BleepingComputer.com: Computer clean but still can't connect to internet

Hi!
Recently I was infected with trojan Vundo and possibly Agent. After extensive cleaning, with the help of PP, we can no longer find any trace of any infection but it has left its damage and I still can not connect to the internet. She help me upgrade to SP3. I have IE 6, Windows Pro XP (I'm not sure what other info you might need). My network connection shows connected but when I click IE I get the message "This page cannot be displayed - cannot find server". You can read everything that has been done and tried here:
http://www.bleepingcomputer.com/forums/topic200918.html

When I diagnose the network connection I get this log:
Last diagnostic run time: 02/20/09 16:15:44
WinSock Diagnostic
WinSock status

info Error attmpting to validate the Winsock base providers: 2
error Not all base service provider entries could be found in the winsock catalog. A reset is needed.
info Redirecting user to support call

Network Adapter Diagnostic
Network location detection

info Using home Internet connection
Network adapter identification

info Network connection: Name=Local Area Connection 3, Device=Realtek RTL8139/810x Family Fast Ethernet NIC, MediaType=LAN, SubMediaType=LAN
info Network connection: Name=1394 Connection 2, Device=1394 Net Adapter, MediaType=LAN, SubMediaType=1394
info Network connection: Name=MSN Explorer, Device=Lucent Win Modem, MediaType=PHONE, SubMediaType=NONE
info Ethernet connection selected
Network adapter status

info Network connection status: Connected

HTTP, HTTPS, FTP Diagnostic
HTTP, HTTPS, FTP connectivity

warn HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved
warn HTTPS: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved
warn FTP (Passive): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved
warn HTTP: Error 12007 connecting to www.hotmail.com: The server name or address could not be resolved
warn HTTPS: Error 12007 connecting to www.passport.net: The server name or address could not be resolved
warn FTP (Active): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved
error Could not make an HTTP connection.
error Could not make an HTTPS connection.
error Could not make an FTP connection.

Any and all advice would be most appreciated.
thanks
Jacque

This post has been edited by wacque: 23 February 2009 - 11:14 AM

Some reading here. Use the run commands first. Use the Tool as a last resort
http://windowsxp.mvps.org/winsock.htm

I had a similar problem that Budapest helped me resolve. Hope this helps

Instructions by Budapest

Quote

Thanks jon - btdt. Also tried all the run commands and nothing.Someone said that I probably have hidden junk in my recycle bin or system restore but PP helped me check my rootkits so I don't know. This is out of my league. I'm still fooling with it so I will keep checking on any advice.
Thanks all
Jacque

I think I'd try updating to IE 7...or doing a repair install on IE 6...or trying a different browser.

Malware tends to leave files damaged, even if removed.

Louis

Upgraded to IE7 and still nothing -- I will try a different browser next. I know my Java is outdated too but I don't know if that will make a difference?
Still open for suggestions
~j

I added Firefox and still no connection. When I ping my IP adress I am fine but when I ping my DNS server or my default gateway I get a FAIL - request timed out if that helps any. Pinging any known adresses are failed too - I get destination host unreachable.
Thanks J

What is the IP address you tried when you ping yourself?

If you go in to the command prompt(Start>Run>type "cmd") and type "ipconfig /all" could you please tell me your IP address, Default Gateway, and DNS server.

Are you going through a router or are you directly connected to you modem?

I think I've had the same problem before and after going to system32, I deleted a file named gazeyuha.dll and everything worked fine. Or you can list the items from 'last modified' and google the recent ones to see if they're a virus.

I am directly connected to a modem which was just replaced. My internet provider also replaced lines in the house and the outside cable box but still no internet. (PS I don't have gaxeyuha.dll in my system32 & PP has given me a thumbs up clean then sent me to this forum for help). Here is my ip info:


Windows IP Configuration



Host Name . . . . . . . . . . . . : home

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection 3:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast Ethernet NIC

Physical Address. . . . . . . . . : 00-20-18-D8-30-4A

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Autoconfiguration IP Address. . . : 169.254.158.83

Subnet Mask . . . . . . . . . . . : 255.255.0.0

Default Gateway . . . . . . . . . :

Your IP address is your problem...it should be 192.168.0.xxx or something very similar.

Right-click on your connection...select Properties.

In the window, scroll down to TCP/IP and put the mouse on it and then click the Properties button underneath.

Both of the options (IP and DNS) should be set for automatic detection.

Then...you might as well pull the power cord on the cable modem...count to five or so...reconnect the power cord. Wait about 2 minutes for everything to reset...see if things work properly now. First check your IP address issued.

From http://homepage.ntlworld.com/robin.d.h.wal...adip.html#ip169

If your IP address is in the range 169.254.xxx.xxx, then this indicates that the DHCP client in your computer failed to contact a DHCP server on the network, and APIPA (Automatic Private IP Addressing) is enabled, and it has automatically assigned you a private IP address in the 169.254.xxx.xxx range. With such an address, you will not be able to work with the public Internet, nor even read the cable modem diagnostic pages.

Possible causes for this are:

Your PC/Mac booted up faster than the cable modem did, and the cable modem was not ready for service by the time the PC/Mac sent out its DHCP request. You should not boot up your PC/Mac until after the cable modem has finished its start-up sequence (see Flashing Lights), or you should leave your cable modem powered on continuously.

A misconfigured firewall has prevented a DHCP lease being acquired: see Personal firewall configuration for cable modems.

You have recently swapped the computer or network interface card connected to the cable modem, and the cable modem is blocking your access to the internet.

You do not have a working ethernet/USB connection between your PC/Mac and the cable modem. Check cable and plugs, check ethernet LINK lights are lit at both ends, check ethernet speed and duplex settings.

Your PC has multiple network interfaces and it is sending DHCP requests on an interface other than the one to the cable modem. Check your network configuration.

Louis

Opps! Sorry about that. I forgot to reboot the modem when I sent the first log so I gave an incorrect ping log. I am attaching the corrected log and based on the info given I *think that I might not be connecting because my firewall went belly up with Vundo. I was using Sygate however it wasn't/hasn't been responding -- anything I clicked in it did nothing so I will uninstall it and see if that helps any. My IP and DNS settings were/are on automatic detection.


Windows IP Configuration



Host Name . . . . . . . . . . . . : home

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : hsd1.nm.comcast.net.



Ethernet adapter Local Area Connection 3:



Connection-specific DNS Suffix . : hsd1.nm.comcast.net.

Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast Ethernet NIC

Physical Address. . . . . . . . . : 00-20-18-D8-30-4A

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 69.254.140.5

Subnet Mask . . . . . . . . . . . : 255.255.252.0

Default Gateway . . . . . . . . . : 69.254.140.1

DHCP Server . . . . . . . . . . . : 68.87.66.10

DNS Servers . . . . . . . . . . . : 68.87.85.98

68.87.69.146

68.87.78.130

Lease Obtained. . . . . . . . . . : Saturday, March 14, 2009 7:08:57 PM

Lease Expires . . . . . . . . . . : Wednesday, March 18, 2009 7:08:57 PM

WOOO HOO!!! That was it. My broken firewall was blocking the internet. I'm connecting now
THANK YOU!!!!

-Jacque

Glad to see that you solved it, happy computing .

Louis