Author Topic: Cannot get access to the internet (Read 120717 times)

rhuffman · « **on:** August 31, 2014, 09:00:45 pm »

Need major help. I cannot get onto the internet via any browser and i cannot check my email, but i can download with bit comet and get my updates with curse add-on program for WOW. I am with telus optic and they have informed me that my computer is infected with the Citidal virus. I have ran every virus program they suggested (except the online ones because no inet access via browser). I have also ran tweaking.com's program "Windows all in one Repair" and bleeping computer's network repair tool (twice). For the life of me i cannot get this fixed. And yes i have reset the windsock etc. (Windows all in one repair air does that and more)

Boggin · « **Reply #1 on:** September 01, 2014, 02:03:22 am »

Can you get a connection when you boot up into Safe Mode with Networking ?

How did Telus determine you are infected with the Citadel virus ?

If you can connect to the Internet in Safe Mode with Networking then download NPE after reading through the page https://security.symantec.com/nbrt/npe.aspx but see if using the restore points back to before this problem occurred while in Safe Mode will resolve.

As a belt & braces after running NPE also run ESET Free Online Scanner http://www.eset.co.uk/Antivirus-Utilities/Online-Scanner

Click on Advanced and check all of the boxes except the last one (for a Proxy I think) then disable your AV program immediately before hitting the Scan button.

This scan will take a little while to complete.

If you aren't able to connect while in Safe Mode etc. and the restore points don't resolve, then see if MSRT can do anything for you.

Go Start - type mrt.exe - press enter and opt for the full scan - this can take a few hours to complete.

The Citadel virus can lead to Ransomware but as you don't have an Internet connection to pay any ransom, then you won't have that.

If these suggestions get you back up and running and virus free, then I strongly advise you to create a system image onto external media.

rhuffman · « **Reply #2 on:** September 01, 2014, 10:19:35 am »

I get the same response in safe mode, can connect with bit comet and curse gets updates, cannot do internet scans as any online internet scanner says it cannot connect, i have no restore point for this issue, it was turned off. I will run the programs that you suggest but if they are online programs no go. (I have downloaded various virus programs on my other computer and put them on a flash drive and ran them, but none of them come up saying the Citidal virus is on my computer, dam stumped and i have never had this happen before, I installed a hide my ip program trial ware and then uninstalled it as i did not like it. But i do not think that it has caused this. Telus says my computer is running a bot and accessing other peoples computers and i am to disconnect my wired and wifi connections for this computer. Driving me nuts!!!!!

Boggin · « **Reply #3 on:** September 01, 2014, 03:36:15 pm »

Probably just have to wait and see if MSRT finds anything.

You get an updated MSRT with each month's Windows Updates so it doesn't have to connect to the 'net.

I don't know if you will be able to open IE without add-ons while mrt.exe is running but when you can, go Start - All programs - Accessories - System Tools - Internet Explorer (No Add-ons).

Click on the home page icon and then see if you can browse.

BTW have you tried the Internet Troubleshooter by right clicking on the WiFi icon and choosing that option to see what that reports ?

Is the WiFi icon showing as 5 bars with a yellow alert or is it just a box with a red cross on it when WiFi is enabled ?

Boggin · « **Reply #4 on:** September 02, 2014, 07:02:20 am »

There's one other thing that you can check that I forgot to mention where viruses are concerned and that is to go into Internet options through All Control Panel Items again and under the Connections tab, ensure that just the top Auto detect box is checked and that the one for Proxy is unchecked.

rhuffman · « **Reply #5 on:** September 02, 2014, 04:20:43 pm »

No yellow exclimation mark or red x, I do have partial access to the internet, have ran malty trouble shooter many times in both modes. Something is blocking my email and browser programs. Will rerun the Microsoft program you mentioned. Also have another question, is there a program that will fix partition table without losing files. Have a 4tb drive that windows says it needs formatted but it is the mft and or partition table that is scrambled, I can restore files from the drive using file recovery programs.

Shane · « **Reply #6 on:** September 02, 2014, 04:25:13 pm »

What version of windows are you on? If you are not on 8, then have you tried combofix yet?
http://www.bleepingcomputer.com/download/combofix/

And after you run it open a cmd.exe window and do two pings for me.

First one:
ping google.com

2nd:
ping 8.8.8.8

If the 8.8.8.8 gives a response but the google.com ping fails then the problem is DNS and we can go from there

Shane

rhuffman · « **Reply #7 on:** September 02, 2014, 08:49:12 pm »

I ran combo fix and i can ping both address you suggested, still cannot get my browsers and email to connect to inet, all bars on the icon are white. Runningmsrt again right now. Auto detect is set to on and the proxy setting is not ticked. Internet explorer tries to load but it disappears after a bit. Running it with no add ons is the same result. Still not able to connect browsers and email in safe mode as well.

rhuffman · « **Reply #8 on:** September 02, 2014, 08:53:35 pm »

Also it is a Windows 7 Machine I7 processor.

Boggin · « **Reply #9 on:** September 03, 2014, 12:49:38 am »

Normally when the WiFi icon is showing as normal but with connectivity problems, it's usually because of the AV program blocking - but in Safe Mode with Networking, the AV and all 3rd party programs are isolated.

The Event Viewer may have more info on this but open a command prompt as an administrator and enter -

netsh winsock reset catalog
netsh int ip reset resetlog.txt
exit

Then reboot and see what connectivity is like.

jraju · « **Reply #10 on:** September 03, 2014, 03:18:48 am »

Hi, Try this . This may help you
Re-register IEPROXY.DLL by clicking START (the win 7 icon in the bottom left hand corner of your desktop) and typing

regsvr32.exe "c:\program files\internet explorer\ieproxy.dll"

and then clicking OK.

If it doesn't find ieproxy.dll, dig around your system to find its location and if not try to get it from installation dvd. It will be available normally.

Shane · « **Reply #11 on:** September 03, 2014, 10:03:57 am »

OK so you are able to ping both the address and the IP, which means internet does work but you have something hijacking or blocking the browsers, or possibly port 80 since that is the port sites are on.

Firewall software could possibly be doing it if somehow it was blocking port 80, infections can do it and also check the proxy setting in the internet options in the control panel and make sure nothing was set there. Some infections will set the proxy server so that the browsers go through it.

Shane

rhuffman · « **Reply #12 on:** September 03, 2014, 11:42:00 pm »

Jraju did that and it was successful but still not inet connection. Settings for proxy is turned off (not selected), Auto detect settings is ticked. I am running avg free and adaware free, do these programs have a firewall setting, i looked but do not see a reference to firewall. I am running windows firewall only. I have talked to a few techs (am a tech to) and they game me suggestions, ran today Bleeping computers Junk removal tool and the program rkill and ADW. I also checked the host file and it says 127.0.0.1 localhost. Just ran spybot and ComboFix. Still nothing. Is it possible for a virus to change the settings in my teleus optic modem ? All my other computers on my network all work fine (both pc's and macs / ipad)

rhuffman · « **Reply #13 on:** September 03, 2014, 11:43:47 pm »

Boggin i also have done what you suggested many times to. Shane am at a loss here, pulling my hair out

jraju · « **Reply #14 on:** September 04, 2014, 12:01:01 am »

Hi, Rhuff
Did you notice whether the ethernet connectivity to your computer blinks with green or not. Downloading thro torrents and then stops in the middle or deleting torrents exe , in some case will make the internet connection impossible to get.
It stops the server signal by its programs. May look as funny, but i experienced the same and i have to totally format the os to get that.
If that is not, then try reregister all the internet explorer by following this article
http://downloadsnfix.blogspot.in/2013/06/how-to-re-register-dll-files-of.html
Hope this could be of help

rhuffman · « **Reply #15 on:** September 04, 2014, 12:14:44 am »

I belevie i have done that as well. Point of note i just checked Control Panel\Network and Internet\Network COnnections and my Wireless Network connection 2 is not connected it is called Microsoft Virtual WiFi Miniport Adaptor. There is a red x on it. But the other ones local are connection and Wireless Connection are connected. The former one says the device is working properly.

Boggin · « **Reply #16 on:** September 04, 2014, 02:09:13 am »

It could be the services are playing up, but open a command prompt as an admin and run sfc /scannow to see what that reports.

Event Viewer should also have some info on what is happening.

Also check that all your Network Services are Started.

Go Start, type services.msc then press Enter.

Their startup type should be Automatic or Manual.

COM+ Event System
Computer Browser
DHCP Client
DNS Client
Network Connections
Network Location Awareness
Remote Procedure Call (RPC)
Server
TCP/IP Netbios helper
Wired Autoconfig is set to manual.
Wireless Zero Configuration (XP wireless configurations only)
WLAN AutoConfig (Vista/7 wireless configurations only)
Workstation

If a service is not running, click on it to highlight then click on Start (top left).

If it fails to start then right click to open its Properties and check the Dependencies and that each of them are running.

Any of the Dependencies not listed in Services can be found in Device Manager/View/Show hidden devices/Non Plug and Play drivers and they may have a yellow alert against them.

Usually if any do have a yellow alert, some can be uninstalled by right clicking on them and selecting Uninstall and they will reinstate on the reboot, but if you need to do this, create a restore point first should they not auto reinstate and check that the restore point has been created.

jraju · « **Reply #17 on:** September 04, 2014, 04:33:20 am »

As suggested by Boggins, Try to include the event viewer log of the error id. Shane may be able to pinpoint the solution.

Shane · « **Reply #18 on:** September 04, 2014, 09:28:06 am »

It is the fact that you are able to ping google.com and pint 8.8.8.8 and you get replies from both. If the internet truly wasnt working then you would have gotten request timeout from both of them.

Any possible way for you to post a screen shot of both the ping results for me? Reason shy is I want to see what they report back. Ping goes out on a different port where wbe pages use port 80 and for https (SSL) they use port 443.

Most infections that try to hijack a connection will hijack those ports.

So just doing a quick google search for a site using a different port other than those two I found this one

http://labs.webmetrics.com:8080/

When ever you use a different port on a site you have to add it to the address, so this site I found is using port 8080, see if that page loads up for you. If it does then we know that something is blocking or hijacking port 80 and 443.

Shane

rhuffman · « **Reply #19 on:** September 04, 2014, 02:16:21 pm »

Server was turned off, what am i looking for in the event viewer?

Boggin · « **Reply #20 on:** September 04, 2014, 03:28:54 pm »

Does Event Viewer say why Server was not started or for any similar services and were you able to start it ?

rhuffman · « **Reply #21 on:** September 04, 2014, 03:56:52 pm »

it started with no problem. I tried the web address on port 8080 and it does not load, get message Unable to connect to the internet using google chrome, tried email and same.

rhuffman · « **Reply #22 on:** September 04, 2014, 04:10:43 pm »

Try number 3

Boggin · « **Reply #23 on:** September 04, 2014, 04:16:11 pm »

Have you run the sfc /scannow yet - and what did Event Viewer have on Server etc. ?

rhuffman · « **Reply #24 on:** September 04, 2014, 04:37:23 pm »

It says that it supports file, print and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. It was off i turned it on. WHat is the Microsoft Virtual WiFi Miniport Adapter for there is a red x on it. Says it is not connected. SFC did not find any problems. How do i do a tracert?