urgent: complete loss of internet connection, maybe a virus?

You have been infected by W32/Rbot-MY worm.

http://www.sophos.com/security/analyses/w32rbotmy.html

Patches:

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx

http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx

http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx

I followed all of the suggestions younghv made (getting rid of registry entries involving videolan, deleting the temp.tmp items in the local directory, running nonav.exe, and running ccleaner utility), but these did not resolve the problem.  The patches ruijietan suggested are not relevant to my machine since I'm running SP2 -- attempts to load these patches were rejected because they are older than SP2.

Sadly enough, the problem is still with me.  Hopefully I'll get more suggestions.

Thank you for trying, younghv and ruijuetan.

Andy

Below is a copy of your HijackThis analysis.  As younghv stated you have an issue with "videolanplayer" which requires 'fixing', but you could also take a look at the 18 "unknown" processes and see if you recognise their descriptions.  Then consider 'fixing' them.  See if that helps.
Ideally you should create a folder where you would like the HijackThis file to reside, and run it from there, not from the Desktop or a temp folder. It is important that you download this file to its own folder as this folder will be used when HijackThis makes backups. Temp folders get deleted, taking with them HJT's 'backups' of items that were 'fixed'.

http://www.hijackthis.de/logfiles/c3cf248040ad04ed480ff83a8a3f0f22.html

You can use the search function here to identify a particular "exe file".  Several of the unknown processes do appear harmless, but you may want to check them out yourself.  Investigating further:

http://www.processlibrary.com/directory/files/pmproxy/

If you haven't yet tried this Norton 'cleanup' >

"Using the Norton Removal Tool":
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039?Open&src=&docid=2001092114452606&nsf=nav.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=&seg=&seg=hm

Suggest you also download and run this free version of Ewido anti-malware.    
Update first, then scan in Safe mode:  
http://www.ewido.net/en/download/

Status update, related to suggestions from Jonvee:

All of the videolan registry entries have been removed.  17 of the 18 unknown processes from the HijackThis report are accounted for (oracle db, network tools, print tools, sound utility, etc.).  The one that is not, the tmp.exe entry, has been removed.  I ran Ewido's full scan, but it didn't discover anything.  The Norton Removal Tool cannot be run, because it demands a network connection (which, of course, I do not have).

The machine still has no internet connectivity.  It's even worse now:  after a run of Winsock Repair and a reboot, now even that doesn't provide a brief moment of internet connection.

Thanks for your ideas, Jonvee, but alas, I am still unable to connect to the internet or other machines on my home network.  This is very frustrating.

Andy

Ok thanks.  Well Ewido is excellent and it's good you've got a clean report.  
However, *if* you get no further satisfactory comments, you may wish to consider a Repair Install.  
This is a particularly popular link for the repair. Please note the appropriate warnings, and if you do procceed with the repair install you will naturally have to redo all updates, etc..  
[Still considering other possible moves on your issue.]
 
"How to Perform a Windows XP Repair Install":
http://www.michaelstevenstech.com/XPrepairinstall.htm

Took another look at your problem & found this >
 
"No Internet Connectivity After Uninstalling Norton AntiVirus Software":

Fixing this requires editing the Registry to remove the dependency for DHCP start up.
 
Click Start > Run.
Type "regedit" in the Run box, click OK.
Locate the following keys in the registry:
HKEY_LOCAL_MACHINESystemCurrentControlSetServicesDHCP
HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNetBT
For each of the above, double-click the item DependOnService.
Delete any references to SYMTDI or NISDRV.
Click File and Exit to save the changes and close the Registry Editor.
 
The computer will need to be restarted before the changes will take effect.

Details >>   http://8help.osu.edu/1552.html

When you say 'winsock' repair, are you running the command:
netsh winsock reset (enter)
from Start --> Run or from a command line?

Also - the nonav.exe should have removed any reference to any Norton/Symantec product everywhere on you computer - including the Registry.

If you still have Registry residue, run the 'Issues' function in CCleaner (www.ccleaner.com).
You may have to run it 2-3 times, re-boot and run it again.
Very good product in the XP environment.

Keep at it, we'll get there.

Vic

Following Vic's entry querying 'winsock' repair, you may like to view this next link, there may be something we've missed >

"How to repair Winsocks":
http://www.alaynah.net/shehar/repair_winsock.htm

The winsock repair I referred to is a utility called winsockxpfix.  I got it from a previous solution posting (for someone else's problem):

> Comment from SheharyaarSaahil
> Date: 09/01/2004 10:14AM MDT
>     Comment    
>
> Hello netadmin2004 =)
>
> Try running this Winsock Repair for XP:
> http://www.spychecker.com/program/winsockxpfix.html

It didn't solve my problem.  Nor did CCleaner, which I have run many times now.

I just tried the solution Jonvee suggested, but my registry has no references to SYMTDI or NISDRV at those keys.  While I was looking in the registry, I verified that there are no references to any keys that have 'norton' or 'nav' as names or values.  nonav appears to have done the job.  Unfortunately, the machine still has no internet connectivity.

Thanks for continued suggestions.  Hopefully we will get there!

Andy

From a command prompt, what do you get when you use the command "ipconfig /all" (enter)

If you're not getting an IP address ALMOST identical to your other computer, take a look at this advice:

http://www.petri.co.il/reinstall_tcp_ip_on_windows_xp.htm

All of your DNS and Default Gateway settings should be identical to your other computer(s).


Vic

I get exactly the IP address the dlink router says it has assigned, which is a final .100 (while the desktop is a .102 -- otherwise all the digits are identical).  And the DNS and Gateway settings are identical, with one exception:  the laptop does not have this line, which the desktop PC does have:

   DNS Suffix Search List..................... : KOTONA

which is the name of my workgroup.  Could this be part of the problem??

... by the way:  the laptop still lists its as part of the workgroup KOTONA.

try this again:

... by the way:  the laptop still lists its workgroup as KOTONA.

I don't think that is a problem, but you can configure your TCP/IP properties to add the suffix.

Before that, have you tried the command:
(ipconfig /flushdns)
Then stopped/restarted the DNS client?

try this again:

... by the way:  the laptop still lists its workgroup as KOTONA.

Darn, I was wrong about something I last sent out!  Turns out that the IP address the laptop is getting has been changing to different routers.  My next door neighbors must also have routers that the laptop is able to pick up on.  It has apparently been shifting away from my own router to routers of neighbor(s).  Such activity has never happened before this most recent Norton fiasco.  I never asked to drop my own router and switch to a different one.  Now that I can see it happening I'm able to manually request a return to my own router.  This must be what had been happening when I rebooted after a winsock repair, got connectivity for a short bit, but then "lost" the connection again.  Losing the connection was probably just switcing the connection to a router across the street, one that caused connection problems for my own machine.

This is new behavior.  Any idea why this has been happening??

I would set up the security for your router.  If questions remain, tech support is always available from the manufacturer of the router.

But the router itself doesn't seem to be the problem.  The desktop and other two laptops in my home network have not had any problems at all during this one machine's crisis moments.  Seems like the problem is a single laptop going to other routers for dpcp ip assignment, and these other routers that are not in my house. Is there a way to *make* this one laptop look fora connection with only one specific router?  

Perhaps this should be posed as a new question.

Andy

Aha!
Wireless.
The only times I've set up wireless connections, I created a unique name for the connection to help sort through all of the various neighbor's open connections.
Don't you physically select which wireless connection you want to make?

You can definitely manually select a connection.  You can even sort the available connections in a preference list.

Until this past week, the router that came up by default is the router in my home.  What's happening now is that even after manually selecting the home router, the laptop ends up dropping it and going over to a different router.  This is new behavior.  One guess is that the laptop would only do that if it's having trouble connecting to the router manually chosen.  If that's the case, then this new behavior could be due to new connection problems the laptop developed in the process of getting rid of Norton.

Any thoughts?

Andy
You could take another look at your router wireless settings.
Have you phyically repositioned the wireless router during troubleshooting so that it is somehow "seeing" a larger signal level from your neighbour's router?  
Can you easily reposition the router if so?   Even consider some form of extra RF shielding between your walls(& routers).  
Are conditions the same if you use your laptop in other parts of your house?
 
You could consider temporarily by-passing your router/home network, and connect the laptop direct, to confirm internet connection.

Hi Andy,
Any luck with the direct connection?
If that works, make sure you have any and all critical patches installed and check the Toshiba web site for any specific updates/patches for your notebook.
Vic

There is a serial number on the bottom of the router.  This would prevent the behavior in which you describe connection problems the laptop devloped in the proccess of getting rid of Norton.  As younghy said in the above post "check with your manufacture's web site"  Check for firmware updates.
You can also call your router manufacture's support staff, they can walk you through set up of the router.

d_may

I'll definitely see what DLink (the type of router I have) and/or Toshiba say about this sort of problem.

How would a serial number on the router help here?


Andy

The router *model* (or type) number may be of more use, perhaps thats what d_may is after, although you could also make a note of the serial number if it's visible.

Firmware updates can certainly be crucial to a router's operation.
   
You may well find sufficient re-setting up instructions if you logon to the router as "admin", on the associated "help page".

Then if you still have a problem and you can make that *direct* internet connection as suggested above, hopefully you could download and run the Norton removal tool mentioned earlier.

I dare say if your neighbor had his  security set up on his router connection (WEP) then your computer would not be able to set it as a connection.  You can set the order or delete his connection.
You need a firmware update.  You need to set your security.  Then as mentioned above your could run the Norton removal tool.
start>run>"type" ipconfig           What do you see as an address?

A few more similar items to consider.   Is the laptop set to Automatically obtain an IP address?

Following on from the above suggestion you could also run the command "ipconfig /all" from a DOS prompt.  
Then run the same command on another computer, and compare the results.

What is the value for "DNS server" on the laptop?    

Can you see the Default Gateway IP?

Sorry for the delay.  

As of last night, the connection via my router would work for a while, then out of nowhere the network connection would switch to some other router somewhere else and the ability to connect to the web with a browser disappeared.  When I rebooted the laptop, it would come back up and connect to my router.  Chances are it would've floated off again, though I was too tired to wait up and find out.

On booting up today, it connected to my router.  So I followed ealier advice while I could and went to Norton's site and used their removal tool, and rebooted again.  The network connection went to my router.

If the connection stays with my router for the rest of today, I'll go ahead and close this question.

Thanks for all the suggestions.

Andy

Good.  Thanks for the report it certainly sounds much better.    
*If* the problem did recurr, another suggestion is to download then install and run this cleanup tool:

http://ca.huji.ac.il/bf/mcafee/NoNav.exe

This will remove NAVCE and Symantec AV versions 4, 5, 7, 8, 9, SCF, SSC, and AMS from your file system and registry.   Reboot once again.

NoNav.exe has been a life saver for us.
Here is the actual link to the Symantec version (they don't publicize it's existence very well).

Check the dates of the files and grab the latest version:


(http://symantec.netvision.net.il/Enterprise/Removal tools/)


I am showing version NoNav2.48.exe

Vic

Vic
       http://symantec.netvision.net.il/Enterprise/Removal tools/

Couldn't access your link, but after inserting "%20" it now seems ok >

       http://symantec.netvision.net.il/Enterprise/Removal%20tools/

Jonvee

Jonvee,
Thanks - I guess the space between Removal and tools is dinking up my hyperlink.

Whatever that "%20" does, I now have it in my sample link.

Thanks for the assist.

Vic

The problem continues.  Here's an update.

I had already run NoNav2.48 a few days ago.  But I went ahead and ran it again.  And I downloaded the tool from http://symantec.netvision.net.il/Enterprise/Removal%20tools/ and ran it too.  Earlier this morning I updated the firmware for my DLink router to the most recent firmware version.  And, of course, after each step, I rebooted the laptop where the problem are showing up.  Still, no luck.  The problem laptop has again left the home router and gone to a neighbor's.

A bit more background.  The laptop with this problem is my wife's.  The laptop that hasn't had this problem at all is mine.  They are both Toshiba Satellites, though hers is a slightly more recent model.  I've always had PC-cillin on my laptop.  My wife for a long time had Norton AntiVirus.  It was problems with Norton that started this whole router fiasco.

Our router's connection name is 'Jaeren'.  Here's what the IP, Gateway, and DNS info looks like for me (and for my wife, during those short-lived moments before her machine goes to a different router):

        IP Address. . . . . . . . . . . . : 192.168.0.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 192.168.0.1

Here's what that same info looks like for my wife's machine once it heads out to some other router, a connection with a different name ('linksys', probably the brand name of the neighbor's router):

        IP Address. . . . . . . . . . . . : 192.168.1.101
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 192.168.1.1

The two sets of numbers are all just one digit away (except for the Subnet Mask):  

      ...0.101 / ...0.1
vs.
      ...1.101 / ...1.1


I truly don't understand why my wife's laptop is leaving our router to go to some neighbor's router.  The two machines are about 20 feet from each other.  The only difference I can think of is that she used to have Norton.  I manually deleted this neighbor network connection from the problem laptop, but the connection was re-acquired.  I don't know how to keep it from happening again.

Any ideas?

Andy

Still periodically investigating ...

On your wife's laptop you could check the router 'Basic Settings'.  
Presume the Internet IP address and DNS address are set to "Get dynamically from ISP" and "Get Automatically from ISP" respectively?

Has the router any mechanism to set the IP address to 192.168.0.1 *manually* in the hope that it's retained while you're accessing the internet?

Another suggestion is to change to a wireless channel that your neighbour is not using.  
If you can see that you are both using the same (or adjacent) channels, try resetting your router to a different channel, and see if this interaction still exists.  
You should be able to logon to the router as "admin", then check the menu for 'wireless settings' (or an equivalent), and hence find the channel selection facility.

Andy
Is your wife's laptop fully updated with MS updates, and are both your laptops identical in most other respects, eg, both running SP1 or SP2?

You could again consider temporarily by-passing your router and connect her laptop direct, to confirm internet connection.
Then run a series of checks including a check for viruses and Malware until you are happy with the laptop's health.

That's a good question.  I should've said this before:  both laptops are running SP2, on XP Pro.  PC-cillin is now running on her laptop, and is showing no viruses or Malware.

There's no question that her laptop can connect to our router.  The problem is just that it very often wanders off to a different router (where there are apparently some DNS problems over there -- but that's not our problem, or, at least, it shouldn't be).  Her laptop can be manually forced back to our router, though.  In fact, a new twist started yesterday:  after the machine wandered off to a different router, it actually drifted back to our router with no manual intervention.  That was good to see, I suppose, but we'd like to see it stick with our router all the time.

This seems like a broader question.  Nonetheless, it's still striking that the "router wandering" never happened at all before the problems with Norton came up.  It seems like the only thing left to try is to do a full re-install of her OS, and never let Norton see the light of day on the machine.  A dreadfully painful tactic, but perhaps it's the only solution that would work.

Andy

Andy,
Have you tried setting "Static IP Addresses" on your computers.
I know that you shouldn't have to, but it would stop the 'wanderlust'.

Vic

That's a good idea.  I'll give it a shot and report what the results are.

Well, that strategy didn't work.  When ipconfig /all is run, the IP shows up with the correct, statically assigned number.  Nevertheless, the network connection itself still wandered over to a different router.  And, of course, internet connection is totally lost.

So the wanderlust is not ceased by statically assigning an IP address.  This surprises me.  Given this scenario, I don't really know what it means to have an XP "network connection" show up when there is no real IP, DNS, and/or Gateway linking done.  The little 'Wireless Network Connection' icon in the taskbar lights up and reports the name of the mystery router and a connection level (good, very good, excellent), but there isn't really a meaningful connection at all.

Arrg!
Are you statically assigning it to YOUR Default Gateway and DNS?

The real question is why in the world this happens on one and not the other?

Think I'll go mumble to myself awhile and hope I have a brainstorm.


Vic

It's certainly a mystery and not much to offer at this time in the way of a suggestion, apart from the "temporary" channel change idea.  
It depends upon the urgency of your situation, and if we *eventually* do come to an impass that between us we still can't resolve (and prior to considering reinstalling the OS), you could post a pointer question (worth 20 points) in the Network topic area, with a link to this thread number:
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_22008771.html#17677802

Network TA > http://www.experts-exchange.com/Networking/Broadband/

This will give you input from experts active in that other area. You should get a quick response particularly as this thread is now a long way down the WinXP list.
Still contemplating!

Yes, they were statically assigned to my router's addresses (DNS, Gateway, statically given IP).

I agree:  why is this going on with my wife's laptop but not mine?  The only difference I can think of is the Norton history on one but not the other.

Very frustrating.

Andy

I had a brain storm of my own:
It could be a DNS cashe problem.  Clear your DNS cashe.  Go to start>Run> and type CMD and hit "OK".
At the command prompt, type ipconfig\flushdns and hit "OK". then test.

hope this helps,

d_may

sorryyounhy I see that you already suggested that: I bad.

I just flushed the DNS cache again, and manually disconnected and then re-connected the wireless network adapter.  It's connected to our router now, but I'll see where it is in a couple hours.

I'll try posting a pointer question to the Network topic area.  Some time this weekend I'll go ahead and close this question out and split the points between d_may and Jonvee.

Many thanks go to both of you for your suggestions.

Andy

d_may,
No bad - tons of posts on this one, but glad you noticed I threw out some ideas on this problem.
Apparently, that fact slipped past Andy :)


Vic

Have you tried disabling windows Wireless Zero Config service?
http://www.ifelix.co.uk/tech/2000.html

Good article reference WZC issues. Seems to relate to your situation
http://cws.internet.com/article/3115-.htm

Yes, the article describes scenarios pretty similar to ours.  But, we have an SSID that is almost guaranteed to be different from any local neighbors' SSID (it's the name of an area where I lived overseas), so SSID name collision is not the problem.

Before disabling WZG, the article suggests obtaining replacement drivers/utilities to use in WZG's place.  The laptop that is experiencing problems is a Toshiba Satellite A15-S157.  Toshiba lists an Atheros WiFi client utility to use, but says that it requires an Atheros driver.  The specific driver listed is also available on Toshiba's site, but A15-S157 is *not* included in the list of "Applicable Models".  Here's the details on the two items, taken directly from Toshiba's site.

1) atheros_wpa_client.exe   Version:  2.4.2.18

Description: Requires Atheros WiFi driver v2.4.2.14 (atheros_wpa_driver.exe). You must uninstall your existing Atheros WiFi client utility (if present) before installing this version.

http://www.csd.toshiba.com/cgi-bin/tais/su/su_sc_dtlViewDL.jsp?soid=553445&moid=429789&BV_SessionID=@@@@2119399490.1160410184@@@@&BV_EngineID=ccccaddjdgjldehcgfkceghdgngdgnj.0&ct=DL


2) atheros_wpa_driver.exe   Version: 2.4.2.14

Description: Requires Atheros Client Utility v2.4.2.18 (atheros_wpa_client.exe)

http://www.csd.toshiba.com/cgi-bin/tais/su/su_sc_dtlViewDL.jsp?soid=553351&moid=160273&BV_SessionID=@@@@2119399490.1160410184@@@@&BV_EngineID=ccccaddjdgjldehcgfkceghdgngdgnj.0&ct=DL


I'm nervous about several things here:

- when the driver installation is initiated, the install window says to "See Atheros_Readme.txt' for detailed instructions."  But the driver does not come with anything other than the .exe file (no readme, no warning sheet, no nothing).

- as mentioned earlier, the page for downloading the driver does not list A15-S157 as an "Applicable Model", despite the fact that the client that is listed as *requiring* this driver is certainly listed as an "Applicable Model".

- the laptop itself was shipped with Intel Pro Network Adapters and Drivers.  These might be for the ethernet connection, not the wireless connection.  I don't know.  But I'm nervous that installing the Athenos driver could cause problems with the Intel driver(s).

Any thoughts?

Andy

User 'Computer101' has volunteered to take care of handling this question.  Hopefully that will happen soon.

Sorry for the delay.


Ansy