Google Answers Logo
View Question
 
Q: Internet access blocked - likely virus or spyware ( No Answer,   25 Comments )
Question  
Subject: Internet access blocked - likely virus or spyware
Category: Computers > Internet
Asked by: banjobarry-ga
List Price: $2.00
Posted: 09 Nov 2004 08:08 PST
Expires: 09 Dec 2004 08:08 PST
Question ID: 426607
I have internet access at home and about a week ago, when I tryed
opening webpages in Mozilla or Internet explorer I was not able to
access any sites, I have tried on different occasions.  I suspected
malicious spyware and installed and ran Ad-Aware SE, ***it could not
receive the definition updates***.  Although I did still run a scan.

My internet connection has always worked, so I think something harmful is at work.

Now I think it's a virus that has hijacked my internet connection or
done something similar, because the connection status of my wireless
access says that signal is strong and is connected.  I am just not
able to visit any websites.

Should I check the hosts file or install AVG Anti-virus and run a full system scan?

Should I make the HOSTS file read-only?

Does the AVG 6 free edition have the latest virus definitions, or will
I have to wait until they release the 7th free version?
Answer  
There is no answer at this time.

Comments  
Subject: Re: Internet access blocked - likely virus or spyware
From: 12345a-ga on 09 Nov 2004 23:49 PST
 
So your connected but can't access the internet in two different web browsers.

Could by a firewall problem blocking web browser access.

I suspect your internet connnection is dead .

try running  

 ping your.isp.name.net.com or what ever from a console window.

If your firewall is not blocking ping then you should get some results
if your connection works.

Try rebooting your router or access point.
Subject: Re: Internet access blocked - likely virus or spyware
From: jackc-ga on 07 Dec 2004 14:12 PST
 
Hey - did you find out what's blocking your internet access?  I've got
a computer with a similar sounding problem.  It is on a home network
with other computers, sharing a DSL connection through an 8-port
router.  The other computers can get on the internet just fine.  This
one computer can ping the other computers AND ping internet servers
(such as www.yahoo.com), but can't access web pages (through either IE
or FireFox).  I tried Spybot Search & Destroy, but it can't access
it's update site.  I know of another computer with similar symptoms!
Subject: Re: Internet access blocked - likely virus or spyware
From: robertech-ga on 07 Jan 2005 19:18 PST
 
Just picked up a similar problem on my laptop, I have both a wireless
broadband and a dial ip, which are connected, but neither Explorere or
Outlook can acess the internet on either connection. Explorer always
goes to the same address no matter what I type in. I had Nortons
enabled and up to date. Has anyone else encountered this?
Subject: Re: Internet access blocked - likely virus or spyware
From: brint-ga on 08 Jan 2005 09:07 PST
 
Is this a new virus? I also have the same problem with 4 PCs connceted
to my home LAN.
The 4 computers are able to brwose the computers and access shared
files in the LAN but whenever I try to browse the internet, these 4
computers are blocked. I have firefox 1.0 and internet explorer
installed.

I was so pissed off that went to format the hard drive of one computer
and installed win98SE. But even after installation, LAN is accsible
but no internet access!

If you guys find a solution to this please advice by leaving a comment
or a link here. thanks!
Subject: Re: Internet access blocked - likely virus or spyware
From: dreamworks-ga on 25 Jan 2005 01:44 PST
 
Damn, I'm also victim of this problem. Did any of you guys find a
solution? I had internet access in the morning, and a few hours later
the internet access has become impossible (although the line is open).
Please help! Someone ...
Subject: Re: Internet access blocked - likely virus or spyware
From: burwell40-ga on 26 Jan 2005 04:50 PST
 
I too am having trouble accessing all the major search engines.  It's
a miracle I made it here on a google server.

Google and Yahoo better get the word out on how to fix this.  If it
keeps spreading, no one will be able to access their sites.  Perhaps
have Lou Dobbs on CNN tell us how to fix it.  I may never be able to
get to here again.

I have used mcafee, msoft and spybot s&d to search for this malware. 
msofts antispyware finds and removes several culprits, but the problem
keeps coming back.  Help!
Subject: Re: Internet access blocked - likely virus or spyware
From: chnet-ga on 27 Jan 2005 10:17 PST
 
OK Kids here is the deal. You got hacked by a spyware/malware bug and
when that happened the bug modified your DNS server entries and
inserted 2 ip addresses that are bogus: I found these although you may
find others. 209.47.15.118, 64.157.143.38 . You will need to check
with your ISP if you don't know your correct DNS Servers. If you find
these in your config, just delete them and all is fixed. No need to
reformat your disk.
-CK
Subject: Re: Internet access blocked - likely virus or spyware
From: akash_kava-ga on 30 Jan 2005 01:58 PST
 
Sometimes after uninstalling software, Winsock gets corrupt, or some
of the operating system components at network level stops working. It
happens due to some improper uninstallers.

In this case, we always suggest to format machine and reinstalling the
OS because there is no way to detect which part of software peice got
corrupt. Its not any virus which stops you but its mailicious
uninstaller which uninstalls something which we do not know how to
bring it back.

If you just reinstall the windows operating system or just reinstall
Internet Explorer Service pack then there is possibility that it might
solve the problem.

- Akash Kava
Our free IMAP/POP3 service at http://www.evenmail.com
Subject: Re: Internet access blocked - likely virus or spyware
From: nevesis-ga on 30 Jan 2005 19:09 PST
 
There are a number of possible scenarios. I've been dealing with this
problem on machines on a daily basis for the past 6 months. If such
software as AOL Instant Messenger, Outlook/Outlook Express, etc
connects then it is a browser problem. There are a million Browser
Hijacks that could cause this. I use HijackThis to remove them
personally - but I also know what to remove. If none of your software
will connect, but Windows says you are connected here are likely
causes:

Under your TCP/IP settings, your DNS servers may be set (static) to
malicious servers.

Your hosts file may be corrupted.

Or the most likely cause.. Winsock is corrupted. In Windows ME and
earlier Winsock was seperate from the operating system. It was easily
uninstalled and reinstalled. In Windows XP (and 2000 I believe)
Winsock and the TCP/IP stack are built into the operating system. They
cannot be uninstalled. BUT there are a number of ways to fix a corrupt
Winsock without reinstalling Windows. (reinstalling Windows should be
a LAST CASE scenario)

I suggest you first open a command prompt and type "netsh int ip reset
resetlog.txt". This will reset Winsock. If that doesn't work, download
LSPfix from http://www.cexx.org/lspfix.htm. This repair software fits
on a floppy and can fix most all Winsock2 problems.
Subject: Re: Internet access blocked - likely virus or spyware
From: banjobarry-ga on 01 Feb 2005 20:47 PST
 
CHNET (google answer user) was right, I had a computer tech fix the
problem.  It was a trojan horse that had modfied the IP addresses and
DNS entries so that my connection was being hijacked.

Possible Solutions:

1) install AVG Anti-virus (free edition) and run a full scan, if it is
a trojan horse, it should find it.

2) install and run the free version of ZoneAlarm.  ZoneAlarm is a
firewall program that helps prevent unauthorized access to your
computer by others.

3) have a computer technician call your internet service provider and
get the correct IP addresses and DNS entries to replace the bad ones.

Good Luck!
Subject: Re: Internet access blocked - likely virus or spyware
From: imjasonurnot-ga on 04 Feb 2005 06:52 PST
 
Some good fixed for this are
Windows XP With SP2

in the run command type in
netsh int ip reset 1.txt hit ok then
netsh winsock reset hit ok

or on other OS this is a great fix
http://www.supportcave.com/winsock2.html

here's what the file does

Windows 2000/XP
__________________________________________________________________________

 With Windows 2000 and XP, this was not possible, due to the fact that TCP 
could not be removed or uninstalled, and even if the Winsock keys in the 
registry were deleted, they will recreate themselves, but with no relevant 
data, therefore making them useless. 
 Some research in this matter, it was found, that these Winsock Registry keys
were not unique to any particular machine.... meaning they could be transplanted
from a working computer, to a broken one.
 Other factors can play a part in successfully restoring these winsock values, 
such as disabling the network adapter before the import of the new Registry keys. 
Also with Windows XP came the very handy "netsh.exe" with the commandline to 
Reset TCP. Although this will reset TCP settings, also removing any tweaks and 
other modifications done, it does not touch the registry Winsock keys.
The most common symptom would be a Valid IP address, but no ability to 
view any Web pages, as well as the "0.0.0.0" IP address symptom and Various
Socket Errors.

Manually Fix:

1.) From the commandline enter the following:

Netsh ip int reset resetlog.txt

2.) These 2 Registry keys will need to be replaced with known good ones.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2


The "Hosts" file. This file (having no extension) and residing in
 "C:\Windows\Hosts" for Windows 95 - Me versions and
"WINDOWS\system32\drivers\etc\Hosts" for Windows XP. Often this file 
(blank by default) can become littered with entries, and again, after the removal 
of Third Party Advertising Clients, that were installed as bundled
software with many
P2P file Sharing programs, this "Hosts" file retains entries that may
be no longer valid.
Generally resulting in some web pages and Domains coming up "Blank".

____________________________________________________________________________

The Winsockfix Utility will:
1.) Detect your current Operating System
2.) Release the IP address, taking you "Offline"
3.) Reset the TCP stack using Netsh.exe (Windows XP only)
4.) Delete the current Registry TCP and Winsock Values
5.) Import new "Working" Registry Values
6.) Backup any Current "Hosts" file
7.) Replace the "Hosts" file with a default one
8.) Reboot the Computer

____________________________________________________________________________

No one should rely on "Quick Fixes" to resolve their connection
issues, only by taking
responsibilty for the software you allow to be installed, can you
protect yourself from
re-occurring problems.
A Google search for information relating to "SpyWare" can usually point you in 
the right direction to get information on the Program you wish to install or Try. 
Chances are there will be many reviews of it, and you get a feel for
the type of program
it is,and what some of the issues with it will be from other peoples opinions.
An understanding of why some programs are "Free" in cost,but you end
up paying with
damage to your system settings, Background running Programs, whose
only purpose is to
plaque the User with non-stop Pop-up advertising, and an overall drain
on system resources.
____________________________________________________________________________
Subject: Re: Internet access blocked - likely virus or spyware
From: mak66-ga on 06 Feb 2005 19:56 PST
 
I have had this same problem, get yourself SpyBot Search & Destroy run
that , it should pick it up ( for me it was NEWDOTNET spyware ) after
it deletes the entries in the registry the problem disappears.  Hope
this helps
Subject: Re: Internet access blocked - likely virus or spyware
From: ts_green-ga on 06 Mar 2005 19:26 PST
 
I am having the same problem as JackC. Have anyone found a solution?
I am able to ping to yahoo.com or to google.com before activating
internet explorer. But once I activate IE, I lost all connections. Not
able to ping anymore. This happened only on 1 PC. My notebook, which
gets access through the wireless router is not affected.
Must be some kind of virus or spyware. I ran spybot search and
destroy, but did not help. Yes, and of course spybot could not get
access to its update site.
Anyone, got a solution? I search out my ip and dns. It is set to
autodetect, and I did not see any bogus IP address.
Subject: Re: Internet access blocked - likely virus or spyware
From: lylemsharp-ga on 09 Mar 2005 20:38 PST
 
Advotech says: Pandasoftware's Anti Virus/Spyware suite can and does
detect and repair these specific problems. 
http://www.pandasoftware.com. Courtesy of http://www.advotechllc.com
Subject: Re: Internet access blocked - likely virus or spyware
From: ts_green-ga on 15 Mar 2005 01:02 PST
 
Found out what was wrong with my internet access. But do not
understand why? Appreciate if some techie fella can enlighten me.
Apparently The problem lies with the graphics card driver. I
uninstalled the graphics card driver and downloaded and installed a
newer driver version. Once loaded it worked as a breeze. Now I can
have good access to the internet. My graphics card is from Nvidia,
Geforce 2, 128M memory.
Question is, can graphics card block access to internet? I would
expect that if a driver is not functioning properly, then there would
be problem with the monitor's display. Instead everything fucntions
well, except the internet.
Anyone, have an answer to this phenomenon?
Subject: Re: Internet access blocked - likely virus or spyware
From: spybyte-ga on 17 Mar 2005 07:33 PST
 
Just a week ago around 7th of March, my xp got affected with almost same 
problem as described by  banjobarry-ga.

The symptoms are:
            - No web pages get displayed for any of the websites
            - If we reboot the pc/xp then internet web page access 
                works fine for the first few minutes.  After that 
                it will not work. Tried both IEand Mozilla. But every
                thing in the setting seems to be fine. Checked the Tools
                 Options, etc/host etc. All the connection settings are
                proper with DHCP enabled, Automatic IP address, DNS address etc.
           
              
        though:
            - ping works fine
            - nslookup also works fine.
              it shows the correct ip address to hostname mapping
           
I tried MS Antispyware beta1 and AVG Free both found some viruses
and of course rebooted the machine. But no use. I still ended up
with the same problem.

Finally I started removing winsocks entries in the registry. After that
I could even use ipconfig and nslookup.

I tried system restore from the control panel. Wow. It worked.
I restored the system to the day where I had no problem to access internet.
After restore, the pc boots on its own and then finally, the problem is gone.
Since I restored the system to a backdate, all the visuses are also
got restored. Again used Antispyware beta1 to scan the pc to remove
all the
affected Drives. Also, used AVG Free to remove remaining viruses.

The solution:
Use system restore.
Subject: Re: Internet access blocked - likely virus or spyware
From: mercycroft-ga on 16 Apr 2005 14:49 PDT
 
I was having a similar problem. I downloaded some junk off the
Internet and suddenly my IE would not connect to google or various
other sites, but my AOL software would connect. I tried cleaning it up
in every way possible--system restore, antivirus ware, spybot,
pinging, you name it. I was due for a new computer anyway, so i bought
one, set it up and it had the SAME problem. I hand't transferred any
of my old files, so it couldn't have been malware or viruses. I read
that my IP might have been hijacked, but when i did a walk through
with my ISP tech, they said everything was fine, and my IP was
different everytime i logged on. I downloaded Hijack This, but don't
know how to use it, and i downloaded AVG anti as well, but no viruses
found.

Finally, after my third call to my ISP, they told me that the bug may
be residing in my wireless router, which goes to my non-networked
laptop, which was also experiencing the same problems. I took off my
router, and did the Winsock reset listed below, and voila--everything
is cool. I just have to call Linksys now and find out how to get the
bug out of my router, so my laptop will be internet ready again.

Hope this helps someone.
Subject: Re: Internet access blocked - likely virus or spyware
From: kerplunk23-ga on 25 Apr 2005 17:33 PDT
 
I encountered the same problem recently(can access internet by IM s/w
but not trhu browser) and when i used Spybot S&D , it found a DSO
Exploit. I fixed it by editing registry.

http://forums.net-integration.net/index.php?s=ced7824ad304d2180fc68355cd0c6cdc&showtopic=17159&st=135


But now i have a similar problem. when Spybot searches, there is not
detectable problems and no viruses found. Any ideas ?
Subject: Re: Internet access blocked - likely virus or spyware
From: gsdrbest-ga on 09 Aug 2005 11:19 PDT
 
thanks a million for the advise about resetting winsock.  The 2 step
proceedure worked in a quick minute.  I was ready to wipe the HDD and
start over.  I had even tried static IPs and putting in correct DNS
servers, still no internet but I could ping the gateway and the DNS
server.

I am the only techie in our organization, don't know what I would do
without your help!

Thanks!
Subject: Re: Internet access blocked - likely virus or spyware
From: foxmate-ga on 15 Aug 2005 12:03 PDT
 
This one might be strange.  A couple of months ago my FireFox became
unable to go on line after an update from MS website. After this, all
of my protections of anti-virus programs and ZA firewall were unable
to update. Norton AV 2005, SpySweeper, and FixIt did not detect any
problem even in safe mode, and currently all are not updated. ZA's
trueVictore is not working. I uninstalled and reinstalled all of them,
but nothing worked. I restarted the pc with the emergency CD that came
with the computer and revived it to its original factory state. The
problem continued with no change. Moreover, I cannot download anything
neither an update from MS, or download from CNet. I was able to
download some tools from major geek and some European sites. Running
these tools, I found TR/Rebootpc.B in about six files. After deleting
them, the problem I described is still there. I have communicated with
all companies, but no one has the answer. Is there someone to help
with an idea?
Subject: Re: Internet access blocked - likely virus or spyware
From: scruff12-ga on 23 Aug 2005 17:50 PDT
 
I had something pretty similar, was hoping for a suggestion.

At home, whenever I launch IE, I'm okay - but if I go to a link that
is a popup (say through a link in an email, or just a link on a
website that has their links pop open another window), the popups all
go directly to the mail.yahoo.com login page. I rebooted and this
still happened.

Then I brought the laptop into work, and everything works fine. The
popups are going where they want to. But I assume when I get home I'm
going to have the same issues as before.

Would this fix:

"Some good fixed for this are
Windows XP With SP2

in the run command type in
netsh int ip reset 1.txt hit ok then
netsh winsock reset hit ok"

Possibly be appropriate if I still have issues? Any other ideas?
Thanks for any help.
Subject: Re: Internet access blocked - likely virus or spyware
From: scruff12-ga on 23 Aug 2005 18:02 PDT
 
UGH. After about 5 minutes it started back up. Webpages all going to
Yahoo Mail's login page again, even here at work.
Subject: Re:all IE pages going to Yahoo Mail
From: banjobarry-ga on 23 Aug 2005 22:29 PDT
 
Scruff 12,

I would check your hosts file, which can be found on your hard drive here:

Windows 2000/Windows XP - C:\system32\drivers\etc\

You can right click the file and open it with Notepad to look at it.
After it's open, if you see any entries for mail.yahoo.com , then you
now know what the problem is.

If there are any such entries, delete those lines of text, or call up
a computer tech guy, and have him check out your computer if this does
not solve the problem.
Subject: Re: Internet access blocked - likely virus or spyware
From: banjobarry-ga on 23 Aug 2005 22:32 PDT
 
location of hosts file

C:/Windows/System 32/drivers/etc

this is where the hosts file will be, 

and sometimes spyware, and even trojan horses can screw up this file
so that your computer will always go to a certain website, instead of
the one you've typed in.
Subject: Re: Internet access blocked - likely virus or spyware
From: joen_ii-ga on 06 Oct 2005 06:16 PDT
 
I have just had the exact same problem. Internet connnection fine for
a while then it dies. I can ping, but any other connection is dead. I
have a router for 2 PC's. After much searching and checking I found
the solution... it was a spyware exe called sysram.exe. I found it
sitting in my c:\windows\litmus folder. Had been there for about 2
months doing nothing till now. It must of been doing something when I
disabled my network connection because the exe crashed and Windows
kindly let me know and asked if I would like to send a report.
I deleted the folder and searched and destroyed the registry for
sysram.exe. And now fully working again.

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy