Internet discconect, but AOL AIM still function, how do you fix?

[Soccerz64]

i get disconnected from games, yet AIM remains intact...i have called my ISP and they told me their are no problems on their side, according to them my cable connection has been up and running for the last 15 days or so. i moved on and decided to see if it may have been my router, so i went to the website of d-link and downloaded the latest firmware. the firmware reset all the settings for the router, but luckly i made screenshots before installing the firmware that i was able to refer to when i put the settings back to normal. after only a few hours after upgrading the firmware i again was seemingly disconnected with IE yet AIM gave me no problems, i was able to access profiles, and IM other people and recieve IMs.

I figured it might be the ethernet wiring, or even the port it was plugged into, so i tested it out, using different cables, some longer, some shorter, all were cat 5 though, i even got rid of the 5 port switch box thinking that it may be giving me problems but still i getting the same problems. as a last attempt to fix it im here to ask for help......

Please Help mE!@!!!@!@!@!@

 

[mechBgon]

Good to hear you've got a router for firewall protection If IE can't go places, it might be that your ISP's DNS servers are flaking out at times. Try this, click Start > Run > cmd *enter* to get a DOS box, then type ipconfig /all and it should show the DNS servers. Now try the command ping 66.239.255.16 or whatever your DNS servers are. Both of them should respond. If they don't, well there ya go.

The DNS servers are who get your computer to its destination when you type in a web address like www.anandtech.com and the computer needs to know that AnandTech is at http://66.117.33.58 (actually in binary but we won't go there :Q) so it can get routed along to AnandTech's servers. Without the DNS servers, you'd need to know IP addresses.

Spyware and adware can have unwanted effects like this too. What precise brand and version of antivirus software do you have, and when's the last time you ran a full scan? How about antispyware, have you tried the free Microsoft AntiSpyware beta software? You can get it and some other stuffs here if you need.

 

[Soccerz64]

ive tried all of those, and i checked my DNS servers, i was getting a response, so i don't think thats it...

as for spyware goes i use SPYbot....

and my antivirus software is NORTon ANTI virus 2004 i believe, but i haven't gotten any updates since 10/04, cause of subscription....

but i also use this free virus scan
http://housecall.trendmicro.com/housecall/start_corp.asp

it only comes up with 3 things, every time i scan, it gives me 3 java things that are UNCLEANABLE which means i can't delete or clean cause its in use or something...

 

[stevty2889]

it only comes up with 3 things, every time i scan, it gives me 3 java things that are UNCLEANABLE which means i can't delete or clean cause its in use or something...

I would try AVG antivirus. It's also free, and it doesn't have a subscription to run out. I really don't like norton, it's full of bloat ware, and it's so commonly used, that it seems many virus's will target norton and take it out. Since trendmicro's housecall is detecting 3 things..especialy java related, that could be causing your problem..

 

[Soccerz64]

hm..yeah i don't really like the norton anti virus, i attempted to try to delete it manually since it doesn't show up in add/remove program under control panel, but i can't seem to turn off norton antivirus so i can manually delete it...

 

[ZeroRift]

 

[ZeroRift]

sorry about that

Did you try to disable any programs that are running in the background?
I know MSN messenger can get in the way, it might be that AIM is also causing issues.

 

[FlyingPenguin]

Have you power cycled your router and modem yet (power off 20 seconds, power back on)? I would assume you've rebooted the computer at least once since this started?

Are you using Comcast? Comcast has been having DNS issues off an on the past week and a half (especially at night).

Your DNS servers may return a ping, but may not be resolving URLs properly. You could try changing your DNS servers manually in your TCP/IP connection settings and see if it helps. Change them back later. A couple of good ones to use are 4.2.2.5 and 4.2.2.6. That's the backup I've been using lately since Comcast started having DNS issues.

I would not consider Spybot alone a thorough spyware scan. Actually Spybot and Adaware have been off my radar for 8 months - they fail to detect a lot of malware now.

Please look at my Spyware Removal Procedure posted here: http://theflyingpenguin.com/spyware-removal.shtml

Make sure to follow the instructions to check the HOSTS file to see if it's been compromised.

If the spyware cleaning doesn't help, you should try installing Firefox just to see if it can browse pages IE can't. That will tell you if IE alone is compromised, or your entire TCP/IP stack is compromised and would give us an idea of where to go from here.

As a last resort you should try using System Restore to take the computer back to a restore point A FEW WEEKS before this started happening and see if you get lucky.

Hope this helps...

 

[mechBgon]

The other thing you might do, since you have a router for protection, is to start up the computer in Safe Mode With Networking before you go to bed tonight, use IE to go to Kaspersky's new online antivirus scanner while you're in Safe Mode W/ Networking, and let it hammer on your rig overnight. I say "overnight" because it isn't fast (although presumably very thorough).

"Only three" viruses, is three too many. DEATH TO TEH MALWARES!!! :evil:

 

[Slikkster]

Give the LSP fix a try: http://www.cexx.org/lspfix.htm

 

[Soccerz64]

thanks for all the help, although the spyware thing, i scanned about 3-4 weeks prior to getting these IE problems, and they still showed up, im not sure if it is the spyware "java" or not.

 

[Soccerz64]

bump for help.

 

[elmer92413]

I would try to use another broswer such as Firefox, Opera, and the like...
It could very well be a problem with IE itself...

 

[Soccerz64]

well, im not familiar with any other browser...firefox if i download it will it conflict with IE, will i have to Uninstall IE?

 

[elmer92413]

No, Firefox won't conflict with IE, infact you can change your default broswer back and forth if you wanted to, and Firefox can import you favs, bookmarks, and such...
I have run both IE and Firefox on the same machine at the sametime even...
Just remeber that if you logon on to a website (such as the anandtech forums) in IE/Firefox it won't carry over the other browser...
And I don't think you could uninstall IE even if you wanted to...
I've tried with no luck...!!!
...
..
.

 

[mechBgon]

Originally posted by: Soccerz64
bump for help.

Did you try any of the advice given above? The overnight scan with Kaspersky's scanner in Safe Mode W/ Networking, or anything else? If you can identify the infected Java items by name, then please do give their names too.

 

[invalidentry]

I think its a problem with ie caused by spyware/adware. Uninstall IE and reinstall it. Or as others said grab firefox. If AIM works you never lost internet connection and therefore its specific to IE and other programs that use the same stuff.

 

[Slikkster]

Did you try the LSP Fix? (My previous post above) That's a common repair for lack of internet connectivity such as what you have.

Those recommending you just switch browsers doesn't solve anything, and is poor advice. That really irks me to read stuff like that. It's not helpful, people. There is a problem that needs addressing. No amount of Microsoft bashing is going to repair it. And Firefox is NOT the be all and end all of browsers. Every week now I'm reading about some security hole that needed to be plugged. It's a good product, but it's not infallible, nor invulnerable. Let's get off that kick and back to helping with the real issue he's having.

If someone is suggesting you download Firefox to see if it will connect vs. IE, that's one thing, but just "hey, dump IE and switch" is lame.


You, , OP, on the other hand, have said absolutely nothing about what you've tried. I would suggest you try the LSP Fix I posted above. Otherwise, good luck.

 

[Soccerz64]

i have tried the LSP fix, i downloaded it and i didn't have to remove anything, i read the textfile and it said that i could manually do it, but when it came up with the things it didn't say anything needed to be removed

i have tried everything suggested here, aside from the KASPERSKY LAB OVERNIGHT VIRUS SCAN, however i am starting right now, and hopefully it will resolve the problem.

I really am a bit confused, the inital problem seemed to have altered itself, i haven't gotten disconnected from game recently, however i haven't played as much as i use to, only 1-2 hours of recent.

i have found a sort of QUICK FIX to the IE problem, i just go to internet options, advanced tab and reset the defaults, it seems to fix the problem....but the thing is I NEVER CHANGED THE to begin with.....

 

[Soccerz64]

HOLY CRAP!!!

this KASPERSKey virus scan, found 4 viruses, and 3 infected files after only 3%....damn......

does this mean that my own antivirus is a POS?

 

[mechBgon]

Originally posted by: Soccerz64
HOLY CRAP!!!

this KASPERSKey virus scan, found 4 viruses, and 3 infected files after only 3%....damn......

does this mean that my own antivirus is a POS?

Your antivirus signatures are six months out-of-date, so that really puts Norton at a disadvantage. But Kaspersky probably is the one to beat for detection, and from what people say, it is good at not just detecting the trash, but forcibly removing it. Anyway, good luck and consider their 30-day trialware since your Norton ran out: download & suggested configuration of the trialware

When the scanner is done, could you post the names of the stuff it detected? That will help figure out what's been going on.

 

[Soccerz64]

okay its the same 3 java files I got from doing the virus scan from trend micro

Trojan.Java.Femad
Trojan.Java.Femad
Trojan-...glieder.cy

i didn't know they were trojans though....

im not sure if this is what you mean when you wanted to know what they were

cool, the scan let me delete them, hopefully this solves the problem, now i feel clean....




do those files look familiar to anyone? do you think those were causing me problems?

 

[Slikkster]

I'm not convinced they were the problem(s), as they should have only been invoked when you ran a java-based website.

If I were you, I'd run the System File Checker.

While you're in Windows, put your XP CD in the CD Drive. Exit out of the installation menu that pops up.

Now, click Start. Click Run. In the Run box, type (without quotes) "sfc /scannow" and click OK.

There is a space between sfc and /scannow.

A little box will come up with a progress bar as it checks to make sure all your system files are correct. When it's done, it will just disappear from your screen. Reboot when that happens.

(You may have to reinstall your video drivers afterwards if you're a gamer, because this will set your opengl files back to Windows defaults).

Also, download and run "HijackThis.exe". It will show everything that's running on your system, and also show anything that might be "hijacking" your browser. Get it here:

http://www.merijn.org/files/hijackthis.zip

Unzip it and run hijackthis.exe. Click the "Scan and create Logfile" (or similar verbiage).

Post the logfile results here (notepad will come up with the results of the scan. Copy and paste the results here).

 

[mechBgon]

Also, now would be a good time to get your computer fully patched.

1) install Microsoft AntiSpyware Beta, update it, and run a full scan (not just the Quick Scan).

2) visit Windows Update and patch up. Reboot as needed, then go back again and see if there's more to get.

3) if you have any Microsoft Office products, then do likewise at http://officeupdate.microsoft.com.

4) Afterwards, run Microsoft Baseline Security Analzyer and fix anything that it gives you a red X on, such as weak/blank passwords on Administrator-class accounts (all too common). When you run it, it looks like this picture (I stitched together three pics to show all the things it analyzes).

5) Get the latest version of Sun Java if you use it: www.java.com

 

[Soccerz64]

Logfile of HijackThis v1.99.1
Scan saved at 2:19:11 PM, on 4/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\lexmvservice.exe
C:\WINDOWS\System32\lexwebservice.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Patrick\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://static.vpptechnologies.com/playfulsearch/landing.html?s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_04\bin\npjava131_04.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_04\bin\npjava131_04.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004...l.trendmicro.com/housecall/xscan53.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MarkVision Server (MvServer) - Unknown owner - C:\WINDOWS\System32\lexmvservice.exe
O23 - Service: MarkVision Web Server (MvWebServer) - Unknown owner - C:\WINDOWS\System32\lexwebservice.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


lol....