Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lost Internet connection - no IP addresses


  • Please log in to reply
33 replies to this topic

#1 xpertsue

xpertsue

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:33 PM

Posted 07 December 2011 - 08:27 AM

I have a Dell 6400 laptop, Win/XP SP3 that got a Trojan.FakeAlert (arewcmosnx.exe) bug on 12/3. Malwarebytes caught it and removed it, but now I have no Internet connection. The "radio" shows a good signal and the link says it is connected, but no browser will work. ipconfig /all does not work - says it cannot get host name. There are no IP addresses in the connection properties.

Attempting to fix it I first ran WinsockxpFix.exe to repair the IP problem. Did not fix it.

Next I asked Malwarebytes support for help. Followed all their instructions, including dds, combofix and otm. This took all day yesterday due to having to download on a working computer on the same DSL service that continues to work fine, port to a flash drive, etc. They have declared my computer to be clean of infections now.

I have tried repairing the connection many times with no change in the browser state. Note I am an experienced computer person, but this one has me stumped. I cannot "repair" XP - the only option Dell gives me is to restart at the factory state (2006!)

Can anyone offer suggestions, or should I call AT&T Dsl support now?

BC AdBot (Login to Remove)

 


#2 loque0215

loque0215

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:33 PM

Posted 07 December 2011 - 08:29 AM

I have this same problem, i being working on it for the past 3days with no solution.

#3 Rich Knapp

Rich Knapp

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:33 PM

Posted 08 December 2011 - 03:14 PM

I have the same problem connecting to the internet. My computer says it is a problem with the winsock catalog provider. The modem can't find an IP. I am on the third day with no solution.

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,337 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:33 PM

Posted 08 December 2011 - 04:34 PM

Hello and welcome..
For the connection try these...

Please click Start > Run, type inetcpl.cpl in the runbox and press enter.
Click the Connections tab and click the LAN settings option.
Verify if "Use a proxy..." is checked, if so, UNcheck it and click OK/OK to exit.
Now check if the internet is working again.

OR

Go to Start ... Run and type in cmd
A dos Window will appear.
Type in the dos window: netsh winsock reset
Click on the enter key.

Reboot your system to complete the process.

If needed : type these one line at a time, press enter after each line. See if it works after each.


netsh interface ipv4 reset
netsh interface ipv6 reset
ipconfig /flushdns
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 MSCGroup

MSCGroup

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:33 PM

Posted 19 December 2011 - 07:27 PM

Boopme

Tried all this and the problem continues. Any additional thoughts?

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,337 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:33 PM

Posted 19 December 2011 - 08:37 PM

Please download SystemLook from one of the links below and save it to your Desktop. Or to a Flash Drive or CD.
Download Mirror #1
Download Mirror #2

64-bit users go HERE
  • Double-click SystemLook.exe to run it.
  • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following box and paste it into the main textfield:
    :reg
    HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\netbt /s
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 Softscience

Softscience

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 20 December 2011 - 05:47 PM

boopme, thanks for taking the time with this.

I am having a similar problem. This Saturday I caught and presumably removed the XP internet 2012 trojan but in the process lost all web connectivity.


The network runs as I am able to access it from other computers, but not with mine. It gets stuck acquiring a network address.


I installed the systemLook program and typed in the above line.

The report generated is as follows:


(unable to open key - key not found)


PS. I'm using an XP if that matters.

#8 MSCGroup

MSCGroup

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:33 PM

Posted 20 December 2011 - 08:11 PM

I had the same issue and ended up running the repair from XP boot CD. Everything seems to back to normal, with getting an IP from my router. I also ran malwarebytes after repair and it picked up a few more malware bits...

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,337 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:33 PM

Posted 21 December 2011 - 02:56 PM

Please download Farbar Service Scanner and run it on the computer with the issue.
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,337 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:33 PM

Posted 21 December 2011 - 09:02 PM

Rich Knapp youe Malware topic has replies you have not taken action on.

Anyone else here other than Softscience still need some help?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#11 Softscience

Softscience

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 28 December 2011 - 12:12 PM

I was away for the holidays, hence the lag in reply. Here is the readout from my FSS scan. It looks worse than I thought.


Farbar Service Scanner
Ran by Ralph K (administrator) on 28-12-2011 at 09:09:23
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

NetBt Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open NetBt registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open NetBt registry key. The service key does not exist.


Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returend error: Yahoo IP is unreachable


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall"=DWORD:0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking LEGACY_wscsvc: Attention! Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
Attention! C:\WINDOWS\system32\Drivers\netbt.sys is missing.
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) PSched(7) Tcpip(4) Tcpip6(9)
0x09000000050000000100000002000000030000000400000008000000060000000700000009000000

**** End of log ****

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,337 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:33 PM

Posted 28 December 2011 - 04:32 PM

We need to fix a registry key.

Following steps involve registry editing. Please create new restore point before proceeding!!!
How to:
XP - http://support.microsoft.com/kb/948247
Vista and Seven - http://www.howtogeek.com/howto/windows-vista/create-a-restore-point-for-windows-vistas-system-restore/


Download XP.zip file from here: http://www.smartestcomputing.us.com/files/download/9-registry-network-keys/
Unzip the file.
You'll find six files inside.
Right click on afd.reg file, click "Merge".
Allow registry merge.
Restart computer, check on internet connection and post new FSS log
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 Softscience

Softscience

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 28 December 2011 - 05:57 PM

Ok, did the merge, but still no go. The NTB thing is still missing it says.

Here is the new FSS report

Farbar Service Scanner
Ran by Ralph K (administrator) on 28-12-2011 at 14:53:33
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

NetBt Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open NetBt registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open NetBt registry key. The service key does not exist.


Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returend error: Yahoo IP is unreachable


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall"=DWORD:0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking LEGACY_wscsvc: Attention! Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
Attention! C:\WINDOWS\system32\Drivers\netbt.sys is missing.
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) PSched(7) Tcpip(4) Tcpip6(9)
0x09000000050000000100000002000000030000000400000008000000060000000700000009000000

**** End of log ****

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,337 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:33 PM

Posted 28 December 2011 - 11:08 PM

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

64-bit users go HERE
  • Double-click SystemLook.exe to run it.
  • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following box and paste it into the main textfield:
    :filefind
    netbt.sys
    :reg
    HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\netbt /s
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 Softscience

Softscience

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 29 December 2011 - 01:36 AM

Thanks again for the step by step help.

Here is the report

SystemLook 30.07.11 by jpshortstuff
Log created at 22:32 on 28/12/2011 by Ralph K
Administrator - Elevation successful

========== filefind ==========

Searching for "netbt.sys"
C:\WINDOWS\$NtServicePackUninstall$\netbt.sys -----c- 162816 bytes [00:04 24/04/2009] [12:00 28/02/2006] 0C80E410CD2F47134407EE7DD19CC86B
C:\WINDOWS\ServicePackFiles\i386\netbt.sys ------- 162816 bytes [19:21 13/04/2008] [19:21 13/04/2008] 74B2B2F5BEA5E9A3DC021D685551BD3D
C:\WINDOWS\system32\dllcache\netbt.sys --a--c- 162816 bytes [12:00 28/02/2006] [19:21 13/04/2008] 74B2B2F5BEA5E9A3DC021D685551BD3D

========== reg ==========

[HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\netbt]
(Unable to open key - key not found)

-= EOF =-




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users