Tweaking.com Support Forums
Main Forum => General Computer Support => Topic started by: rhuffman on August 31, 2014, 09:00:45 pm
-
Need major help. I cannot get onto the internet via any browser and i cannot check my email, but i can download with bit comet and get my updates with curse add-on program for WOW. I am with telus optic and they have informed me that my computer is infected with the Citidal virus. I have ran every virus program they suggested (except the online ones because no inet access via browser). I have also ran tweaking.com's program "Windows all in one Repair" and bleeping computer's network repair tool (twice). For the life of me i cannot get this fixed. And yes i have reset the windsock etc. (Windows all in one repair air does that and more)
-
Can you get a connection when you boot up into Safe Mode with Networking ?
How did Telus determine you are infected with the Citadel virus ?
If you can connect to the Internet in Safe Mode with Networking then download NPE after reading through the page https://security.symantec.com/nbrt/npe.aspx but see if using the restore points back to before this problem occurred while in Safe Mode will resolve.
As a belt & braces after running NPE also run ESET Free Online Scanner http://www.eset.co.uk/Antivirus-Utilities/Online-Scanner
Click on Advanced and check all of the boxes except the last one (for a Proxy I think) then disable your AV program immediately before hitting the Scan button.
This scan will take a little while to complete.
If you aren't able to connect while in Safe Mode etc. and the restore points don't resolve, then see if MSRT can do anything for you.
Go Start - type mrt.exe - press enter and opt for the full scan - this can take a few hours to complete.
The Citadel virus can lead to Ransomware but as you don't have an Internet connection to pay any ransom, then you won't have that.
If these suggestions get you back up and running and virus free, then I strongly advise you to create a system image onto external media.
-
I get the same response in safe mode, can connect with bit comet and curse gets updates, cannot do internet scans as any online internet scanner says it cannot connect, i have no restore point for this issue, it was turned off. I will run the programs that you suggest but if they are online programs no go. (I have downloaded various virus programs on my other computer and put them on a flash drive and ran them, but none of them come up saying the Citidal virus is on my computer, dam stumped and i have never had this happen before, I installed a hide my ip program trial ware and then uninstalled it as i did not like it. But i do not think that it has caused this. Telus says my computer is running a bot and accessing other peoples computers and i am to disconnect my wired and wifi connections for this computer. Driving me nuts!!!!!
-
Probably just have to wait and see if MSRT finds anything.
You get an updated MSRT with each month's Windows Updates so it doesn't have to connect to the 'net.
I don't know if you will be able to open IE without add-ons while mrt.exe is running but when you can, go Start - All programs - Accessories - System Tools - Internet Explorer (No Add-ons).
Click on the home page icon and then see if you can browse.
BTW have you tried the Internet Troubleshooter by right clicking on the WiFi icon and choosing that option to see what that reports ?
Is the WiFi icon showing as 5 bars with a yellow alert or is it just a box with a red cross on it when WiFi is enabled ?
-
There's one other thing that you can check that I forgot to mention where viruses are concerned and that is to go into Internet options through All Control Panel Items again and under the Connections tab, ensure that just the top Auto detect box is checked and that the one for Proxy is unchecked.
-
No yellow exclimation mark or red x, I do have partial access to the internet, have ran malty trouble shooter many times in both modes. Something is blocking my email and browser programs. Will rerun the Microsoft program you mentioned. Also have another question, is there a program that will fix partition table without losing files. Have a 4tb drive that windows says it needs formatted but it is the mft and or partition table that is scrambled, I can restore files from the drive using file recovery programs.
-
What version of windows are you on? If you are not on 8, then have you tried combofix yet?
http://www.bleepingcomputer.com/download/combofix/
And after you run it open a cmd.exe window and do two pings for me.
First one:
ping google.com
2nd:
ping 8.8.8.8
If the 8.8.8.8 gives a response but the google.com ping fails then the problem is DNS and we can go from there :wink:
Shane
-
I ran combo fix and i can ping both address you suggested, still cannot get my browsers and email to connect to inet, all bars on the icon are white. Runningmsrt again right now. Auto detect is set to on and the proxy setting is not ticked. Internet explorer tries to load but it disappears after a bit. Running it with no add ons is the same result. Still not able to connect browsers and email in safe mode as well.
-
Also it is a Windows 7 Machine I7 processor.
-
Normally when the WiFi icon is showing as normal but with connectivity problems, it's usually because of the AV program blocking - but in Safe Mode with Networking, the AV and all 3rd party programs are isolated.
The Event Viewer may have more info on this but open a command prompt as an administrator and enter -
netsh winsock reset catalog
netsh int ip reset resetlog.txt
exit
Then reboot and see what connectivity is like.
-
Hi, Try this . This may help you
Re-register IEPROXY.DLL by clicking START (the win 7 icon in the bottom left hand corner of your desktop) and typing
regsvr32.exe "c:\program files\internet explorer\ieproxy.dll"
and then clicking OK.
If it doesn't find ieproxy.dll, dig around your system to find its location and if not try to get it from installation dvd. It will be available normally.
-
OK so you are able to ping both the address and the IP, which means internet does work but you have something hijacking or blocking the browsers, or possibly port 80 since that is the port sites are on.
Firewall software could possibly be doing it if somehow it was blocking port 80, infections can do it and also check the proxy setting in the internet options in the control panel and make sure nothing was set there. Some infections will set the proxy server so that the browsers go through it.
Shane
-
Jraju did that and it was successful but still not inet connection. Settings for proxy is turned off (not selected), Auto detect settings is ticked. I am running avg free and adaware free, do these programs have a firewall setting, i looked but do not see a reference to firewall. I am running windows firewall only. I have talked to a few techs (am a tech to) and they game me suggestions, ran today Bleeping computers Junk removal tool and the program rkill and ADW. I also checked the host file and it says 127.0.0.1 localhost. Just ran spybot and ComboFix. Still nothing. Is it possible for a virus to change the settings in my teleus optic modem ? All my other computers on my network all work fine (both pc's and macs / ipad)
-
Boggin i also have done what you suggested many times to. Shane am at a loss here, pulling my hair out :(
-
Hi, Rhuff
Did you notice whether the ethernet connectivity to your computer blinks with green or not. Downloading thro torrents and then stops in the middle or deleting torrents exe , in some case will make the internet connection impossible to get.
It stops the server signal by its programs. May look as funny, but i experienced the same and i have to totally format the os to get that.
If that is not, then try reregister all the internet explorer by following this article
http://downloadsnfix.blogspot.in/2013/06/how-to-re-register-dll-files-of.html
Hope this could be of help
-
I belevie i have done that as well. Point of note i just checked Control Panel\Network and Internet\Network COnnections and my Wireless Network connection 2 is not connected it is called Microsoft Virtual WiFi Miniport Adaptor. There is a red x on it. But the other ones local are connection and Wireless Connection are connected. The former one says the device is working properly.
-
It could be the services are playing up, but open a command prompt as an admin and run sfc /scannow to see what that reports.
Event Viewer should also have some info on what is happening.
Also check that all your Network Services are Started.
Go Start, type services.msc then press Enter.
Their startup type should be Automatic or Manual.
COM+ Event System
Computer Browser
DHCP Client
DNS Client
Network Connections
Network Location Awareness
Remote Procedure Call (RPC)
Server
TCP/IP Netbios helper
Wired Autoconfig is set to manual.
Wireless Zero Configuration (XP wireless configurations only)
WLAN AutoConfig (Vista/7 wireless configurations only)
Workstation
If a service is not running, click on it to highlight then click on Start (top left).
If it fails to start then right click to open its Properties and check the Dependencies and that each of them are running.
Any of the Dependencies not listed in Services can be found in Device Manager/View/Show hidden devices/Non Plug and Play drivers and they may have a yellow alert against them.
Usually if any do have a yellow alert, some can be uninstalled by right clicking on them and selecting Uninstall and they will reinstate on the reboot, but if you need to do this, create a restore point first should they not auto reinstate and check that the restore point has been created.
-
As suggested by Boggins, Try to include the event viewer log of the error id. Shane may be able to pinpoint the solution.
-
It is the fact that you are able to ping google.com and pint 8.8.8.8 and you get replies from both. If the internet truly wasnt working then you would have gotten request timeout from both of them.
Any possible way for you to post a screen shot of both the ping results for me? Reason shy is I want to see what they report back. Ping goes out on a different port where wbe pages use port 80 and for https (SSL) they use port 443.
Most infections that try to hijack a connection will hijack those ports.
So just doing a quick google search for a site using a different port other than those two I found this one
http://labs.webmetrics.com:8080/
When ever you use a different port on a site you have to add it to the address, so this site I found is using port 8080, see if that page loads up for you. If it does then we know that something is blocking or hijacking port 80 and 443. :wink:
Shane
-
Server was turned off, what am i looking for in the event viewer?
-
Does Event Viewer say why Server was not started or for any similar services and were you able to start it ?
-
it started with no problem. I tried the web address on port 8080 and it does not load, get message Unable to connect to the internet using google chrome, tried email and same.
-
Try number 3
-
Have you run the sfc /scannow yet - and what did Event Viewer have on Server etc. ?
-
It says that it supports file, print and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. It was off i turned it on. WHat is the Microsoft Virtual WiFi Miniport Adapter for there is a red x on it. Says it is not connected. SFC did not find any problems. How do i do a tracert?
-
Article on the Virtual WiFi Mini Port Adapter, but you can disable it if you aren't going to use it as it can sometimes cause connectivity problems, but never has done for me. http://helpdeskgeek.com/windows-7/what-is-microsoft-virtual-wifi-miniport-adapter/
You just enter tracert at the command prompt instead of ping and it lists the Hops it would take to resolve the address - give it a try with www.google.com - it takes 11 hops for me from the UK to resolve with a ping of 30ms but as you are much closer it won't take so many.
There's one other thing that you can try and that is to right click on either the LAN and/or Wireless adapters in Network and Sharing Center/Change adapter settings (depending upon what you have enabled) and select Properties then uncheck the box for TCP/IPv6 - OK - Close then reboot.
Is what you posted about Server what was in Event Viewer or when you clicked on it in services ?
-
It was in services, what would i look for in event viewer? Took me 10 hops ranging from a low of -1 to a high of 43 ms. Turning off TCP/IPv6 had no effect.
-
Hi, Rhuff Please see this link
From
http://wiki.bitcomet.com/add_port_mapping_in_nat_router, where your problem have been analysed and workarounds are given. It specifically dealt with half internet connectivity.
-
In Event Viewer when it has read the logs, you will have listings for Critical, Error and Warnings etc.
Click on Error then on View All Instances of These Events in the right pane.
Clicking on each that are listed will produce a brief description in the lower window - check to see if any relate to connectivity and let us know what they are together with the Event ID No. if any.
On the affected computer open a command prompt and enter ipconfig /all then right click in the text area and click on Select all then press enter.
Open Notepad or Wordpad and paste the output into there and Save_as then copy that across to your working computer and copy & paste into the reply box.
Can you also run the ipconfig /all command on your working computer and note that the preferred IP address for whichever adapter you are using for the Internet on that one is not the same as either of the Wireless or Ethernet of the affected one.
If you are getting a DHCP address assigned on the affected computer, then you can try assigning the affected computer with a static IP address for it either in the router or in the computer's TCP/IPv4 Properties - but we'll need to see the output of the ipconfig /all first.
As you are able to ping 8.8.8.8 then you could try using that DNS address in the computer's TCP/IPv4 Properties.
Check the radio button for Use the following DNS server addresses and enter an 8 into each of the boxes in the top row and then 8.8.4.4 into the lower row - check the box for Validate settings upon exit - OK - Close and that should activate the Troubleshooter - let us know if that reports anything other than couldn't find a problem and then reboot.
Can you also check back with your ISP to see if they can still detect Citadel from your IP address.
-
The part that makes this confusing is the fact that the pings work, and even have really good response times.
Cant remember if you tried this yet or not, but download the newest version of my Windows Repair tool, make sure to do a clean boot and then run all of the repairs.
Also download teamviewer from another computer and put it on yours and see if it is able to get an id and password. If it is able to get online I could connect to you and take a look as well. Mainly because I am freaking curious how pings work nice and fast yet nothing else does lol
Shane
-
That is the puzzler :smiley:
I'd like to see the info I've requested but also wondering if creating a Kaspersky Rescue Disk on the working machine and letting it have a look at the files. http://support.kaspersky.co.uk/4162
It may be able to get an Internet connection to update itself when you wire up but it should have sufficient in its armoury to scan for any infection.
Not sure if you could boot up the working machine with it and let it update itself on that and then boot up the affected machine with it, but once you start the Scan C: you are stuck with it until completion and that scan took a little over 9hrs on this laptop and then initiated a chkdsk /f.
If you've gotten rid of Citadel somehow but it has left some files damaged, then this ESET Tool could repair/replace those http://www.trishtech.com/2013/11/restore-missing-services-after-malware-infection/
Edit
After a bit more brain storming, here's a couple of more things to check -
Go into services.msc and check that Base Filtering Engine is showing as Started and Automatic (this is one of the services that ESET repairs)
Also check that IP Helper is showing as Started and Automatic - also that IPsec Policy Agent is Started and Manual.
I think I once came across where .NET Framework was causing a problem so download/Save the repair tool and copy it across to the affected machine where it can then be executed http://www.microsoft.com/en-gb/download/details.aspx?id=30135
-
Here are the ipconfigs.
-
Ipsec Policy Agent is not started, turning it on now. (Nothing happens no connection)
-
Did the ip thing 8.8.8.8 and 8.8.4.4 no errors / problems found
-
I forgot to ask if you could also run the command route print and post the output of that as well.
Looking at the ipconfig /all of the good computer, it looks as if that has had connectivity problems as well, as Windows creates a MS ISATAP adapter whenever it has problems getting an Internet connection - which is why there are quite a few duplicated ISATAP adapters.
At your leisure on the good machine, go Device Manager/View/Show hidden devices/Network adapters then right click on all but the original ISATAP and select Uninstall.
There won't be much point in doing that on the affected computer yet, but I noticed there weren't as many duplicated ISATAP adapters on that one as there were on the good one - which could either mean that Windows was able to connect or that function was no longer working ??
Were you able to run the ESET and/or the .NET Framework Repair Tools and have you contacted your ISP yet to see if you are still broadcasting Citadel.
As a DHCP IP address has been assigned to the Network adapters and that you can't still connect in Safe Mode with Networking, would suggest a firewall and the only firewall still active in that mode is Windows Firewall.
Depending upon the results of ESET, .NET and your ISP, you may be able to play around with the firewall settings, but I'll leave Shane to advise on those. http://www.howtogeek.com/112564/how-to-create-advanced-firewall-rules-in-the-windows-firewall/
Probably best to create a restore point first should Shane wish to eliminate the firewall as the cause.
I don't think at this point it is worth assigning a static IP address, but MAC Filtering in the router for the affected computer could be something worth looking at where you add its MAC address to the filter, which is sometimes a requirement for Internet connectivity but being able to ping Google throws a lot of diagnostics out of the window.
This program has had some success if none of the above have restored connectivity - thing is, it doesn't tell you what it has fixed when it has and we would still be in the dark http://www.majorgeeks.com/files/details/complete_internet_repair.html
-
Hi, Shane ,
Did you see my link?. Bitcomet downloader explains you will only receive half of the internet functions.
If you are connected to the Internet through a wireless modem (usually a USB stick) which uses mobile phone wireless telecommunications technology (such as GPRS, EDGE, EVDO, HSPA, UMTS, etc.) most likely your Internet connection will be firewalled at the ISP site by default (so you basically get only half of an Internet connection, without the possibility of successful incoming connections). Short of contacting your ISP to ask if there is a possibility to get full Internet connections on the same device or changing your Internet subscription plan for one that has incoming connections unfirewalled by default (all xDSL, cable or FiOS providers usually offer unfirewalled connections), there is nothing you can do on your side to unblock incoming connections, therefore there is no point in following this guide or any other port-forwarding guide, for that matter, because you will still have incoming connections blocked on all your ports!
-
Hi, Shane ,
Did you see my link?. Bitcomet downloader explains you will only receive half of the internet functions.
If you are connected to the Internet through a wireless modem (usually a USB stick) which uses mobile phone wireless telecommunications technology (such as GPRS, EDGE, EVDO, HSPA, UMTS, etc.) most likely your Internet connection will be firewalled at the ISP site by default (so you basically get only half of an Internet connection, without the possibility of successful incoming connections). Short of contacting your ISP to ask if there is a possibility to get full Internet connections on the same device or changing your Internet subscription plan for one that has incoming connections unfirewalled by default (all xDSL, cable or FiOS providers usually offer unfirewalled connections), there is nothing you can do on your side to unblock incoming connections, therefore there is no point in following this guide or any other port-forwarding guide, for that matter, because you will still have incoming connections blocked on all your ports!
This problem is with bitcomet though and has to do with his browsers.
rhuffman, did you download teamviewer on another system and put it on your troubled system and see if it is will get online? I want to see if I can connect to it and take a look :-)
Shane
-
I think rhuffman is just using bitcomet as an alternative means of connection as the original problem was that Citadel was being broadcast from his IP address on one computer.
-
Hi, Boggin
Let me know what is the citadel virus. Ofcourse, the TO has said and some discussion on the previous posts. But would a virus could stop the internet connection? I also surfed the net to get some cure. But it seems to be a major attack on compromised system.
I thought that bit comet downloader is the culprit and by disabling or removing this would possibly get him the full connection.
-
As an attempt try to scan to get rid of this
http://www.microsoft.com/security/scanner/en-us/sysreq.aspx
I hope that this fix it.
Update: please download in some other machine and then scan. I found that this thread has been fixed in the latest security scanner by Microsoft
-
I don't think Citadel is stopping connectivity as it requires that to spread its malevolence.
Subsequent anti malware scans have found no sign of that or any other infection and while his ISP could block his connectivity because of it, as other machines are working okay, I'm not sure if they could have blocked just this computer's MAC address - which is why rhuffman needs to contact his ISP to see if it's still broadcasting Citadel.
Because other machines can connect, then this would normally eliminate the router - and it's assigning a DHCP address anyway.
Without going back through the thread, I don't think we've tried running IE without add-ons yet, but as there's some sort of connection with bitcomet (although I'm not familiar with it) then it's not likely to be a malicious add-on
There's one thing that an infection can do and leave after it has been removed and that is to corrupt the Hosts file, but MS has a Fixit to reset that back to default, which can be downloaded and copied across http://support.microsoft.com/kb/972034 - so that is something else to try.
-
Hi, Rhuffman,
Did you see my post dated september 9 and try the microsoft scan
-
Sorry guys i did not reply over the last few days, have been busy with work. Reading posts now and will reply soon.
-
Contacted Telus and their response is "We have not seen any new activity since Aug. 22nd. It is possible that the scans you tried resolved the issue already.
". Ponit of note no browsers at all will connect on this computer and yes i tried running iexploer with all addons turned off. I installed EMSISOFT Anti-Malware as suggested and fired up Bitcomet, it immedialtly bloced bitcomet.exe and it detected it trying to access FALCOWARE.COM. I have run the MSERT.exe file as well. Any virus or malware was deleted. (Point of not alot of the files these virus scanners have said were infected were keygens for various programs (all false positives) they also have said my warcraft mouse files were possibly an issue as well as my wow64.exe file to launch the game. I think i am getting alot od wrong diagnosies from these programs. None of these virus programs have detected anything to do with Citadeal. Here is the route file and bitcomet running in background all files are saying connecting and do not download since the block.
-
You didn't get back to us if you had checked Event Viewer - Post #28 describes how to check for the errors.
It was interesting that bitcomet.exe was trying to take you to Falcoware.com so you could have something malicious on there.
Either with the partial connectivity or you can save and copy across - download AdwCleaner http://www.bleepingcomputer.com/download/adwcleaner/
Click on Scan and when that has completed, it may show items in the lower box that you can uncheck if you want to keep.
Click on Report and that will show what it has found - if it has found any files that it wants to delete, close the Report and click on Clean.
It will produce another report after the reboot as to what it has deleted and then see if you can connect through Telus.
If that still fails then I think you should use the link in Post #30 to create a Kaspersky Rescue Disk and boot up with that.
It may be able to get an Internet connection if you wire up so that it can update itself when you choose that option and then have it Scan C:
This will take a number of hours and when it has completed, click on Shutdown to see what it does then - it initiated a chkdsk /f on mine but it may take another path for you as I had a different problem when I used it..
-
Boggin do you use skype, if so lets connect and chat about this my handle on skype is rick_and_liliya, skype is online right now.
-
http://wiki.bitcomet.com/bitcomet_client_issues_and_possible_solutions?&#all_my_other_internet_applications_either_slow_down_or_say_they_can_t_connect_when_i_use_bitcomet_what_s_going_on_and_how_can_i_fix_this
Please see this link. It takes much of your source and resources.
If you could get rid of torrent exe, then you may have to loose your internet connection altogether.
I have come across the same problem, and i have to format my Os to get rid of this monster torrent. Torrent downloads are from computer and it is possible that citadel would have crept in your computer thro this computer to computer transfer of downloads. It takes your sources and resources. If it is possible to not to kill but to destabilize the torrent exe, then you are having a chance of getting the proper internet links to connect.
Update: if you still insist that you have to have bit comet and other internet connection do the following tip. If it fixes ok, otherwise, i think that disabling if possible the torrent may restore your internet connection.
The tip
Change the Connections in BitComet
1. Go to Tools and select Options (or press CTRL+P) to bring up the preference options.
2. Go to Advanced and click on “network.max_connections”.
3. Change the value from 0 (unlimited) to a more usable connection number (100) in the “Value:” box below, then click Apply.
-
Ok so how do i disable the torrent.exe
-
Doing the Kaspersky Rescue DIsk, it was able to connect to the internet and the browser works to. 19 hours to go :(
-
Doing the Kaspersky Rescue DIsk, it was able to connect to the internet and the browser works to. 19 hours to go :(
The Scan C: only took ~9.5hrs on mine which was long enough, but it would depend upon how much you have on your computer.
Kaspersky won't be using Telus to connect to the internet http://www.howtogeek.com/howto/36403/how-to-use-the-kaspersky-rescue-disk-to-clean-your-infected-pc/
-
Doing the Kaspersky Rescue DIsk, it was able to connect to the internet and the browser works to
Then we know for sure that the router is fine and the internet is fine and that it is your system. Which explains why the pings worked as the virus is hijacking the port 80 and others but not the ping port.
You must have one hell of a rootkit installed.
So many posts now, I cant remember, but you did combofix.exe and tdsskiller.exe correct?
Shane
-
Yes shane i ran both combofix.exe and tdsskiller.exe - This is the worst computer hijack i have ever seen. One for the record books for sure.
-
You are doing the best thing by scanning the system outside of windows itself. Viruses like this like to fight back when you try to clean the system while windows is running. So the only way to keep them from doing that is to scan the system outside of windows when windows isnt running.
Of course now it just comes down to how new this virus or rootkit that you have is and if any scanner will catch it. That is the things about all antivirus/scanners. they can only detect what they know. Virus makers test their viruses against them all before they put it out.
Worst case, if you want to be 100% sure you are clean, then you have to backup your files that you cant replace, kill the partitions (In case it is a nasty MBR virus) and then install windows fresh. And formatting the drive wont cut it since the MBR doesnt get replaced. You have to delete the partitions, which you can do during the windows install, and the windows install will auto create new partitions.
Shane
-
Thanks Shane for all the help and everyone else, will keep ya posted on progress. Shane is that your wife or girlfrind in picture, lucky guy. I am lucky to have hot Russian blond girl :):):):):):) for my wife :)
-
My wife of 10 years and counting and 5 kids :-)
Shane
-
Cool :) Hey do you want to chat for a bit on skype, my handle is rick_and_liliya, you can see my wife on the image for that, ill fire up skype now :)
-
Hi, Shane, if it is a MBR virus, then aswmbr is available as a tool of avast antivirus . This will scan and if it fixes others or not, there is a button to fix MBR and after an alert it replaces the infected MBR, The tool could be downloaded here
http://public.avast.com/~gmerek/aswMBR.htm
Or instead, one can go to the elevated command prompt and there, could execute fixmbr command and it will fix any infected after alert. Provided it only fixes mbr. But as you rightly pointed out, his computer has variety of rootkits, trojans, and browser objects playing with all the system files. Torrent downloads are risky in nature.
I have already asked about the utorrent kills my internet connection and some fourm members have enclosed a link that it could kill int connection.I could not locate the thread easily in my summary but will enclose that in due course of time. There is possibility of viewing total no of questions individually in this "My summery Posts", but it is a continuous posts, not post wise.
-
Hey Shane microsoft update is trying to run, i clicked on it and it is running files from my external drive. unplugged the drive and updates would not work, virus program for sure doing kaspersky on all drives now see what happens when i get home from work.
-
Have you always had the external HDD plugged in ?
You need to get the computer sorted without anything connected as the infection could be residing on the external HDD and I don't think the likes of Combofix etc. would have scanned other than C:
In Kaspersky you have boxes to check for which drive to scan and if you had the one for the external drive checked as well, then it would have gone onto scanning that one as well.
The scan should have completed long before now if it was just set to scan C: on the computer.
-
So did the internet start working after you uninstalled the programs I told you to?
Shane
-
Yes 2 external drives and a flash drive are attached. I ran jasper sky with all ticked and it is saying read errors on some files and the first time I ran it it failed running, it is still running now started it this morning and it is at 34 percent. Sorry forgot the name of programs you asked me to uninstall, had a few beers last night, what were they again.
-
AVG, and any and all of the other scanners you have installed, including any tools like hide my ip and anything that touches the network as well :wink:
Shane
-
Ok will do, will keep ya posted.
-
In continuation of reply 56 of this post
I request you to see this link, where it is clear that torrent may altogether stop internet connectivity.
http://en.wikipedia.org/wiki/Layered_Service_Provider#Corruption_issues
Did you try microsoft service link for fixing. It include in its virus definition the citadel virus. hence, i recommended
-
I have him removing avg and the other scanners because I have had multiple customers who called me saying their internet didnt work any more and it turned out that the firewall in the AV was blocking it even when disabled. When I have them remove the AV the internet started working fine.
So to cover all the bases I am having him do the same. Better to make sure it isnt one of the many many scanners he has installed :wink:
Shane
-
Hi, Thanks. shane for your information
-
All of those programs would have been isolated in Safe Mode with Networking, so perhaps the conflict is from the attached devices ?
-
I have seen firewall drivers still block even in safe mode with networking. It is a low level driver and depends how it is configured to run. You can set what drivers and services are allowed to run in safe mode via the registry and a lot of the AV's add their drivers to the safe mode sections. :wink:
Shane
-
Normally without setting other programs to run in Safe Mode with Networking, there's usually only Windows Firewall active - although when on occasions I've booted up into that mode, I've seen my Norton 360 drivers included as the rest were loaded.
AVG can be the bane of Internet at times, especially when its AVG Secure Search add-on is running and uninstalling AVG in favour of something like MSE while trouble shooting is always a good step and using either a good uninstaller program or AVG's uninstaller to ensure no residue remains.
I'm concerned at the amount of external storage media connected while trying to trouble shoot the computer as they add too many variables - and without going back through the thread, don't know if connectivity is possible when wired using the built in LAN and without bitcomet.
Definitely needs the likes of µTorrent uninstalling and would be interested as to what else is installed on the computer.
A copy of the output of MiniToolBx with pretty much all of the boxes checked could tell us a lot - this file can be copied across the same way as the ipconfig /all was. http://www.bleepingcomputer.com/download/minitoolbox/
-
Well i have scanned all drives and am scanning god computer as well (point of note cannot boot into safe mode on good computer - it hangs at the ati file). I have uninstalled avg and adaware, rooming the virus scanners that i was told to try so there will be no virus scanners installed. So far still no internet access.
-
Can you copy across MiniToolBox from the link in my last post, check all of the boxes then post its report on here so we may be able to see what is going on ?
If the "good" computer is otherwise working okay, then the Safe Mode problem can be looked at later as it's best to work on just one machine at a time - but you could download the auto detect and install the graphics drivers if it gives you a download. http://support.amd.com/en-us/download/auto-detect-tool
If it says you're up to date and doesn't, then go Start - All Programs - right click on AMD Catalyst Control Center and select Delete then try the auto detect again.
After the drivers have downloaded, select the Custom install and click on Select All and let it do it's thing - but we need to concentrate on the original Network problem.
-
Here is the report from Minitool Boggin.
-
Thanks for that.
First or all, in Post #40 I asked you to copy across http://support.microsoft.com/kb/972034 and assumed you had run the Hosts file reset.
Unless you have added entries to the Hosts file, additional entries can be the result of an infection and resetting it can resolve Internet connectivity problems.
When you've run the MS Fixit, open a command prompt as an administrator and run these commands (again ?) -
netsh winsock reset catalog
netsh int ip reset resetlog.txt
ipconfig /flushdns
ipconfig /release
ipconfig /renew
ipconfig /registerdns
exit
Now reboot.
Hopefully this should reinstate the Subnet Mask to 255.255.255.0 that it should be and was and reinstate connectivity.
The Teamviewer errors could be because of lack of Internet connectivity.
Sometimes iTunes and Bonjour can cause connectivity problems, so a temporary uninstall of the former and stopping the latter may also need to be done if connectivity hasn't returned.
Has the licence on Stardock Multiplicity 2 expired as that could be the reason for it being stopped and if you no longer need it, then uninstall it.
Have you ever had Counterspy or Vipre installed - that's the only info I can get about SBRE and an incorrect uninstallation of either can leave residue.
I don't know what the E Rawdisk is - perhaps Shane can shed some light on that.
I think you still need to uninstall µTorrent as that could well have been the source of Citadel and can be for any other nasty.
What is the Pendrive for that you have plugged in - Drive J: ?
When connectivity is restored, Firefox, Adobe Flash Player, Adobe Reader and Java need updating.
-
Hi, Boggins. Other solutions given by you will definitely solve the problem, but uninstalling utorrent. Would it be possible. I already written about my experience in my posts on this thread. It totally stops the int con once it is removed. My modem lights were fine but the blinking light at the back would not blink. Whatsoever you try , like restore , it will not work, as there will be no restore points available. At last i resorted to reinstall the Os not repair. Then only i could see the light, that is internet connectivity. I already enclosed the link about how it could corrupt the DNS server.
What is this mini tool . can any body run like ccleaner?
-
Thanks for the bit about uTorrent, I'll have to have a Google about its safe removal.
Anyone can download/run MiniToolBox - it isn't a program like Farbar that security experts use to diagnose malware/networking issues http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
I've never really got the hang of that one - it produces two reports but I've only ever managed to find one of them :smiley:
Edit
Which method did you use to remove uTorrent ?
-
Ok i ran the microsoft FIXIT program and ran the
netsh winsock reset catalog
netsh int ip reset resetlog.txt
ipconfig /flushdns
ipconfig /release
ipconfig /renew
ipconfig /registerdns
exit
Still no connection to internet. The pendrive is a flash drive that i have all these scanner programs and utilities you have all suggested to run, i download them on good computer and run them from the pendrive on the affected computer. THe subnet mask did reset to 255.255.255.0 like you said. Do not think i have ever had counterspy installed and same with vipre (is that a antivirus program.?) Uninstalled Stardock. I was using both utorrent and bitcomet to download (if i uninstall them i need to save the torrents so i can finish downloading the programs i am trying to download, mostly videos/travel shows)
-
Just tried to run chkdsk and it will not run, says a previous installed program is preventing it from running, use system restore. But i do not have a restore point prior to this problem:(
-
I don't normally advocate using registry cleaners, but the one in the free version of CCleaner is an intelligent one and offers to make a back up which you should do. https://www.piriform.com/ccleaner/download
You could also use the Cleaner option to clear the cache - tips on using CCleaner http://www.howtogeek.com/113382/how-to-use-ccleaner-like-a-pro-9-tips-tricks/
For the registry clean, uncheck the box for ActiveX but the Missing Shared DLLs is optional.
I think you normally get those DLLs on OEM builds because of generic OS installs, but where some could use either Intel or AMD - Shane will probably know more about those and correct me if I'm wrong.
The previously installed program that is preventing chkdsk could be anything - either one currently installed or orphaned files from a previous incomplete uninstall.
CCleaner will normally root any residue out.
If you are still unable to run chkdsk /f after running CCleaner, then perform a clean boot and try it again. http://support.microsoft.com/kb/929135
I think disabling the programs in Startup should be sufficient, but you may have to disable the non MS services under the Services tab.
Run MiniToolBox again - no need to attach its report just yet, and check to see if the Hosts file has repopulated - there should only be one entry in there but if it has, then that could be the work of µTorrent or bitcomet and will have to go - neither are recommended to use and you will have to run the MS Fixit again.
Can you also check to see if that Winsock layer is still showing as broken ?
While using most P2P programs pose a risk, some of the lesser known ones could be a little bit safer - have a Google to see if you can find any alternatives to those two.
-
I sent him the info on how to do a repair install without losing his data, waiting to hear back :wink:
Shane
-
Thanks for the info Shane, but I think as long as he continues to use µTorrent and BitComet he his going to have the same problems.
If the Hosts File has repopulated, I think that will confirm that.
-
When I teamviewered in and checked I couldnt find any infections and host file was good. BUT he has over 1 TB+ of data, so a virus could be hiding anywhere.
Shane
-
Hi, Shane,
Just he says that he runs utorrent and another bit comet to download and he says that he will continue to do so. One torrent is enough to stop the internet connection . He use two. Just imagine. The torrents , from computer to computer method, will try to steal the speed when torrenting. It is universal truth. secondly, i my self experienced when i used the torrent, that my speed abnormally goes up, even than DAM or other accelerator , which normally i would not get, as my speed is regulated by the service provider as per my cost broadband plan. the thread owner does not seem to realise that torrents seek not only torrented files but also not torrent files from the connected computers. So, if i type a suggestive download, it gets that from running computers using torrent. Torrent downloaders would not forgive me for this post. But it is true. Moreover, the service provider , by any program would or would not be monitoring the speed and if regulate them. These are all torrenting tutorials, which provide you abnormal speed for torrent downloads, leaving less or nil to other internet connectivity. Am i correct? Shane
-
There was a large number of programs on the computer, and over 120+ processes running. Could have been anything.
Shane
-
Did the msconfig thing and ran ccleaner, no luck, what program can i download to run from my usb stick to do what chkdak does? Burned the win7 cd shane, going to do the repair install. How much free space do i need before i do this on the c drive? I think i may have to delte some files.
-
Hi, Delete or copy the other files from c: drive, it should contain only the system files. You could copy the other files to other drives. I think, what ever you do, the repair install would not work, if you continue with torrent downloading. The only way is to copy all the files to other drives. You have to re download the application files fresh after installation. Repair installation would not get your internet connectivity. You just format the c: drive and then re install the windows . You have to scrupulously follow the instructions in this link to avoid any problem during the installation
http://pcsupport.about.com/od/operatingsystems/ss/windows-7-clean-install-part-1.htm
The applications other than the systems have to be reinstalled. There are no ways how you could kill torrents.It is high time that you choose to copy the data and other useful files from c: drive to some other drive and then resort to clean install of windows
-
THat the problem i do not have another drive to dump this data onto (will have to buy a 5 tb drive to do this) - i have total over 12 tb of data between all my drives. Need a NAS backup system but to expensive. :(
-
So am i to assume that doing the rapair install is a waste of time ?
-
I would also like to point out that i have used both these programs to donload torrents for years with no problems. I think i got the virus problem off of demonoid site when they finally came back online as they were hacked by some jerk near the beggining of this year. I have been downloading for over 30 years and this is the first time i have had this occur. Target and Home depot have been compromised and i think that this virus that nailed them is possibly on my system. I have had bad dealings with other virus's in the pass and they were a challange to get rid of but i managed to fix them. THis what i have is a mystery and i am stumped.
-
P2P are notorious for infections and your past experience bears testimony to that.
Without going back through the thread, what was the error message you got for the failure of chkdsk and do any of these problems apply to you http://support.microsoft.com/kb/975778
Hopefully Event Viewer should have more info on its failure.
You can use this method to check the integrity of any connected HDD http://www.sevenforums.com/tutorials/433-disk-check.html
The repair install may not rid you of an infection if one is still residing as for the most part, your programs are left intact - but prior to performing a repair install, check the Networking drivers then download/save those to external media so that you can drop them into Windows\System32 when the repair install is complete.
You would normally back up the Drivers folders in System32 but there's still no telling what is blocking connectivity. http://www.sevenforums.com/tutorials/3413-repair-install.html
If you were using an OEM build then a factory reset is the most effective way of restoring a computer and so is the clean install - but both being cumbersome.
Just as a matter of interest, is the clock showing the correct time ?
I think if you are going to continue to use P2P then perhaps you should consider creating a Virtual Machine which will protect the main system from any other nasty incursions http://www.howtogeek.com/56158/beginner-how-to-create-a-virtual-machine-in-windows-7-using-virtual-pc/
-
hI,
Repair install will only replace the files of the system, where it is corrupted and not present, but in no way delete the other files present in the system directories or registries. Moreover, if one has updated some service pack, then repair install may not work. Are these information correct?
-
hI,
Repair install will only replace the files of the system, where it is corrupted and not present, but in no way delete the other files present in the system directories or registries. Moreover, if one has updated some service pack, then repair install may not work. Are these information correct?
If Shane has pointed rhuffman to the correct Win 7 ISO download site such as http://www.w7forums.com/threads/official-windows-7-sp1-iso-image-downloads.12325/page-2#post-124821 they include SP1 but the sevenforums tutorial I've linked, explains the repair install.
-
I already gave him these links to get the iso (I even downloaded the iso for him) and the guide for the repair install. And yes he has plenty of space for the repair install and no you wont lose any of your data :-)
https://sites.google.com/site/linuxlablibrary/windows-iso
http://www.sevenforums.com/tutorials/3413-repair-install.html
Shane
-
Ok this is weird, i deleted the network cards in device manager and rebooted, also did memory test and set page file to 0 and restore is set to 0. I now do not have wireless access unless i type the router key in, but i have wired connection. I do not have any bars in the inet icon in bottom right corner of screen but i do have internet access. I loaded bit comet and it is no downloading. Holy crap this is bizarre.
-
Sorry i mean it is downloading, but now it is slowing down and only 1 file is downloading.
-
Do the repair install like I asked bud :wink:
Shane
-
Am going to do today, have some time off from work:)
-
After you do the repair install you might get some errors from programs, you can ignore them because after the repair install you need to go do all the windows updates, so any program that needed .net and such will complain at first but will be fine after the windows updates are done :-)
Shane
-
Ok will do
-
Did you download and save the Network drivers to external media as I'd advised so that you could drop them into Windows\System32 after the install had completed ?
Leave Bitcomet off for the time being and see if you can connect with just the on board LAN - there's no point in risking another infection as you'll only have Windows Firewall to protect you until you install an AV program.
Providing you didn't check the box to include software when you uninstalled the Network drivers in Device Manager, Windows Update should have a Wireless driver - but it's not likely to be the latest one.
Just as a point of interest Shane, are those designated as ISOs in your link less SP1 ?
-
Boggin explain how i download the network drivers, would they not be infected as well?
-
i cannot stop the boot screen for the error for chkdsk. says autochk cannot run and then i get error message. Is there a program like chkdsk that will do what chkdsk does to fix files etc?
-
It tells me it cannot run because of a previous installed program and to use system restore. I cannot use system restore as it is turned off. I just installed Norton utilities and i cannot run a surface scan (it says the drives has errors). If i install the restore win7sp1 will i have problems since chkdsk says there are erros on the drive?
-
I could also run Spinrite (low level formatting program, but it takes a day at least or longer. It may fix the errors on the drive.
-
Hi, It seems that you are doing all the tricks in your sleeves to get back the internet. I think that your computer is invested with so many infections and missing files, that it may not be possible for you to fix. Best way is re installation and that too clean installation. I think tha you have done all the possible manual operations and ready made fixes.
-
Im a pig headed guy when it comes to fixing computers. when i was working as a tech i took on the hard to fix jobs and did not give up until i fixed it. I try everything possible before i concide defeat. Went and looked at hard drives today, have to buy at least a 4tb to back all this stuff up before i do a wipe and reinstall. Loaded Belarc today to get all serials numbers of my software etc. Man this is a major mystery, i really want to find out what the hell is wrong with this system.
-
Hey maybe i should give Leo of ask Leo a call he he ")
-
I'm like you - I prefer to fix before replace just to try and find what is wrong, but if Norton has detected bad sectors then the system files that you need for normal connectivity could be on those bad sectors and that your computer finally is infection free.
As you are able to get a wired connection, you can download your Network drivers and save them onto a Flash Drive as the ISOs don't include any drivers and then you can reinstate connectivity after you have swapped out the HDD - but if you can boot up into Safe Mode either by tapping F8 (probably) or through msconfig, select Safe Mode with Command Prompt and enter chkdsk without any parameters to see if that will run in read-only mode, as any 3rd party conflicting programs won't be loaded - whether that is µTorrent, BitComet or whatever else you have downloaded and without a timestamp on this, there's no knowing which program that could be.
That will report any corrupt files/bad sectors without repairing anything.
If that still doesn't run, HDDScan 3.3 is a program (if you are able to download) that you can run S.M.A.R.T. and other tests on and that will show if there's anything wrong with the HDD - but once a HDD develops bad sectors then it's only a matter of time before it fails completely and when you are fortunate enough to have forewarning of that - you have time to back up for a replacement. http://hddscan.com/
A chkdsk /r doesn't repair bad sectors - it just moves what data it can to the good areas of the disk, repairing any system files and marks the bad sectors so nothing else is written to them and if those bad sectors have non system data on them - then that data can be lost.
-
i have done the chkdsk in safe mode and normal mode with /r works fine. Just wondering if I do the repair install if it will fail if it hits the bad data. It is not bad sectors but corrupted data. Running spin rite is a very good way to find out if any bad sector are recoverable, it does a low level format without losing your data, takes a very long time but it works. Many bad sectors are just corrupt data. I have resurrected many drives with this program and the drives I have fixed with this program are still running fine. My torrent will not load, says wrong version of windsock and I cannot re install over it. The bit comet downloaded 3 cam movies and started to download a data program but then eventually stopped. Rest of torrent in bit comet now just say connecting, still no email and browser access, will attempt the repair install today, if that does not work then I will have to buy another 4 to 5 terabyte drive and dump the files I need to save. Ran bel arc to get all keys and data I need before install. Then re partition and format and do factory restore.
-
If you were unable to run chkdsk before in normal mode - what has changed and what did chkdsk report ?
Is this an OEM machine as you mention factory restore ?
If you format an OEM machine then you will lose the Recovery Partition.
-
Yes oem machine, operating system is on d drive partition. I made the restore dvd's when i first bought it. it is a HP I7 machine. Just ran chkdsk in windows in read only mode and it does only 3 checks and it says all is fine.
-
Then all you need to do with the current HDD, once you have backed up your personal stuff is to factory reset via the RE and there'll be no need to repair install.
I don't know which AV program HP preinstalled as bloat but you can use one of the Uninstallers from http://singularlabs.com/uninstallers/security-software/ prior to installing your preference before running Windows Updates and leave µTorrent and BitComet off until you have everything else reinstalled and then anything you do afterwards should point to the cause if lack of connectivity reoccurs.
To save from doing another factory reset, before reinstalling µTorrent and BitComet - if you must and after uninstalling the bloat, would be to create a full system image and then you wouldn't need to sit through hours of Windows Updates again.
CHKDSK in read-only also says if there's any bad sectors - did it report any ?
-
It looks like HP provide a number of ways to factory reset http://h10025.www1.hp.com/ewfrf/wc/document?docname=c01867418&tmp_task=solveCategory&cc=uk&dlc=en&lc=en&os=4063
-
Chkdsk reported no bad sectores in read only mode. I installed Norton Utilities and ran everything it has and now when i re-boot it always wants to runs chkdsk which fails because i get the error message that a previously installed program is preventing it to procede.
-
You said earlier that the chkdsk /r ran okay in normal mode - what has changed from when you first got the error message that it couldn't run because of previously installed software to being able to run it to a repeat of the error message ?
Just to confirm the HDD is okay, can you copy across that HDDScan 3.3 that I'd linked in Post #106.
It can run S.M.A.R.T. and when you click on the HDD symbol you can select a Surface Test - which takes a lot longer.
If it's just corrupt files that's causing the problem then booting up into Safe Mode > select Repair your Computer and navigate to the Recovery Environment and run either the Startup Repair up to three times if it continues to report it is unable to auto repair or select Command Prompt and enter sfc /scannow which will report what it has found/can do.
If that reports that it was unable to repair some files then an offboot sfc /scannow after booting up with the bootable install disk should fix those if needed and hopefully the connectivity problem.
-
well after Shane's help yesterday and the repair restore failing it looks like I have to do a system wipe and factory restore. Thanks for all your help guys.
-
With the amount of programs that are installed, that have been uninstalled and other problems even the repair install of windows failed, repeatedly. Each error it would give I would give him a way to fix and continue on. The repair install got all the way to installing the files and then failed yet again.
A fresh install is very much needed.
Shane
-
A repair install doesn't always work on an OEM machine - it certainly doesn't on my Toshiba.
I've tried this a couple of times and it seems to get almost to the end and at exactly the same spot, it fails and then you have to sit through while it restores the original version.
If you wipe the HDD then you will wipe the Recovery Partition and you will have a computer without an OS.
If you have back ups of what is on the computer then follow the steps in the link in Post #111 to factory reset it.
-
Was talking to a local tech from a very good computer shop here in my town and he told me that some virus can hide on the drive even when you wipe the drive, they hid in a hidden part of the drive (something like a double partition or something. He suggested i remove my drive from my pc and attach it to a usb connector and plug it into my MAC and wipe and partition it with the mac thereby nullifying the virus that may be on the hard drive, different file system than the PC and then after that put it back into the pc and do the install of windows and it will ask you to partition and format it to NTFS. He said if i wipe it on the pc and re-partition it and format that there is a possibly of the virus still be able to hide on the drive and after doing the re-partition and format it reactivates itself. Sounds strange! But god who knows.
-
I suppose you could do that but see how you get on by factory resetting it with the OEM Recovery disks or factory resetting it from within the Windows Recovery Environment (WRE).
An alternative is to scan with MBAR.
While this article pre-dates the final release of MBAR, it will walk you through the procedure to scan your full system and could be less painful to do than the work involved in either removing the HDD or a factory reset. http://www.bleepingcomputer.com/virus-removal/how-to-use-malwarebytes-anti-rootkit
-
That would be a Master Boot Record type of virus. Formatting the drive wouldn't wipe it, BUT destroying the partitions and recreating them would as a new MBR is written when you do that. No need to hook it up to a mac.
I do it with every install of Windows 7 i do. When the install gets to the point of the hard drive and where to install it, I delete every partition there is and just leave one big partition. Not only is the file system destroyed but the MBR is destroyed and recreated as well.
The MBR holds the information on how the logical partitions, containing file systems, are organized on that medium. Besides that, the MBR also contains executable code to function as a loader for the installed operating system—usually by passing control over to the loader's second stage, or in conjunction with each partition's volume boot record (VBR). This MBR code is usually referred to as a boot loader.
This is why when you destroy the partitions and create new ones the MBR gets written again, when you simply only do a format, the partitions do not change so the MBR doesnt need to be written to, so if there was a virus on the MBR then it would still be there after a format, this is why a format doesnt work.
But taking the steps of hooking the drive into a mac is not needed at all :wink:
Shane
-
anyone help him chk hosts file corruption?
-
Rick i beleive i have done that, but for review purposes how do i do that. I am almost postitve that shanes suggestion programs have done just that.
-
You've already run the MS Fixit to reset the Hosts file and Shane found it to be okay when he Teamviewered in, but you can manually check it yourself by pressing the Windows key+r then type notepad C:\Windows\System32\drivers\etc\hosts then press enter and that will open in Notepad.
You should have 127.0.0.1 localhost - that's you.
and possibly ::1 localhost - which is for computers that support IPv6
http://www.tech-faq.com/127-0-0-1.html
If it has repopulated then run the Fixit again to reset it http://support.microsoft.com/kb/972034
-
Yes the host file was fine when I looked at the file system.
I had him boot up ubuntu off a usb drive on the bad system and I teamviewered in and took a look at the drive. I wasn't able to look at the registry since I wasnt in windows, but I did check all the normal places that viruses tend to hide. Drivers, appdata, windows, all over the place. Even checked the host file and I couldnt find any virus of any kind.
But again, the amount of data on the drive was over 1 TB+ so I didnt check every folder of course, so one could have been hiding else where. But for the normal hiding spots they where all clean.
It is very possible that windows is simply shot, isnt infected but instead the registry and drivers got royally screwed to the point that a repair install wont even work.
A fresh install is a must. When windows has over 1 million + registry keys on a fresh installed system alone, not to mention if the winsxs folder gets messed up then sometimes there is no way to fix it but to start fresh. at least at that point it would be the fastest way to get back up and working.
Shane
-
Create a restore point then boot up with a Win 7 install disk - Repair your Computer and navigate to the Recovery Environment, select Command Prompt and with the following commands, the registry can be reset to default - but I'm not sure if this would take it back to pre-SP1, so a manual Check for updates would be prudent after the reboot.
I'd borrowed these commands from someone else a while back and have tried them on this laptop after creating a restore point.
After the reboot, the computer seemed slow which is why I thought it could be pre-SP1 - but it did work.
At the command prompt type c: and press enter.
Then type and enter -
copy C:\windows\system32\config\regback\system c:\windows\system32\config\system
copy C:\windows\system32\config\regback\software c:\windows\system32\config\software
copy C:\windows\system32\config\regback\security c:\windows\system32\config\security
copy C:\windows\system32\config\regback\sam c:\windows\system32\config\sam
copy C:\windows\system32\config\regback\default c:\windows\system32\config\default
Press the "Y" key after each copied file to confirm you want to overwrite the existing registry files.
Enter exit to close the command window, remove the Win7 install disk and click on Restart
-
Local host is 127.0.0.1 like you said, did your next suggestion, drive c: did not have the windows dir, it was on drive d: did all commands and it overwrote as expected. Botted and it did not work, still no access to the internet.
-
Bought a 5 terabyte drive and am going to copy all downloaded program i want to keep and the torrents to drive and then do a factory restore. This has gotten to be a impossible fix.
-
Then it isn't the registry that is causing the problem.
Did you check Device Manager that the Network adapters weren't displaying yellow alerts or red crosses ?
When you say you are going to copy all of the downloaded programs you want to keep, you can only reinstate those from a system image which would defeat the object of a factory reset as you cannot just copy a program back in.
Any programs you have will need to be reinstalled afresh after the reset, but after reinstalling your AV program then the Windows Updates, check connectivity after each reinstall or any of your files and don't do them en-bloc - as something in those must be the cause.
-
hi, rhuffman,
While installing afresh, i would request you not to have the torrents, as it is the culprit in slowing your computer or taking full download speed. I have already told thro my posts that how the torrent kills internet speed. Only Windows OS could be copied. Programs registries are written when you are installing a program or application. As Boggins suggests , You could only copy the installation effectively. For all other programs you have to reinstall. For other files, you could copy to other drives other than the OS installed drive
-
Guys I am not going to copy dirs of programs already installed, I will copy over moves and programs I downloaded from the net that are completed downloads. All games and programs I have installed I will reinstall after restore. I have a lot of TV show torrents that I want to finish downloading. I guess I can backup the torrents to other drive. Will search drive for all torrents and remove them to other drive and I will also virus scan them all. But first thing I must do is restore my 4tb drive, partitino table scrambled, will transfer those files to 5 tab drive, then wipe 4 tb drive and repartition and format it. I used bel arc to get serial numbers and info of system. This is going to be a long and painful restore.
-
Update: Rescued all files, bought 5 TB drive to back them up. Question....I have a copy of windows 8.1, if i do a upgrade install do you think it may fix this problem. Also what are your views on Win 8.1, is it worth buying ?
-
I have no practical experience of Win 8.1 so cannot offer an opinion on it but have seen a number of threads where those users have also had connectivity problems.
If you already have an 8.1 disk, why do you need to purchase ?
If you do decide to go ahead with its install, first run the 8.1 Upgrade Assistant http://windows.microsoft.com/en-gb/windows-8/upgrade-assistant-download-online-faq to check for compatibility issues and create a full system image before installing should you need to fall back.
I'm not sure how long it will be before Win 10's release and there are rumours that the Enterprise version will be offered free - with purchasable apps.
As MS are trying to put as much distance between themselves and Win 8, it's not known how long they will continue to support 8.1.
-
My copy is a downloaded copy not legit and it runs that re activate program every 180 days, not going to buy a copy especially since windows 10 is on the horizon. Was just curious if installing would possibly fix my corrupt windows. Shane suggests not to and to do the system recovery from my factory disks which i guess i will do.
-
Guys what is the link for me to download a new copy of windsock.dll for windows 7 64 bit? Been trying to find it online but no luck.
-
Guys what is the link for me to download a new copy of windsock.dll for windows 7 64 bit? Been trying to find it online but no luck.
What's happened to your existing winsock and what errors are you getting in Event Viewer ?
It's not advised to download .DLLs from the 'net as they could contain viruses.
Depending upon what error you are getting, either use your restore points back to when the error was no longer being reported and/or open a command prompt as administrator and enter sfc /scannow and let us know what it reports.
You can also download MiniToolBox and check the box for List Winsock Entries and post that so we can have a look at them.
http://www.bleepingcomputer.com/download/minitoolbox/dl/65/
Because of a recent bereavement, Shane isn't likely to be back until Monday.
-
it tells me WSAStartup() failed, or you have the incorrect version of windsock. (this happens when i try to load torrent program. When i try to load emule program i get Error initiating Windows sockets.Bitcomet loads fine. I have ran shames program and the src and all the other programs you all have suggested. I just got my modem replaced with a new 100 mb connection, so it is defiantly no the modem. I just want to get a new windsock file and try to replace it, i all need to register the file etc, need the commands to do this. I have 5 days off in mid november and if this does not work i am wiping the drive and doing a complete factory restore.
-
As Shane has already advised you to factory reset, I think that would be the best option as a sfc /scannow has failed to replace the file.
-
Hi,
A little bit of instruction. Do not know whether would work for you.
You could open with 7zip, the OS , that now you have and depending upon your windows version, you could copy the one from the installation DVD for 64 bit. Though one has only one version of the operating system, the DVD has all version of windows, but you have to select the correct version , whether ultimate verson, etc.
The same set of windows files, as in your operating system, in the same location for example if a file is in c: windows, the same will be found in the same directory. Only thing is you have to correctly choose the version and path and then it is a matter of minutes to get the copy of any dll files in to your system.
The detailed instructions are given in this wonderful link. I have succeeded in copying some of the corrupted files in the system with my own dvd. Just you have to download 7zip, to get this done
the link is
http://www.sevenforums.com/tutorials/42776-extract-files-windows-7-installation-dvd.html
You have to scrupulously follow the instruction there.
SFC scannow could correct only from the winsock or store in the downloaded os folder. If these are corrupt, then the same file will be copied from store. This is one of the alternative, which proved to be good. I have copied wanted files from the installation dvd, which have all the version on it.
-
Well guys i bit the bullet and did a factory restore, been installing all my programs and games, what a chore.
-
It can be a chew especially with all of the Windows Updates but at least you end up (in most cases) with a working computer - just be careful with P2P otherwise you'll be back to disinfecting/trouble shooting again.
-
Hi, rhuffman,
Please close the thread as solved by editing your opening post and add Solved to the title text.