Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Revert Network Settings After Running Combofix?


  • Please log in to reply
3 replies to this topic

#1 dougwilliams

dougwilliams

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:48 PM

Posted 09 February 2008 - 07:08 PM

I had a malware issue and had to ran Combofix to get rid of it. My PC is generally fine now, except for one pesky networking issue. It seems to be missing some sort of windows file or process that connects application ports to windows network services. I can have a program open up a port, and if I run "netstat -ano" from the command prompt I see that it is open and listening. However, the program doesnt respond to the network traffic. It's hitting the PC- as I was able to snoop it with Ethereal/Wireshark. Strangely - this only seems to apply to TCP connections, as far as I can tell UDP works fine.

Is there an easy file or Combofix would have disabled or deleted that I can restore? Is it possible to do a networking services reinstall?

PS - I know I could do a system restore, but Combofix apparently didnt enable System Restore before it ran, and said it made a system restore point. If it really did I cant find it or figure out how to restore it.

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,862 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:48 PM

Posted 09 February 2008 - 07:16 PM

Home network?

Just set it up again from scratch. I would also suggest uninstalling/reinstalling the NIC drivers (in case of corruption) or updating same.

You sure it's not a firewall issue of some sort? They can become corrupted also (what can't?).

Louis

#3 dougwilliams

dougwilliams
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:48 PM

Posted 09 February 2008 - 10:20 PM

Home network?


It's really a work machine on a home network. I have admin access on the machine. But when I bring it to work it's part of a domain that I dont have admin on.

Just set it up again from scratch. I would also suggest uninstalling/reinstalling the NIC drivers (in case of corruption) or updating same.


What part are you suggesting I re-set up? It's behind my router, no firewall running; and it's a laptop - so I'm really just using the router as an interface onto the net.

You sure it's not a firewall issue of some sort? They can become corrupted also (what can't?).


I have another machine behind the router as well. What I really see is when I run Shareaza, it cant get the TCP connections. I had port 6346 port forwarded on the router. If I aim the port forward to my other machine that one works fine. I reset the router, uninstalled and reinstalled Sharaza. I have a wired port and wireless, and primarily use wireless - I'll double check that this happens regardless of which NIC I use (but I'm almost sure it's all). I dont have Windows firewall running, and although I have Adaare and Network Associtae VirusScan, I dont have them running - and I cant think (or see any processes) that would be firewalling it. I ran the traffic analyzer on this machine with the problem - and I see the TCP packets come in for that port, but it says there is no destination port.

But I can do the netstat and it says 6346 is open and "listening", and the process associated is Shareaza - so it's something in between layers there I think???

#4 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:48 PM

Posted 10 February 2008 - 09:27 AM

Since this is a work computer, I'd suggest getting assistance from the IT department there. It's likely that they can backup your stuff and reinstall Windows with an image far faster than you can fix this on your own.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users