Internet only works in safe mode after virus

[FXGuy3369]

I have a friends PC running Windows XP SP3, and it had some major virus infections. I ran MBAM and got 14000+, Spybot found 99 More, then I ran Combofix, I am currently running Super Anti Spyware. The machine seems to be virus clean, but it will connect in safemode w/ networking but not regular mode. I have checked everything I can think of but can't figure it out. I checked IP address, proxy settings, reset winsock, etc. If I go to cmd and ping a site like google or yahoo it pings fine. What can I do to determine my problem?
Thanks!!!

 

[Lemon law]

Not sure if it will help but my working theory is that you need to reinstall the drivers for your Network interface card, be you NIC on the mother board board or a separate add in card.

Windows safe mode runs window with generic drivers for various decices and windows regular mode uses the higher level drivers for your specific devices is my basic working theory. If your virus(s) corrupted your NIC drivers, reading in a fresh copy might solve the problem.

In my case, my NIC is on board so my NICdrivers are on my motherboard drivers disc. But if worse comes to worse, its possible to buy a NIC add on card with drivers for $15 or less.

 

[FXGuy3369]

Tried that already, also tried a usb wireless card, same thing, everything about the connection looks right but can not browse the web.

 

[Lemon law]

I am still thinking but so far its got me baffled. But for now, I might refer you to the anand tech networking subsection or any other networking forum. I do know JackMDS on the anand tech networking subsection is extremely knowledgeable about networking issues.

But if we still think your previous virus(s) corrupted software, there are so many dll's and the like, so finding the culprit may prove almost impossible. But still spyware of various varieties changes dll's as its method of infection. How many dll's and such are involved in internet connections? Changing a limited set with fresh known good copies might be doable. But failing finding the problem, we might ask how hard would it be for you to nuke the drive and reinstall windows as a last resort?

It also would be helpful to describe the networking connecting architecture of the computer in question.

And edit in suggestion, I googled the phrase "internet connections works in only XP safe mode" and got a large number of hits, you could try that the same to see if any the hits help you.

 

[aylafan]

Did you check your hosts file to make sure it was not corrupted? Also, make sure the internet browser isn't redirecting to a proxy server.

Find it at:
C: drive at windows\system32\drivers\etc

Should look like this without any modifications:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

 

[Slugbait]

Launch HijackThis and look for a proxy item emanating from HKCU...if you see a number at the end, check the box to let HijackThis fix it. That should get you back on.