[Girard]

TheSpyKiller guy helped me to get rid of some hijack virus but now I can't connect to the internet although I have access to the network file and printing is fine from and to other computers.

Computer is XP Japanese.

I think some important files were deleted while I was trying to fix the computer? I reinstalled XP about 5 times but still no luck.

PLEASE PLEASE PLEASE HELP ME.

Here is the log file
Logfile of HijackThis v1.97.7
Scan saved at 8:14:01, on 2004/03/27
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\WINDOWS\System32\CAPRPCSK.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\netdde.exe
C:\Documents and Settings\Ikuko Kondo\ƒfƒXƒNƒgƒbƒv\HijackThis.exe

F0 - syst>m.ini: Shell=
F0 - R >ystem.ini: Shel>=
F0 - R >ystem.ini: UserInit=
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: ntuser.dat
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.dat.ref.LOG
O4 - Startup: ntuser.ini
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2B5C7E2-2D4A-435B-A972-97A3C8EE4D19}: NameServer = 192.168.0.1

 

[stars1234]

Girard

You say you do have access to a LAN.

Is this a home LAN or one at an office?

If it's at an office, you may be running through a proxy to get access to the outside world. It is set in the Tools/Internet Options/Conncections/LAN section of IE.

If so, check with the system administrator for the correct proxy settings and you should be back in business as soon as their server browses and grabs your systems IP address.

If that isn't the case, we're still thinking.

 

[Bob Cerelli]

Some basic troubleshooting for Internet problems are:

1. Can you ping the gateway's IP address
2. Can you ping the DNS server's IP address
3. Can you ping an external IP address
4. Can you ping an external webiste name

 

[Girard]

Thank you for helping me.


It is an office and I am the administrator.

I assume that I can ping because I have full access to other computers and other computer have access to it. I can print to another computer and share files etc.

Something weird just happened. I got the windows update in the task bar, clicked it and was able to download a windows upgrade. It took a very long time but somehow I was connected to microsoft update. During that time I could not access the internet in the explorer browser. I keep getting the shdoclc.dll dns error message. After dowloading the update I rebooted and still no access. I am waiting to see if microsoft sends me another update.

I think that this mess was caused by me deleting some files. When I got the viruses and hacker crap I panicked and went to the program list in the control panel. I thought of deleting any new software listed by date. I think I deleted a windows update that would have appeared as a list of numbers. I thought that may have been the virus software.

Help

 

[Bob Cerelli]

Can you take the time to actually try all the ping requests. It can help determine where the problem might be.

 

[Girard]

How do I do all of the above pinging on xp?

 

[Girard]

Can you give me an external ip to ping please

 

[Girard]

How do I ping an outside homepage address?

 

[Bob Cerelli]

Pinging isn't that much different with XP as any other operating system.

Open up a command prompt (start / run / cmd)

Then "ping 199.181.164.1" - no quotes

That is an external address you can use.

But first start locally. If you can't ping the gateway, you won't be able to get much farther.

Also, how exactly are you connected to the Internet.

 

[Bob Cerelli]

Ping something like www.yahoo.com

What has been the results of the pinging by IP address. It's hard to keep making future suggestions when I don't know what has been happening so far.

 

[Girard]

This is the result from the above ping 199.181.164.1
Transmit failed. error code 65

 

[Girard]

ping 192.168.0.1 result

failed error code 65.

This is weird because I can connect to that computer and share files.

 

[Girard]

result from pinging yahoo

ping www.yahoo.com
result:
pinging www.yahoo.akadns.net with 32 bytes 216.109.117.108

failed error code 65

 

[Bob Cerelli]

If you have another protocol stack installed, then that is likely how your local network is functioning but it is also masking a problem with TCP/IP.

Have you turned off any firewalls. Zone Alarm is a common one that needs to be configured correctly. XP also has a built-in one.

Also, are you using any proxy server. That's why I previously asked how you are connecting to the Internet. Please give the details here as well.

 

[Bob Cerelli]

Again, can you ping the IP address of the local gateway? If you can't ping internally, you sure aren't going to be able to do it externally.

 

[Girard]

I have Zone alarm but I don't think it is running. I'll check.
not using a proxy server.
Simple office setup. One computer connects to the internet and the other 4 use the internet via the main computer. I used the simple wizard in xp "this computer connects to the internet through another computer"
Main computer: 192.168.0.1 (NORTON)
Bad computer: 192.168.0.4 (NOTHING)

 

[Girard]

The local gateway is 192.168.0.1 the same as the main computer and I cannot ping it.

 

[Girard]

I just uninstalled Zone Alarm and guess what......
I HAVE INTERNET ACCESS!!!!!!!!!! HAPPY HAPPY HAPPY ME.
Zone Alarm was running and I didn't know it.

Thanks guys!!!!!!

 

[Bob Cerelli]

So you are you using ICS. Can the computer that is 192.168.0.1 access the Internet as well as the rest of the computers not mentioned.

Can you temporarily either make certain ZoneAlarm is disabled on both computers or uninstall it completely. When it is misconfigured this is often the cause of problems.


Also, what other protocol stacks are installed.

There are a growing number of complications that are making troubleshooting much more difficult.

 

[Bob Cerelli]

You must have done this just before I sent that last post. It is amazing how often when it is misconfigured that is the cause of the problem. Microsoft even lists this exact scenario in their knowledge base:

http://support.microsoft.com/default.aspx?scid=kb;en-us;q316414

The solution is to configure ZoneAlarm for ICS support

Now you can remove the other unnecessary protocols since TCP/IP is really all you need.