22 objects - a few trojans, MSE (ran after MAB) got nothing and Spybot cannot run as I cannot update the definitions.

Thanks for the suggestions so far

bhickey

Macers wrote: »

Apologies - it did pinged like you said but with slightly different IP address.

That's fine, the IP address does actually change - as long as it returns something that's the main thing.

Done the scans in Safe Mode. MAB got 22 objects - a few trojans, MSE (ran after MAB) got nothing and Spybot cannot run as I cannot update the definitions.

So Malwarebytes has removed some stuff already? Can you post the log?

Macers

bhickey wrote: »

That's fine, the IP address does actually change - as long as it returns something that's the main thing.



So Malwarebytes has removed some stuff already? Can you post the log?

Erm...I left it scanning overnight. First thing I did this this morning was remove the objects and restart in normal mode...sorry. Will do another scan now and see what it throws up

bhickey

Macers wrote: »

Erm...I left it scanning overnight. First thing I did this this morning was remove the objects and restart in normal mode...sorry. Will do another scan now and see what it throws up

Go into Malwarebytes and click on <logs>. Then double-click on the relevant log and copy/paste the contents.

Macers

bhickey wrote: »

Go into Malwarebytes and click on <logs>. Then double-click on the relevant log and copy/paste the contents.

Totally forgot about that sorry...too early on a Sunday morning

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5363

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

15/01/2011 23:42:15
mbam-log-2011-01-15 (23-42-15).txt

Scan type: Quick scan
Objects scanned: 128426
Time elapsed: 7 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 18
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Mary\favorites\antivirus scan.url (Rogue.Link) -> Quarantined and deleted successfully.
c:\Users\Mary\documents\my documents.url (Trojan.Zlob) -> Quarantined and deleted successfully.
c:\Users\Mary\documents\my pictures\my pictures.url (Trojan.Zlob) -> Quarantined and deleted successfully.
c:\Users\Mary\documents\my videos\My Video.url (Trojan.Zlob) -> Quarantined and deleted successfully.

bhickey

Macers wrote: »

Totally forgot about that sorry...too early on a Sunday morning

No worries. So is the computer still behaving the same way? One thing you can try (in 'Safe Mode with Networkin') is to run 'rkill' first just before running Malwarebytes. Rkill kills know processes that might might prevent Malwarebytes detecting certain infections.

Also to speed up the scans, download and run TFC first. This will clear all sorts of junk and temporary files from the computer and so the scans will have a lot less work to do.

Make sure you update Malware bytes too before scanning, then run 'rkill' and then do a full scan with Malwarebytes.

Macers

bhickey wrote: »

No worries. So is the computer still behaving the same way? One thing you can try (in 'Safe Mode with Networkin') is to run 'rkill' first just before running Malwarebytes. Rkill kills know processes that might might prevent Malwarebytes detecting certain infections.

Also to speed up the scans, download and run TFC first. This will clear all sorts of junk and temporary files from the computer and so the scans will have a lot less work to do.

Make sure you update Malware bytes too before scanning, then run 'rkill' and then do a full scan with Malwarebytes.

Thanks for that - I cannot update MAB - definitions are 26 days old (so I'm told) but get an error message (same one I get with Spybot). I will try what you have said and report back ASAP.

Thanks for your help again

CSU

could you post the results of

ipconfig /all

Im guessing there's something messed up in your net config, is the router set to DHCP server?

Have you tried renewing the card ip address?

Go and get Comodo - it's pretty good at sorting these things out.

IrishB.ie

Op, if you can ping successfully but cannot browse, it may be that your Winsock settings have become corrupted.

Try this.

Macers

Comodo doesn't seem to have done anything.

IrishB - tried that but the ctrl-shift-enter prompt doesn't seem to work (even though I am an admisitrator). Keep getting 'The requested operation requires elevation'

quaidox

should the wireless adapter settings not have a default gateway set?

IrishB.ie

Macers wrote: »

IrishB - tried that but the ctrl-shift-enter prompt doesn't seem to work (even though I am an admisitrator). Keep getting 'The requested operation requires elevation'

Elevate the command prompt by: right-click on the Command Prompt shortcut and then choose 'Run as administrator'.

quaidox is correct about that screenshot. Your network adapter should have a default gateway and should not be using an IP address of 169.254.*.* That IP states that you are not connected to the wireless network.

quaidox

plus your ip address is an APIPA address, so it's not getting an IP address from the router.

pickarooney

What do you get from typing firefox 209.85.143.99 from the command prompt?
Are you using a wireless connection to a router or a 3G dongle?

Macers

pickarooney wrote: »

What do you get from typing firefox 209.85.143.99 from the command prompt?
Are you using a wireless connection to a router or a 3G dongle?

Hi guys,

Sorry about the delay - she needed he laptop back for college work so had to return it. Have it back now though...

Its a Belkin router plugged into an Eircom Netopia router.

How do I change the default gateway on the router? All other laptops, PCs, iPhones etc can connect to the router perfectly for last 4 years with no issues.

'Firefox is not recognized as an internal or external command, operable program or batch file' - Firefox is definitely is installed though...

Macers

Any ideas anyone?

bonzodog2

I would try
ipconfig /release
ipconfig /renew
restarting laptop and router
check router's config for DHCP address pool size (from another pc)

Any special reason why you have 2 routers ?

imran101

Uninstalled browser, then reinstalled and check if Not working then use these DNS
208.67.222.222
208.67.220.220

softdancomputer

network adapter properties --> tcp/ip4 --> obtain an IP address automatically and obtain dns server address automatically

chin_grin

I've had a few cases where the HOSTS file was f*cked. (Couldn't delete or create a new one). Would that be the culprit?

Macers

softdancomputer wrote: »

network adapter properties --> tcp/ip4 --> obtain an IP address automatically and obtain dns server address automatically

Done and no change...

Macers

bonzodog2 wrote: »

I would try
ipconfig /release
ipconfig /renew
restarting laptop and router
check router's config for DHCP address pool size (from another pc)

Any special reason why you have 2 routers ?

I only have 1 router..?

bonzodog2

Macers wrote: »

Its a Belkin router plugged into an Eircom Netopia router.

That sounds like 2 to me

Macers

bonzodog2 wrote: »

That sounds like 2 to me

Lol well ye - it's a none wireless Netopia modem with a Belkin wireless router plugged into it