mac_shinobi Posted November 9, 2008 Posted November 9, 2008 no problems - also anything in event viewer ? If so post back with event id and description
srochford Posted November 9, 2008 Posted November 9, 2008 a couple of people have talked about using safe mode - this is a good idea but do you know that "safe mode" isn't always safe? Basically, safe mode starts the processes listed at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot (there are two keys under there; minimal and network which should be obvious ...) If a virus, trojan etc has added something to the lists here then that can interfere with normal operation. I would try and boot from BartPE etc disc and then use regedit to load the hive from c:\windows\system32\config\system - you can then be reasonably sure that what you're looking at is the genuine thing and not interfered with by rootkits etc. If you do see anything you don't recognise then you can delete it (you will have taken a backup copy, won't you? :-)) and then see if the machine starts OK I understand the desire to learn how to fix obscure problems but given that this machine has been virus infected you could be fighting a losing battle. It really comes down to deciding do you want to beat the virus writers or do you want a working machine? Good luck :-)
mattx Posted November 9, 2008 Author Posted November 9, 2008 I understand the desire to learn how to fix obscure problems but given that this machine has been virus infected you could be fighting a losing battle. Hmmmmm, I've been fixing PCs with Viruses / Worms for over 15 years - never ONCE have I re-built a PC because of it. All the traces of the recent virus / trojan have gone and I can say hand on my heart it's virus free - unless there is something on the EISA partition...... I'll get to the bottom of it - may even take a copy so I can see how it works as a VM.
Jay Posted November 9, 2008 Posted November 9, 2008 The EISA partition may just be an area used for the factory restore. A lot of pre-installed machines seem to have them, the fujitsu siemens laptop I was looking at the other day for instance.
mattx Posted November 9, 2008 Author Posted November 9, 2008 Tried the stinger no Joy The EISA partition is the recovery partition for it - I am quite tempted to run it !!
Jay Posted November 12, 2008 Posted November 12, 2008 Have you removed the trend micro stuff? Might be worth running some sort of cleaning tool to get all of it off. I don't know of one offhand, but cleanwipe does the job for Symantec. Also "AOE4A4.EXE" isn't one I recognise, maybe disable it it from starting as well as removing trend before doing a reboot. (Age of Empires 4??)
ZeroHour Posted November 12, 2008 Posted November 12, 2008 One thing, are you sure your hijack entry: O20 - AppInit_DLLs: karna.dat_ Is valid? that smells of malware. Also try a LSPstack viewer and see if it all checks out by checking another pc with its results.
Jay Posted November 12, 2008 Posted November 12, 2008 One thing, are you sure your hijack entry: O20 - AppInit_DLLs: karna.dat_ Is valid? that smells of malware. Also try a LSPstack viewer and see if it all checks out by checking another pc with its results. Good call, IE trojan. Troj/DwnLdr-HIW Trojan - Sophos security analysis
ZeroHour Posted November 12, 2008 Posted November 12, 2008 Also check out: C:\WINDOWS\TEMP\AOE4A4.EXE And notice your lsp stack could be borked: O10 - Broken Internet access because of LSP provider 'lsp32.dll' missing Which will break the internet probably. Try getting that file and dropping it in from a similar sp'ed pc.
Quackers Posted November 13, 2008 Posted November 13, 2008 Does it have AVG 8 on? In last 2 weeks i have had 2 people i know have this same issue, and for some reason AVG 8 was the cause. Uninstall AVG and internet worked again, re-install AVG 8 and all is still fine.
Ste_Harve Posted November 13, 2008 Posted November 13, 2008 I've had a smilar problem with a friends pc recently. Tried everything mentioned above and it still did it. I could browse the net using the ip address in the address bar but it got very tiring having to remember them!! Have you tried Malware Bytes Anti Malware? I found the problem with the PC I had was done to AVG being uninstalled and leaving some files behind. There was also a whole host of other problems on this PC so i just rebuilt it and it turned out a lot quicker than ever!!
AngryITGuy Posted November 13, 2008 Posted November 13, 2008 Had a similar issue to this last week teachers laptop would not connect to the internet at all. Didn't check to see if it was able to browse via ip addresses but it could ping domain names. Colleague here resolved the issue by replacing the tcpip file in system32\drivers to resolve the issue. He isn't around today so I can't ask him how he managed to find out that resolution or what else he tried but it may be of some use to you.
accura2000 Posted November 13, 2008 Posted November 13, 2008 have you tried IE 8 beta? just a thought. Also there used to be a program i googled a whileback called IEFix.exe but make sure you have the windows cd handy! Chris
dcart20 Posted November 13, 2008 Posted November 13, 2008 Is there a process running called PCClient.exe??
JJonas Posted November 13, 2008 Posted November 13, 2008 2nd vote for malwarebytes antispyware also try superantispyware SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!
bossman Posted November 13, 2008 Posted November 13, 2008 3rd vote for Malware Bytes Anti Malware software it does what it says on the tin absolutely brill!!
ChrisH Posted November 13, 2008 Posted November 13, 2008 3rd vote for Malware Bytes Anti Malware software it does what it says on the tin absolutely brill!! It is the best I have used. I tried all the normal ones on my last problematic machine and this is the only one that detected the problem and shifted it!
AyatollahPies Posted November 13, 2008 Posted November 13, 2008 It is the best I have used. I tried all the normal ones on my last problematic machine and this is the only one that detected the problem and shifted it! Yet software such as Adaware still gets rave reviews in the I.T press. The mind boggles. Malwarebytes saved my bacon recently. I salute it.
tumbleweed Posted November 27, 2008 Posted November 27, 2008 Long shot, but I carry a USB network adapter with me, if it's based on an ADM8511 chip it don't need any drivers for XP - stick it in, plug your cable in and see what happens. Also had something similar due to remnants of Norton Internet Security hanging around.
joolsyjoolsy Posted November 28, 2008 Posted November 28, 2008 Have a good look at your hosts file to see if that has been amended.
Sirbendy Posted November 28, 2008 Posted November 28, 2008 Is there a process running called PCClient.exe?? argh, PolicyCentral Enterprise...heh...
Guest blacksheep Posted December 2, 2008 Posted December 2, 2008 @Quackers - There is a fix for that on Grisoft website
Quackers Posted December 2, 2008 Posted December 2, 2008 @Quackers - There is a fix for that on Grisoft website Not seen that, i'll look incase somebody else has the issue.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now