Where to begin waves of pain (any suggestions)

Where to begin (any suggestions)

Three weeks ago I was surfing GW guru when there was errors on the page (some of you may still see this ad errors or something) anyway I blindly clicked to get to the forums which was a big mistake. I must have click on an ad banner. I had windows prompt me stating I had an error on my system click here to resolve. Mislead by the perfect looking Windows error prompt….like a fool I clicked. This is where the first set of problems began. While on the internet Windows started to open on there own and my system started to lag while surfing the internet.

I run Norton and update my protection all the time. Three days later and 2 full system scans and many other checks my system finally caught a Trojan Vundo. The software would remove it and after you would reboot and log on again it would catch another copy (a vicious circle of repair reboot repair reboot). I searched the net for other removing tools and finally found one. Downloaded it ran it and nothing. So I have ran scans (with system restore off and in safe mode also disconnected from the internet at least 10 times in the last 2 weeks) during this time Guild Wars ran fine with no real change in lag at least nothing I noticed. This changed on Friday 05/30/08. I logged in and nothing… I could not get past the Character Screen. It would sit on the loading screen and then time out. I refreshed my IP connection following the suggestions from the help prompts and from there own I have kind of a wave issue (ping goes from 2000 or higher range down to 100 and back and forth back and forth makes it impossible to play). Frustrated I gave up and looked again to catching this virus that plagued my system. Well the special tool I downloaded finally caught it and removed it.

I was happy and ran the tool twice to make sure it was gone and no virus found. Great... I finally caught it this is great I thought to myself. Rebooted and pulled up GW and no change to the new lag problem. Waves of fast then slow. Also at the same time the internet would barely pull up a page. Half the time I would get time outs. I even changed my web browser from explorer to fire fox to see if I got improvements and unfortunately no. Frustrated thinking this is still the virus at work I did a full system restore a cleansing process more for myself a start from scratch approach. Yes I was pissed and went to extreme measures but I had a system that could not access the internet or the game I play on my free time all the time.

Loaded my system to factory settings and was starting the download process to load my virus software and no change #$^%$&% I timed out of the downloader. Over and over. Ok now what.

I called my DSL provider and was on the phone with them for over an hour. They show no problems in my area. ( I also have cable with them and it is fine) We reset my IP address. We pinged sites from the command prompt (sent 4 pings and received 4 replies from Google) (sent 4 pings and received 2 reply from Yahoo) and another site sent 4 pings and got 2 replies). We tested my modem and it seemed fine with good readings. We disabled the driver on the Ethernet Card and rebooted to restore and no changed in performance. (Even ran checks in safe mode). The devise manger reports no problems. My provider can send someone out to check the lines to my house for a charge. But that is all they can help with. Since I have no issues with cable I am assuming this is a waste to have them check it out.

I am far from an expert in this area and at my wits end. Any ideas? On what to do? I do not have another computer at home otherwise I would have tested the connection.

Older computer from 2004-5 range
e-machine T6524
Running Windows XP
1 Gig ram
ATI 1550 256 RAM (Yes I am cheap, but for what I do on the computer it works great for me)

Please help

Painbringer

PS yes I am a fool for clicking

Thats probably how you got a virus. IE is basically a virus hidden as a web browser.

How long have you had the computer? It sounds like it may be time for a clean install of Windows. After a while, the Windows system gets bogged down with old files from programs that were un-installed and old registry info. To help clean some of it up, download a program such as CCleaner (google it), and run the system and Regestry scan. Another good program for this is "Advanced Windows Care V2 Personal". This also scans for spyware, and has sped up my system and stopped the dreaded BSOD.

I just did a reformat of the hard drive and reload to factory settings from the recovery disks? I can not download a thing if i wanted to... it times out on me 90% of the time.

Did you clean your registry? It's a good idea to clean your registry after a viral attack. Go to something like geekstogo.com forums or hijackthis forums for help from professional geeks.

You can ping Google but not connect to it? What error do you get in FireFox when you TRY to connect? Purely 404 not found, or a DNS server error?

@Lakatz - he said he did a full format and restore - that registry is as clean as they get

Ok it is weird I will load a page and it takes forever I mean 5 minutes to load a page. I am on a 10 meg DSL it used to be instantaneous.

I really don't have anything set up on my system. I loaded the graphic card software (basic disk that came with it) the keyboard g-11 and mouse (g-5 I think) small downloads for them. And the system let me do it. I go to load up norton and it times out while downloading the patch.

Fire fox... I am pretty sure will time out if I try and download the browser.

Before I reset my system I would get a prompt from Norton "check that the cords are properly connected". When requesting help and support. They seem ok I have a buried cable outside and I have checked from the splice to my computer everything seems fine

On a side note I am tempted to ask my sister in law to come over and hook into the DSL with her laptop to see if she has any issues. at least I coould certainly find out if it is the line. But she lives aways away from me.

This could just be a odd occurrence but I have had many friends get e-machine's and without fail they all crap out.

Everything sounds fine on your DSL.

did you get it at wal-mart?

e-machine comps are like area-51 computers.....I am prolly the only one who knows what a area-51 comp is, lol they went bankrupt years ago.

After a full reformat and reinstall, that virus should be totally dead. That leaves the DSL people as the source of the connectivity problem. Keep after them.

LOL If crapped out I should atleast have issues running other things. It runs fine for anything other than Internet. And I would replace the ethernet card in a heartbeat if i new it was going out. but it shows it is running

Best Buy


I did find this on the web and I will check it tonight

If your PING tests work but you are having problems browsing sites on the Internet
1. If you could ping external sites by both IP address and Name, but cannot browse the web, likely your web browser is misconfigured.
2. Double check that you don't have an incorrect or not needed Proxy server assigned.
For the Internet Explorer - Tools / Internet Options / Connections tab / LAN settings button. Uncheck both Automatically detect settings and Use a proxy server for your LAN.

If you want, you can head on over to www.lunarsoft.net, they are pretty good with security there too.

They can recommend some things to start getting your PC cleaned up.

http://lunarsoft.net/news/software/3...ti-malware-114 you can also download this and run it, see if it catches the Trojan.

Here is a Malware cleanup page on there too http://lunarsoft.net/downloads/cat_v...alware-cleanup these things seem to do good.

I've had problems in the past where I could ping sites but not connect. It turned out to be corrupted TCP/IP drivers and/or stacks. If I recall, I had to go through a process involving uninstalling and reinstalling the drivers, etc. The tricky part (which I don't recall) was forcing Windows to install fresh copies off the CD instead of the ones on the hard drive.

Of course, a format C: and complete reinstall would probably fix it, and should be done every now and then anyway. (Which is a good reason for having only the OS installed on C: and creating a D: for everything else. )

So, I started reading this post to see what was going on and try to find the issue. I only got as far as:
That right there is your biggest problem. In fact, it's probably the entire problem. Get rid of Norton/Symantec products. Uninstall them COMPLETELY.

You'll need SymNRT to fully remove everything. It'd be a good idea to use Dial-a-fix after you've used SymNRT to remove Norton, that way anything that Norton broke during uninstall/removal (like Windows Updates, SSL, etc.) can get repaired.

You can use avast which is free and does far better than Norton.

He's a bit stuffed not being able to d/l anything :/

Painbringer, I suggest you do invite your sister-in-law over, get her to download what Tarun suggested, then burn them onto a CD to install on your system.

So even if I reformatted and reinstalled to factory settings it Norton can still be messing with my settings ???

If you reformat (F-Disk, delete the C partition etc) then no there is no files left, thus Norton is gone.

I still think the bashing against Symantec AntiVirus (Not Norton) is null. I haven't had any problems in 2 and a half years and the only one I had recently was self inflicted due to my own stupidity, and my AV caught that and dealt with it for me.

Not to mention that Task Manager uses up more resources than my AV does to run, that makes it even more null in my opinion, plus all of it's updates are done in stealth too and take up no resources either, so you'll never even notice it.

There is literally a blog about all the problems that Norton causes.

http://symantec-sucks.blogspot.com/

Another worth reading about the problems of almost every pay antivirus:
http://djlizard.net/2007/12/23/278/

Note: Symantec's corporate antivirus was originally made by Intel (a part of "LANdesk") and it is almost exactly the same today as it was when Intel first created it - that's why it isn't totally horrible. The detection rate feels about the same as Norton Antivirus, and it catches a lot less spyware pieces than anything else out there.

But notice how everything is still listed Norton in there.

I do not use anything labeled under ''Norton'' even if it is the same company. Aside, I have not had any of those problems that blog mentions.

I know you aren't referring to me so much, but I'm just throwing it out there anyway. (Ahh I see, that makes sense, whether it's good at detecting things or not is something I can be more inclined to believe, but it did catch most baddies anyways, and it has definition updates quite often so I feel pretty safe at the very least.)

After having to deal with Symantec's products in the tech shop and seeing how a majority of computers had it and had lots of issues, I don't recommend the use of any product from Symantec except for SymNRT. :P

sounds like you have a well hidden hijacker. most likely hidden in a rootkit.

my advice (which i strongly recommend you follow) is this:

1) DO NOT LET ANYONE ELSE ON YOUR NETWORK UNTIL THIS ISSUE IS RESOLVED. ie, your sister.

2) go to www.bleepingcomputer.com
3) register there, it is required for assistance and worth your time.
4) make a post there in the appropriate forum.
5) they will most likely have you run an app called hijackthis
6) once you save and post the logfile it creates they will analyze it for free and give you advise for removal of any problems.
7) they may end up having you run one or two other apps, by the way, Rootkit Revealer for instance.

Just follow their advise explicitly and you should have your problem resolved.

Do not, under any circumstances ever click on any link that offers Analysis, Removal, or Repair of your system unless specifically advised to by a well informed and educated person.

i once had a very similar problem and resolved it thusly.

anyway, good luck...

ps- you could go to pcworld.com and research your problem there, but i wager bleepingcomputer will get you fixed up. one caveat though, since they are an all volunteer force don't expect the most hasty results.

If you reformatted your hard drive and only installed essential programs without touching your internet and this setup has worked perfectly before, it's nearly impossible a software issue. I'd recommend you check your line with a different computer (i.e. your sister in law's computer). You can also try resetting your modem/router (disabling power for 10 seconds should work for most hardware). Norton isn't a bad program either it's just that most people are dumb/lazy/impatient.

It could also be a hardware issue. It could very well be something wrong with his network adapter and/or associated drivers.

Ok one last tidbit for any networking Guru could be barking up the wrong tree but what the heck

If I go to Control Panel double click on Network Connections I show 2 different Connections Local Area and another one can’t think of name

Checking Status I have Packets from Local Connection that are 1000 range down to 100

The other connection has 0/0

(I use Charter Cable for Internet)

At work (different system different computer the packets are 308,000 / 324,000)

Not sure if this means anything?

I disconnected the Ethernet cord and reconnected I was able to restore my anti-virus (This was a pretty quick download?) but browsing still has long waits on page loads etc. Guild wars would not download for me it timed out.

I also did some more CMD prompt pings Google 4 for 4 / yahoo 4 for 3 / guild wars 4 sent 0 replys / Ebay 4 for 0 / MSN 4 for 2

Could a bad Ethernet cord be to blame?

After my system restore I noticed my D drive has a new name called RECOVERY Could that little virus still be in there?

My guesss is your second connection is a 1394 connection which is Firewire. It's good that your machine is using Local Area and not that one. The packets are telling you how much information has been sent/received through the connection. The numbers you have listed are not good. You can try using a different network cable and see if that helps, you can pick them up just about anywere for just a few dollars.

I think I recall you saying that your internet provider checked their infrastruction for problems and saw nothing abnormal and they probably said they could see your modem. That tells me that from one side of the modem out, things are good. That leaves stuff from the network connection side of the modem to your computer as the culprit. As stated you can try a new network cable from the modem to your network card.

I would start with a fresh copy of the network adapter's drivers. Find a computer you can use to download them from the manufacturer's site (http://www.emachines.com/support/pro...es&model=T6524) and then uninstall the device (not physically) just using device manager. Then reinstall and force the system to install the new ones you downloaded. If that doesn't solve your issues, then that leaves few options.

At that point it is either the Modem, the network adapter or the motherboard. It appears that your adapter is integrated with the motherboard, so you can't try moving to a different slot. I would try using a different network adapter, again easy to find and not to expensive. Your last option would be the modem, they can be fairly expensive and it will require another phone call to your provider to register it. If none of these options work, then I am at a loss and maybe someone else can give some ideas.

I would assume that, since it was working before, the hardware probably did not just happen to go faulty at the same time he reformatted. Drivers are a more likely issue, but windows tends to be able to install a network card just fine without the user's assistance.

You are wrong in assuming that (1) the ISP people were competent enough to detect a problem on their end if it existed, and (2) the ISP people care enough to be bothered to fix a problem when they can just as easily ignore it by saying "it must be on your end." In my experience, both of those assumptions are usually wrong.

You are wrong in assuming that just because it worked before it has to now. Electronics fail, and yes, sometimes with no apparent reason. I was only pointing out that there are still other possibilities for the connectivity issues. The OP could just as easy sit there and say, it was working before so it can't be my equipment, it has to be the service provider.

I do however agree with you that drivers are a more likely culprit than anything else, hence the reason I provided a link to the site to get a separate copy. The rest of the information is there for things to look at if drivers do not work. If Painbringer can get his sister to hook up to his connection, it would be a definitive test of the providers connectivity.

http://www.tech-recipes.com/windows_tips8.html

The above link may be good if none of your previous restore points work, but if you're just trying to remove an infection it's easier to make a new "Clean OS" restore point and then use the Disk Cleanup to remove the old system restore points. It lets you remove all except the most recent. In the case mentioned earlier in my post, this would be the new, clean OS point you made.

Yes, most viruses and worms are programmed to embed themselves in the system restore files, so when you do a restore in a panic, the virus actually makes the infection worse. Evil little buggers.

I was thinking it had to do with the fact system restore is stupid and can't tell a viral invasion from a software install and makes a backup of the virus/worm and a new restore point just like it does for every new software install. Betcha a nickel that one of his restore points is the precise moment the bug entered his system. It's seemed very possible to me that he's still got the virus/worm/hijacker by the way his system is acting.

If you are talking about turning the Windows system restore off then running the system in safe mode and then running the virus checker with the modem shut off I did this. Many times I ran both full system scans from Norton and also a special Vundo designed removal Tool I ran both over and over in safe and normal mode ran at least 4 times in both settings. Before I reinstalled the sytem again.

I wonder if I had a hardware fail do to all the activity I have put my system through in the last few weeks. At least I really hope it is something like this.

I am really hoping this will tell someone what is wrong I found a network tester in Windows XP Media edition

I ran it and found a fail

DHCP Server Fail (hesitant to give the full description may contain hackable material)

There are no options except to save a log from this

Again Devise Manger of course says the card is fine so I am wondering if this makes any sense to any one.

Again it was almost like a light switched reduced (slower) internet then it went to almost stopped
when it was slow and the virus was doing its thing the hardrive was whirling but now its not.

Sounds like you found a backdoor on your system?
http://www.sophos.com/security/analy...w32rbotpr.html click on the "more information" tab.

Try turning off DHCP Server and see how that works. Also if I were in your shoes, I'd educate myself thoroughly about the backdoor (and it's extended family) that I found on my system and how to clean it properly. Often, once they've turned your system into a 'server,' they invite their friends in.

EDIT: The more I read about backdoors, the more I understand how difficult they are to detect and clean. For instance, I was reading up on the Brontok family and it says they automatically close or terminate any program with the following name: Registry, Command Prompt, System Configuration, Anti-virus programs (etc: AVG, Avast, Trendmicro) and other specific names including Process Explorer. I imagine, for obvious reasons, that can be said about most backdoors.

I am agreeing with Tarun. However, here is a good link. Run this and tell me how things work out for you.

http://www.snapfiles.com/get/winsockxpfix.html

Cheers!!!

Backing up a minute, just to be clear, when you said you "reformated," did you do a total reformat (that deleting everything on the drive) or did you just reinstall windows over the top of itself?

LSPFix can also resolve issues with Winsock.

Sounds like he punted his system. Good thing too, he will get better performance out of it.

When I saw D marked as recover I am questioning myself as well. (Would it not say D: Drive Just like C: Drive) But I have never done one in XP May have clicked hasty i was in a bad mood at the time

When you did a format, what were the steps you took? Sounds like you booted off of a recovery partition and did a generic restore, keeping all of your files and settings.

popped in restore windows disk shut off and turned it on there was two options. Maybe i should do it again ?

I have done other ones and remeber a reformat process that takes a bit of time don't remember one this last time

First, do you have your files backed up? Second, if not, back them up to DVD or CD. Third, do a factory restore (or Destructive restore). That will get your back to factory settings.

I will try this again I save the important stuff to a CD before the initial recovery

What if when I am done I still have the problem with the internet
Run the Winsock tool?