Impossible To Fix ?

[mac_shinobi]

no problems - also anything in event viewer ?

If so post back with event id and description

[srochford]

a couple of people have talked about using safe mode - this is a good idea but do you know that "safe mode" isn't always safe? Basically, safe mode starts the processes listed at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot (there are two keys under there; minimal and network which should be obvious ...)

 

If a virus, trojan etc has added something to the lists here then that can interfere with normal operation.

 

I would try and boot from BartPE etc disc and then use regedit to load the hive from c:\windows\system32\config\system - you can then be reasonably sure that what you're looking at is the genuine thing and not interfered with by rootkits etc. If you do see anything you don't recognise then you can delete it (you will have taken a backup copy, won't you? :-)) and then see if the machine starts OK

 

I understand the desire to learn how to fix obscure problems but given that this machine has been virus infected you could be fighting a losing battle. It really comes down to deciding do you want to beat the virus writers or do you want a working machine?

 

Good luck :-)

[mattx]

I understand the desire to learn how to fix obscure problems but given that this machine has been virus infected you could be fighting a losing battle.

 

Hmmmmm, I've been fixing PCs with Viruses / Worms for over 15 years - never ONCE have I re-built a PC because of it.

All the traces of the recent virus / trojan have gone and I can say hand on my heart it's virus free - unless there is something on the EISA partition......

I'll get to the bottom of it - may even take a copy so I can see how it works as a VM.

[Jay]

The EISA partition may just be an area used for the factory restore. A lot of pre-installed machines seem to have them, the fujitsu siemens laptop I was looking at the other day for instance.

[plexer]

You could also try the mcafee stinger.

 

Ben

[mattx]

Tried the stinger no Joy

The EISA partition is the recovery partition for it - I am quite tempted to run it !!

[Jay]

Have you removed the trend micro stuff? Might be worth running some sort of cleaning tool to get all of it off. I don't know of one offhand, but cleanwipe does the job for Symantec. Also "AOE4A4.EXE" isn't one I recognise, maybe disable it it from starting as well as removing trend before doing a reboot. (Age of Empires 4??)

[ZeroHour]

One thing, are you sure your hijack entry:

O20 - AppInit_DLLs: karna.dat_

Is valid? that smells of malware. Also try a LSPstack viewer and see if it all checks out by checking another pc with its results.

[Jay]

One thing, are you sure your hijack entry:

O20 - AppInit_DLLs: karna.dat_

Is valid? that smells of malware. Also try a LSPstack viewer and see if it all checks out by checking another pc with its results.

 

Good call, IE trojan.

 

Troj/DwnLdr-HIW Trojan - Sophos security analysis

[ZeroHour]

Also check out:

C:\WINDOWS\TEMP\AOE4A4.EXE

 

And notice your lsp stack could be borked:

O10 - Broken Internet access because of LSP provider 'lsp32.dll' missing

Which will break the internet probably. Try getting that file and dropping it in from a similar sp'ed pc.

[AyatollahPies]

You could have rebuilt it by now.

 

[Quackers]

Does it have AVG 8 on?

 

In last 2 weeks i have had 2 people i know have this same issue, and for some reason AVG 8 was the cause. Uninstall AVG and internet worked again, re-install AVG 8 and all is still fine.

[Ste_Harve]

I've had a smilar problem with a friends pc recently. Tried everything mentioned above and it still did it.

 

I could browse the net using the ip address in the address bar but it got very tiring having to remember them!!

 

Have you tried Malware Bytes Anti Malware? I found the problem with the PC I had was done to AVG being uninstalled and leaving some files behind. There was also a whole host of other problems on this PC so i just rebuilt it and it turned out a lot quicker than ever!!

[AngryITGuy]

Had a similar issue to this last week teachers laptop would not connect to the internet at all.

 

Didn't check to see if it was able to browse via ip addresses but it could ping domain names.

 

Colleague here resolved the issue by replacing the tcpip file in system32\drivers to resolve the issue.

 

He isn't around today so I can't ask him how he managed to find out that resolution or what else he tried but it may be of some use to you.

[accura2000]

have you tried IE 8 beta? just a thought.

 

Also there used to be a program i googled a whileback called IEFix.exe but make sure you have the windows cd handy!

 

Chris

[dcart20]

Is there a process running called PCClient.exe??

[JJonas]

2nd vote for malwarebytes antispyware also try superantispyware SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!

[bossman]

3rd vote for Malware Bytes Anti Malware software it does what it says on the tin absolutely brill!!

[ChrisH]

3rd vote for Malware Bytes Anti Malware software it does what it says on the tin absolutely brill!!

 

It is the best I have used. I tried all the normal ones on my last problematic machine and this is the only one that detected the problem and shifted it!

[AyatollahPies]

It is the best I have used. I tried all the normal ones on my last problematic machine and this is the only one that detected the problem and shifted it!

 

Yet software such as Adaware still gets rave reviews in the I.T press. The mind boggles. Malwarebytes saved my bacon recently. I salute it.

[tumbleweed]

Long shot, but I carry a USB network adapter with me, if it's based on an ADM8511 chip it don't need any drivers for XP - stick it in, plug your cable in and see what happens.

 

Also had something similar due to remnants of Norton Internet Security hanging around.

[joolsyjoolsy]

Have a good look at your hosts file to see if that has been amended.

[Sirbendy]

Is there a process running called PCClient.exe??

 

argh, PolicyCentral Enterprise...heh...

[Guest blacksheep]

@Quackers - There is a fix for that on Grisoft website

[Quackers]

@Quackers - There is a fix for that on Grisoft website

 

Not seen that, i'll look incase somebody else has the issue.