a virus maybe?

CDsDontBurn · Oct 16, 2005, 06:08 AM

well, today my sister aproached me earlier today telling me that she can't connect to the internet. I tried setting up her connection like i normally do (through the network setup wizard), but no avail. So, i went to set it up manually. again, nothing. Now, i'm thinking she has a virus on her computer because as i was setting up the network on her end, Norton flashed saying something about attempting to quarantine a file. So, since then, i've been thinking a virus has gotten into her rig. She doesn't want me to reformat, but i'm telling her it's really the only answer at this point. So now she's all like "well, see what you can do". So now, i'm here asking you guys what you think. Here's a pic of her task manager, see what you guys can see that shouldn't be there.

TJ- · Oct 16, 2005, 06:43 AM

why would you have to reformat? Get a real av (symantec) and quarantine or delete the virus.

You just wanted to show your desktop didnt you

edit* goto www.bitdefender.com and do a free online scan, the best scan on the net!

Necrosis · Oct 16, 2005, 06:59 AM

Exactly what Zion said..if you think virus it's always best to get two opinions from anti-virus software.

Tipstaff · Oct 16, 2005, 07:02 AM

Quote:

Originally Posted by [zi0n]aXe

why would you have to reformat? Get a real av (symantec) and quarantine or delete the virus.

You just wanted to show your desktop didnt you

edit* goto www.bitdefender.com and do a free online scan, the best scan on the net!

zion, my man, he has Norton AV.. which is from Symantec.

But your right, zion, I would try some of the online scanners to see what they come up with, or even changing it to something like AVG or McAfee to get a second opinion.

CDs, none of the apps running look suspecious to me.

You might want to try running a Winsock repair tool like LSP-Fix, or WinSock XP Fix. After you reboot run a TCP optimizing program like Speedguides TCP Optimizer. Might just be that the TCP protocols need to be reset.

Speaking of which, what type of connection is it? PPPOE, or direct (such as cable)?

Drakon · Oct 16, 2005, 07:13 AM

Actually task manager doesn't really do a good job of showing virii and trojans. I usually use an app called PrcView. Great little app and it works all the time

Tipstaff · Oct 16, 2005, 07:32 AM

Quote:

Originally Posted by Drakon

Actually task manager doesn't really do a good job of showing virii and trojans. I usually use an app called PrcView. Great little app and it works all the time

Looks like a good app. I also use HijackThis, but it's not for the squeamish.

CDsDontBurn · Oct 16, 2005, 08:19 AM

Quote:

Originally Posted by [zi0n]aXe

why would you have to reformat? Get a real av (symantec) and quarantine or delete the virus.

You just wanted to show your desktop didnt you

edit* goto www.bitdefender.com and do a free online scan, the best scan on the net!

but like i said, she can't connect to the internet

Dyre Straits · Oct 16, 2005, 08:23 AM

CDs,

My mom's rig often gets where it can't connect and I find that either AD-Aware and/or Spybot S&D will take care of it.

I think I finally got her where she uses these consistently on her own.

CDsDontBurn · Oct 16, 2005, 08:40 AM

well, i've already d/led all the stuff you've mentioned. one thing i did forget to mention is that she is on wireless and i have my connection on WEP. Now, it's always been able to connect no problem after i enter the password and whatnot, but now whenever i put in the password, it doesn't want to connect. I could test out the connection w/WEP disabled, but i don't want to run it like that 24/7 you know? I haven't yet reset my router, i'll do that next i guess. If that doesn't work, i'll run the tools you guys gave me links to, and if that don't work......dun dun dun.....REFORMAT!!!

soloz2 · Oct 16, 2005, 02:56 PM

Sometimes a simple fix when using wireless is to turn off the WEP on your router and see if you can connect like that. While you're into the settings on your router check and see if for some reason the lease expired on your siter's computer. I had a router once that didn't always renew leases for some reason. Try to manually renew it if this is the case then just watch and see what happens.

CDsDontBurn · Oct 16, 2005, 05:03 PM

hmm....well, don't really have all the time in the world ATM. i gotta start getting for work. will have plenty of time to look at this problem when i get back though for sure

The_Neon_Cowboy · Oct 16, 2005, 06:21 PM

Psst:
http://www.liutilities.com/products/wintaskspro/

CDsDontBurn · Oct 17, 2005, 05:33 AM

well, i was playing around w/my router just now, and i disabled the WEP encryption. Right after i did that, i went back to my sister's computer and had her computer connect. It connected just fine. But like i said in my one post, i don't want to leave WEP disabled cuz i don't want peeps lagging up on my bandwith and checking out my madness.

CDsDontBurn · Oct 17, 2005, 05:45 AM

update: she's reluctantly agreeing with me to actually just go ahead with the reformat

.

Son_of_Thunder · Oct 17, 2005, 06:44 AM

I wouldn't format quite yet. I'd play around with your router a bit more, update it's firmware maybe. Also, you could try deleting all of her connections in the network connections window and letting it set up a fresh one.

CDsDontBurn · Oct 17, 2005, 06:00 PM

well, i'm looking into this right now. Though the thing about this is that i don't understand why out of nowhere her computer would just stop connecting to the router. It was working fine like 3 days ago

.

Also, after i disabled the WEP encryption last night, her computer would be able to connect to the internet, but only for a short period of time. After that, it would cut off again.

niceguyrichy · Oct 17, 2005, 06:06 PM

winsock fix.

worked wonders for me in the past.

CDsDontBurn · Oct 17, 2005, 06:27 PM

i tried using all them tools everybody gave me last night, but still no avail

Vikingod · Oct 17, 2005, 06:34 PM

Did she use the latest windows updates? I heard there was some problem with them that was affecting peoples privilages and networking abilities. Read here http://support.microsoft.com/kb/909444

This may not help you out, I haven't looked into it that deeply. Good luck.

Rasta Monsta · Oct 17, 2005, 07:48 PM

Quote:

Originally Posted by CDsDontBurn

update: she's reluctantly agreeing with me to actually just go ahead with the reformat

.

I have one suggestion to help ease her pain. . .I did this on a friend's rig not long ago.

Use Partition Magic to make a nw partition on her HD, then right click "My Documents" and change location to new partition. That way, you can wipe the O/S partition, she can have a clean install AND keep most of her stuff.

rasta

Yousaif · Oct 17, 2005, 08:17 PM

Dunno if you've tried this, but an easy way to repair a damaged WINSOCK is to go to start> run and type:

NETSH WINSOCK RESET CATALOG

Hit enter and reboot.

Otherwise, I'm as stumped as you are. Unless Sygate personal firewall is running on the machine. If so then uninstall it and DL it again.

riles9262 · Oct 17, 2005, 09:56 PM

Ya I'd try the command that yousaif mentioned, it works really well if she has sp2...although I think you have to type it in the command prompt, not just the run menu.

CDsDontBurn · Oct 17, 2005, 10:47 PM

thanks guys

. i'll try that command line that yousaif mentioned

. As for copying over the "my documents" folder, i could just copy the folder over to her secondary HDD, so no worries there

. I did d/l the latest available updates on her machine only days before this had happened.

Well, like i said before, i'll give those suggestions a shot, and see if it can get back online. If not, imna go ahead and reformat the machine.

Yousaif · Oct 17, 2005, 11:29 PM

Quote:

Originally Posted by riles9262

Ya I'd try the command that yousaif mentioned, it works really well if she has sp2...although I think you have to type it in the command prompt, not just the run menu.

It works in both the run line and the command window.

I probably run that comand 5 times a day on caller's PC's. Seems that the latest spyware/adware/virii are always fubaring the winsock.

Alternately you can go into the registry and under HKEY LOCAL MACHINE> SYSTEM >CONTROL SET 001 > SERVICES delete the winsock and winsock 2 keys, reboot, then go into the local network connection and reinstall TCP/IP.

edit: But you're better off trying the NETSH command first and only going into registry as a last resort, i.e. right before you reformat

CDsDontBurn · Oct 17, 2005, 11:38 PM

Quote:

Originally Posted by Yousaif

edit: But you're better off trying the NETSH command first and only going into registry as a last resort, i.e. right before you reformat

if i would do that right before i would reformat the machine, why would i bother doing that

?

Yousaif · Oct 18, 2005, 01:05 AM

Cause it might work and make it so you don't have to reformat?

I dunno :P

CDsDontBurn · Oct 18, 2005, 01:47 AM

lol...good point

Dyre Straits · Oct 18, 2005, 05:14 AM

CDs, if it were my machine, the first thing I would try is a Repair installation. I've had to do this a few times.....as recently as this past few days. It works wonders and you don't lose any data in the process.

The only nuance I've found doing it is that you need to boot to the CD and then click on ENTER to begin the install. THEN, let it detect your current Windows folder and -- at that point -- click the Repair.

CDsDontBurn · Oct 18, 2005, 05:18 AM

yea, i know about the repair, but that to me is like a makeshift attempt on a windows install. i know that data lost will not happen, but it's best to just start over.

on a side note. I've tried the NETSH command, and the registry thing, and both to no avail have succeded.

PangingJr · Oct 18, 2005, 07:31 AM

the "netsh winsock reset catalog" command restores Winsock catalog to the default configuration. this can be useful if a malformed Layered Service Provider (LSP) is installed that results in loss of network connectivity. however, when executing the command it also remove all of the third-party Winsock LSPs, and as the result all of the third-party LSP which's previously-installed will need to be re-installed,
the number of the third-party LSPs installed on a system can be very, and yours may have a lot and the re-installation of these third-party software can take a lot of time as well. so before using the netsh command i'd suggest you check and document the third-party LSPs first.

to check the third-party LSPs installed on the system open a CMD window and type the following command line: (and press Enter)
netsh winsock show catalog >c:\lsp.txt
and then you can check in the 'lsp.txt' for all of third-party LSPs installed.
or, if you use the Lavasoft Ad-Aware SE you can also D/L and install the "LSP Explorer" add-on from the program web site. the LSP Explorer's GUI is quite good and most users should be able to understand how to use it on their first use.

Oct 16, 2005, 06:08 AM	#1
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	a virus maybe? well, today my sister aproached me earlier today telling me that she can't connect to the internet. I tried setting up her connection like i normally do (through the network setup wizard), but no avail. So, i went to set it up manually. again, nothing. Now, i'm thinking she has a virus on her computer because as i was setting up the network on her end, Norton flashed saying something about attempting to quarantine a file. So, since then, i've been thinking a virus has gotten into her rig. She doesn't want me to reformat, but i'm telling her it's really the only answer at this point. So now she's all like "well, see what you can do". So now, i'm here asking you guys what you think. Here's a pic of her task manager, see what you guys can see that shouldn't be there. __________________ Her First Day \| A year later

Oct 16, 2005, 06:43 AM	#2
TJ- DriverHeaven Extreme Member Join Date: Oct 2004 Location: Infinity Posts: 3,679 Rep Power: 0	why would you have to reformat? Get a real av (symantec) and quarantine or delete the virus. You just wanted to show your desktop didnt you edit* goto www.bitdefender.com and do a free online scan, the best scan on the net! __________________ new sig comming soon

Oct 16, 2005, 08:40 AM	Thread Starter #9
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	well, i've already d/led all the stuff you've mentioned. one thing i did forget to mention is that she is on wireless and i have my connection on WEP. Now, it's always been able to connect no problem after i enter the password and whatnot, but now whenever i put in the password, it doesn't want to connect. I could test out the connection w/WEP disabled, but i don't want to run it like that 24/7 you know? I haven't yet reset my router, i'll do that next i guess. If that doesn't work, i'll run the tools you guys gave me links to, and if that don't work......dun dun dun.....REFORMAT!!! __________________ Her First Day \| A year later

Oct 16, 2005, 02:56 PM	#10
soloz2 DriverHeaven Addict Join Date: Mar 2005 Posts: 362 Rep Power: 0	Sometimes a simple fix when using wireless is to turn off the WEP on your router and see if you can connect like that. While you're into the settings on your router check and see if for some reason the lease expired on your siter's computer. I had a router once that didn't always renew leases for some reason. Try to manually renew it if this is the case then just watch and see what happens. __________________ [COLOR=gray][COLOR=red]CPU:[/COLOR] AMD Opteron 165 CCBBE @ 2.8Ghz [/COLOR] [COLOR=gray][COLOR=red]Motherboard:[/COLOR] DFI nF4 SLI-DR Expert [COLOR=red]Memory:[/COLOR] 2gb G.Skill F1-4000USU2-2 [COLOR=red]Video:[/COLOR] Asus 7900GT TOP @ 700/1700 [COLOR=red]Sound:[/COLOR] Modded X-Fi Elite Pro [COLOR=red]HD:[/COLOR] 2x Seagate 250Gb RAID 0, 1 Seagate 320Gb [COLOR=red]Optical Drives:[/COLOR] Sony DVD-Rom, Plextor 16x DVD DL RW [COLOR=red]Case:[/COLOR] CM Stacker [COLOR=red]PSU:[/COLOR] PC Power & Cooling Silencer 610 [COLOR=red]Cooling:[/COLOR] Custom Water [COLOR=yellow][COLOR=red]Keyboard/Mouse:[/COLOR] [/COLOR]Saitec Eclipse & Logitech MX518 with a Razer ExactMat mouse pad [COLOR=red]Sound:[/COLOR] Modded X-fi > Soloz Audio Silver IC > Maxed PIMETA > Beyer DT 770 Pro/80 cans [COLOR=red]HTPC:[/COLOR] [/COLOR][COLOR=gray]AMD 3800X2[/COLOR][COLOR=gray], Asus A8N-SLI Deluxe, G.Skill 2GB DDR400, MSI 6600GT, Haupauge PVR150, SB [/COLOR][COLOR=gray]Audigy 2ZS[/COLOR][COLOR=gray], Samsung 16x DVD DL RW, Sunbeam Nuuo PSU, Antec P180 case, AC Freezer64 Pro, Viewsonic N2750w LCD HDTV Heatware eBay [/COLOR]

Oct 16, 2005, 05:03 PM	Thread Starter #11
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	hmm....well, don't really have all the time in the world ATM. i gotta start getting for work. will have plenty of time to look at this problem when i get back though for sure __________________ Her First Day \| A year later

Oct 16, 2005, 06:59 AM	#3
Necrosis HardwareHeaven Extreme Member Join Date: May 2002 Location: Ohio Posts: 8,838 Rep Power: 131 System Specs	Exactly what Zion said..if you think virus it's always best to get two opinions from anti-virus software.

Oct 16, 2005, 07:13 AM	#5
Drakon DriverHeaven Extreme Member Join Date: Jun 2004 Location: Floatin'... Posts: 4,957 Rep Power: 0	Actually task manager doesn't really do a good job of showing virii and trojans. I usually use an app called PrcView. Great little app and it works all the time

Oct 16, 2005, 06:21 PM	#12
The_Neon_Cowboy HardwareHeaven Extreme Member Join Date: Dec 2002 Location: U.S.A. Posts: 16,009 Rep Power: 92 System Specs	Psst: http://www.liutilities.com/products/wintaskspro/ __________________

Oct 17, 2005, 05:33 AM	Thread Starter #13
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	well, i was playing around w/my router just now, and i disabled the WEP encryption. Right after i did that, i went back to my sister's computer and had her computer connect. It connected just fine. But like i said in my one post, i don't want to leave WEP disabled cuz i don't want peeps lagging up on my bandwith and checking out my madness. __________________ Her First Day \| A year later

Oct 17, 2005, 05:45 AM	Thread Starter #14
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	update: she's reluctantly agreeing with me to actually just go ahead with the reformat . __________________ Her First Day \| A year later

Oct 17, 2005, 06:44 AM	#15
Son_of_Thunder HardwareHeaven Senior Member Join Date: Jun 2004 Location: Kalamazoo, MI Posts: 1,441 Rep Power: 0 System Specs	I wouldn't format quite yet. I'd play around with your router a bit more, update it's firmware maybe. Also, you could try deleting all of her connections in the network connections window and letting it set up a fresh one. __________________

Oct 17, 2005, 06:00 PM	Thread Starter #16
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	well, i'm looking into this right now. Though the thing about this is that i don't understand why out of nowhere her computer would just stop connecting to the router. It was working fine like 3 days ago . Also, after i disabled the WEP encryption last night, her computer would be able to connect to the internet, but only for a short period of time. After that, it would cut off again. __________________ Her First Day \| A year later

Oct 17, 2005, 06:27 PM	Thread Starter #18
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	i tried using all them tools everybody gave me last night, but still no avail __________________ Her First Day \| A year later

Oct 17, 2005, 06:34 PM	#19
Vikingod Int'l Fish Liaison Join Date: Jul 2004 Location: By the light of lamp I sit and type... Posts: 16,197 Rep Power: 112 System Specs	Did she use the latest windows updates? I heard there was some problem with them that was affecting peoples privilages and networking abilities. Read here http://support.microsoft.com/kb/909444 This may not help you out, I haven't looked into it that deeply. Good luck.

Oct 17, 2005, 09:56 PM	#22
riles9262 Driverheaven brewmaster Join Date: Oct 2002 Location: British Columbia, Canada Posts: 4,842 Rep Power: 72 System Specs	Ya I'd try the command that yousaif mentioned, it works really well if she has sp2...although I think you have to type it in the command prompt, not just the run menu. __________________ A beer a day keeps the doctor away.

Oct 17, 2005, 10:47 PM	Thread Starter #23
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	thanks guys . i'll try that command line that yousaif mentioned . As for copying over the "my documents" folder, i could just copy the folder over to her secondary HDD, so no worries there . I did d/l the latest available updates on her machine only days before this had happened. Well, like i said before, i'll give those suggestions a shot, and see if it can get back online. If not, imna go ahead and reformat the machine. __________________ Her First Day \| A year later

Oct 18, 2005, 01:47 AM	Thread Starter #27
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	lol...good point __________________ Her First Day \| A year later

Oct 18, 2005, 05:18 AM	Thread Starter #29
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,779 Rep Power: 235 System Specs	yea, i know about the repair, but that to me is like a makeshift attempt on a windows install. i know that data lost will not happen, but it's best to just start over. on a side note. I've tried the NETSH command, and the registry thing, and both to no avail have succeded. __________________ Her First Day \| A year later

Oct 18, 2005, 07:31 AM	#30
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 71	the "netsh winsock reset catalog" command restores Winsock catalog to the default configuration. this can be useful if a malformed Layered Service Provider (LSP) is installed that results in loss of network connectivity. however, when executing the command it also remove all of the third-party Winsock LSPs, and as the result all of the third-party LSP which's previously-installed will need to be re-installed, the number of the third-party LSPs installed on a system can be very, and yours may have a lot and the re-installation of these third-party software can take a lot of time as well. so before using the netsh command i'd suggest you check and document the third-party LSPs first. to check the third-party LSPs installed on the system open a CMD window and type the following command line: (and press Enter) netsh winsock show catalog >c:\lsp.txt and then you can check in the 'lsp.txt' for all of third-party LSPs installed. or, if you use the Lavasoft Ad-Aware SE you can also D/L and install the "LSP Explorer" add-on from the program web site. the LSP Explorer's GUI is quite good and most users should be able to understand how to use it on their first use.