BleepingComputer.com: Internet access affected in IE, FF, MBAM, and others

I originally opened this topic in HJT logs, but there was no infection found:

http://www.bleepingcomputer.com/forums/topic201709.html

Basically, Firefox cannot access any sites, IE can access some but not all (I can access cnn.com, bleepingcomputer.com, etc.. but not mail.yahoo.com, calendar.google.com). When I put these sites in the address bar, it actually searches for them in Google. The first result that comes up is for the real site, so I click on it... and then I get a 'could not connect' message from IE.

MBAM and Ad-Aware cannot do automatic updates because there is 'no internet access' (even though there is). Winamp's online services are unavailable for the same reason.

I did a system restore to the oldest available (Feb 5), but this was about the time that the problem really started, so I am not sure that it goes back far enough.

I can access some sites via IE, as I said, and I can make SSH connections out as well. In addition, this is affecting all other users on the PC, but I know the hardware is OK because I dual boot and everything is fine in Linux. We also have other Windows (XP, I have Vista) machines on the network and they are fine.

One more strange thing... trying to boot into "Safe Mode with Networking," I cannot actually get any networking. I can't DHCP an address, and when I try to assign a static, I can't actually connect through the gateway to the Internet (though I can ping IPs on network).

Any ideas on where to start?

This post has been edited by dmslack: 18 February 2009 - 06:05 PM

I seem to have similar issues, started around the same time too. It seems like a classic corrupt tcpip stack but i've tried the usual 'netsh winsock reset' to no avail. After boot-up all my apps seem to be ok then one by one they lock up or can't connect. If Firefox locks, I can open IE and use that, other times updates fail or e-mail or Second Life etc.

When Firefox or IE7 fails I can still 'ping bbc.co.uk' even though I can't browse the site.

My problem seems to differ in that all sites are either available or not - there's no pick & choose. It's also happening across three machine (two wired one wi-fi, two Vista, one Win2k).

Only a reboot seems to cure it. I've tried may security products (AVG, Zonealarm in as standard) but various rootkit revealers, MBAM, SAS, Sophos, Kaspersky online scan, Housecall, Spybot Ad-Aware have all been used but reveal nothing.

One or two other things (odd keyboard delays, occasional erratic (slow) mouse movement, apps being reported as having been changed since the last use) all suggest some sort of infection along the lines of Confiker (tried the removal tool) but it's not being detected yet. Maybe this post needs to be relocated, moderator?

I have requested some thought from Tiscali (my ISP) but I don't think that will get me very far (I wondered if my router was corrupting the data stream). Can routers be reprogrammed by viruses?

Sorry, this is no help to you dmslack but at least two of us think something funny(not) is going on - maybe others too have been here before (or are still here) and we can start to rule things out.

Ken

Wish I could say a reboot or a restore helped. Mine is the same behavior no matter what... and I know it's not my router because the other machines are all fine... bummer, though..

Have you tried 'netsh winsock reset' (assuming that you are on XP SP2 or above)?

Do you have Blue Coat K9 protection installed?
A few ppl have disabled theirs and now everything works again, same for me!

Try it!

Thanks for the suggestions... I don't have Blue Coat K9 installed, and I have tried the winsock reset to no avail.

Ok, well... turns out it was remnants of the trial of Symantec anti-virus that came with my PC. It was fine until the program (Firefox, IE, Winamp) updated, and then it no longer allowed them to run properly. I had to uninstall the current antivirus and run the "Norton Removal Tool" to get up and running again. Looks good so far!