Author Topic: Problems with Internet Connection (Read 10315 times)

agurney83 · « **on:** March 05, 2005, 10:37:57 AM »

Yesterday I installed Avast!4 on my Dads computer, due to the high number of Trojans and niggly viruses on there. After running some sort of scan ( similar to the WINXP Scandisk at startup), all errors were deleted. These included Trojans and some other infected files. Once the computer was re-booted, and the internet re-dialed, no pages can be displayed, nor does MSN messenger connect, even though a valid connection has been made. My first thought was that Avast had deleted an important file, so I re-installed all the modem and broadband drivers but to no avail.
If anyone can help, you would be my Dads Business' lifesaver.

The spec being run on is WinXP SP2... P4 2.0GHz... 256MB RAM...Avast!4 ( now uninstalled)

Lisandro · « **Reply #1 on:** March 05, 2005, 12:48:59 PM »

Quote from: agurney83 on March 05, 2005, 10:37:57 AM

No pages can be displayed

Can you disable the WebShield provider and see what you get?
Did you allow ashWebSv.exe to connect the Internet into your firewall settings?
If you disable the Web Shield provider (into avast On-access providers settings) will you be allowed to connect the Internet?

Welcome to forums

agurney83 · « **Reply #2 on:** March 05, 2005, 02:03:29 PM »

I re-installed Avast back on his computer this morning, and then disabled the WebShield provider and Windows own firewall. This still did not allow me to access webpages though, even though a connection was still active.

Thanks for the welcome

Any other ideas, or will I have to resort to re-installing Windows XP.

Eddy · « **Reply #3 on:** March 05, 2005, 02:04:41 PM »

Can you ping websites?

agurney83 · « **Reply #4 on:** March 05, 2005, 02:05:50 PM »

Quote from: Eddy on March 05, 2005, 02:04:41 PM

Can you ping websites?

as in, start -> run -> cmd -> ping

.

?

Eddy · « **Reply #5 on:** March 05, 2005, 02:14:18 PM »

agurney83 · « **Reply #6 on:** March 05, 2005, 02:19:39 PM »

Quote from: Eddy on March 05, 2005, 02:14:18 PM

yup

Just tried that and it does not work. When connected to the internet, the status bar is recieving data just as normal.

Eddy · « **Reply #7 on:** March 05, 2005, 02:22:03 PM »

Please check Avast's log file(s) and tell us what file (and their locations) where deleted. It may tell us more about what is going on.

agurney83 · « **Reply #8 on:** March 05, 2005, 02:29:29 PM »

Sorry guys, but yesterday I uninstalled the program, only to re-install it today and I assume the log file was wiped as well because all I have in there is installation data for today.
Do you know if anyone else has experienced this problem before, as I couldnt find anything with the search facility.

Eddy · « **Reply #9 on:** March 05, 2005, 02:36:58 PM »

ouch, very hard to tell what happend now. I guess a FP (false positive) was detected and the file was removed. What file? Very hard to say.

You can try this:
- remove the netwerk card/modem from devicemanager
- remove the internet protocols (tcp/ip and such)
- reboot
- reinstall them

With a bit of luck this will reinstall everything needed.

agurney83 · « **Reply #10 on:** March 05, 2005, 03:53:54 PM »

Quote from: Eddy on March 05, 2005, 02:36:58 PM

ouch, very hard to tell what happend now. I guess a FP (false positive) was detected and the file was removed. What file? Very hard to say.

You can try this:
- remove the netwerk card/modem from devicemanager
- remove the internet protocols (tcp/ip and such)
- reboot
- reinstall them

With a bit of luck this will reinstall everything needed.

Eddy, unfortunatly the above did not work. From reading some other forums, the HijackThis file was often recommended for dealing with these problems so I have included mine below if anyone understands this $:-\$

Logfile of HijackThis v1.99.1
Scan saved at 14:50:49, on 05/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd64.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\Program Files\Intel\DslSetup\ProDsl.exe
C:\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.btopenworld.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.btopenworld.com/businesshome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by BT Openworld
O2 - BHO: Explorer Class - {962F12AE-2773-4BEB-99EA-B5C3AB9A6606} - C:\WINDOWS\System32\DSMANA~1.DLL
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {C1EA1782-8E6E-4ea4-9800-B68DE41F1A26} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\system32\cmd64.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DSL Connection Manager] C:\Program Files\INTEL\DSLSetup\ProDsl.exe
O4 - HKLM\..\RunServices: [windows] iexplore.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\RunServices: [logon.exe] C:\WINDOWS\System32\logon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: BT - {51153D62-D18E-4D46-A2F2-2A9738F7D136} - http://www.bt.com (file missing) (HKCU)
O9 - Extra button: Homepage - {CA6399A5-24AD-49AA-9268-C8C58B48E343} - http://www.btopenworld.com/businesshome (file missing) (HKCU)
O9 - Extra button: Help - {EB2C5440-A1FB-4D70-AA6D-7A0B65DB1001} - http://www.btopenworld.com/helpbb (file missing) (HKCU)
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\aklsp.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x15.chm::/trs15.exe
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2385a8d7055fe1b21715/netzip/RdxIE601.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\lv2m09f1e.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

Eddy · « **Reply #11 on:** March 05, 2005, 04:18:20 PM »

This is the result of my HJT log analyzer:

--------------------------------------------------------------------------------
CHECKING HIJACKTHIS, INTERNET EXPLORER, WINDOWS AND SOFTWARE FIREWALL:
--------------------------------------------------------------------------------
You are using the latest version of HijackThis.
You are using the latest version of Internet Explorer.
No software firewall detected. If you are not using a
hardware firewall, it is highly recommended to install one.

--------------------------------------------------------------------------------
THESE ARE EITHER HARMFULL OR A SECURITY RISK
WE STRONGLY RECOMMEND TO FIX THEM :
--------------------------------------------------------------------------------
\windows\system32\cmd64.exe
o2 - bho: explorer class - {962f12ae-2773-4beb-99ea-b5c3ab9a6606} - c:\windows\system32\dsmana~1.dll
o2 - bho: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file)
o3 - toolbar: (no name) - {c1ea1782-8e6e-4ea4-9800-b68de41f1a26} - (no file)
o4 - hklm\..\run: [controlpanel] c:\windows\system32\cmd64.exe internat.dll,loadkeyboardprofile
o4 - hklm\..\runservices: [windows] iexplore.exe
o9 - extra button: bt - {51153d62-d18e-4d46-a2f2-2a9738f7d136} - http://www.bt.com (file missing) (hkcu)
o9 - extra button: homepage - {ca6399a5-24ad-49aa-9268-c8c58b48e343} - http://www.btopenworld.com/businesshome (file missing) (hkcu)
o9 - extra button: help - {eb2c5440-a1fb-4d70-aa6d-7a0b65db1001} - http://www.btopenworld.com/helpbb (file missing) (hkcu)
o10 - broken internet access because of lsp provider 'c:\windows\system32\aklsp.dll' missing
o15 - trusted zone: *.skoobidoo.com
o15 - trusted zone: *.slotchbar.com
o15 - trusted zone: *.windupdates.com
o15 - trusted zone: *.skoobidoo.com (hklm)
o15 - trusted zone: *.slotchbar.com (hklm)
o15 - trusted zone: *.windupdates.com (hklm)
o15 - trusted ip range: 67.19.178.84
o16 - dpf: {14a3221b-1678-1982-a355-7263b1281987} - ms-its:mhtml:file://c:\foo.mht!http://82.179.166.145/x15.chm::/trs15.exe
o16 - dpf: {4e62c4de-627d-4604-b157-4b7d6b09f02e} (accounttracking profile manager class) - https://moneymanager.egg.com/pinsafe/accounttracking.cab
o16 - dpf: {56336bcb-3d8a-11d6-a00b-0050da18de71} (rdxie class) - http://software-dl.real.com/2385a8d7055fe1b21715/netzip/rdxie601.cab
o16 - dpf: {b38870e4-7ecb-40da-8c6a-595f0a5519ff} (msnmessengersetupdownloadcontrol class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
o20 - winlogon notify: optimallayout - c:\windows\system32\lv2m09f1e.dll (file missing)
o23 - service: x10 device network service (x10nets) - unknown owner - c:\progra~1\atimul~1\remctrl\x10nets.exe (file missing)

--------------------------------------------------------------------------------
THE FOLLOWING ITEMS ARE NOT NEEDED TO LOAD
AT BOOTIME FOR THE SYSTEM TO WORK PROPERLY:
--------------------------------------------------------------------------------
o4 - hklm\..\run: [dsl connection manager] c:\program files\intel\dslsetup\prodsl.exe

After fixing the things, run LSPFIX

That will likely solve the problem.

agurney83 · « **Reply #12 on:** March 05, 2005, 04:23:54 PM »

Pardon my ignorance Eddy, but how do I set about removing these items?

Eddy · « **Reply #13 on:** March 05, 2005, 04:30:00 PM »

Put a checkmark in front of them in HijackThis.

Hint: most (if not all) applications do have manuals

Author Topic: Problems with Internet Connection (Read 10315 times)

agurney83

Problems with Internet Connection

Lisandro

Re: Problems with Internet Connection

agurney83

Re: Problems with Internet Connection

Eddy

Re: Problems with Internet Connection

agurney83

Re: Problems with Internet Connection

Eddy

Re: Problems with Internet Connection

agurney83

Re: Problems with Internet Connection

Eddy

Re: Problems with Internet Connection

agurney83

Re: Problems with Internet Connection

Eddy

Re: Problems with Internet Connection

agurney83

Re: Problems with Internet Connection

Eddy

Re: Problems with Internet Connection

agurney83

Re: Problems with Internet Connection

Eddy

Re: Problems with Internet Connection