[whynot2]

Hello
I seem to have a similiar problem to the one that you guys helped Brodie123 solve, I'm hoping that you can help me as well. I'm not very computer literate, so I greatly appreciate any help you can provide.

My desktop became infected with a nasty piece of spyware that basically shut down IE (firefox was ok). I downloaded web sweeper trial & cleaned it off. After the free trial expired, I removed web sweeper. McAfee told me that my computer wasn't protected immediatly thereafter, so I clicked the fix button. The next time I tried to access the internet, nothing happened.

My laptops still access through the D-Link LD-524 fine & I even unplugged the cable running from the DLink to one of my laptops & turned the wireless feature off & was able to access the internet, so I don't think it's the cable or the D-Link.

Here's a go at trying to provide you enough information to help:
ISP = earthlink from Brighthouse Networks in the US
Modem = ? I have a Toshiba PCX2500 that came from the ISP and that is connected to a D-Link DI524 for my wireless feature (the desktop is also connected to it via plug.
The computer in question is a Dimension 3000 running Windows XP home edition version 5.1.2600
I think that I recently downloaded SP3? But not sure how to tell.
Both IE and Firefox will not connect.

Some more information: it seem when I reboot, the network does not assign a network address to the computer and repairing does not work.

I also tried the TCP/IP stack repair options for use with Windows XP with SP2 suggest in the post to Brodie123, but that did not solve it.

Here is the text file without the network address assigned.

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Matt>ping 216.109.112.135
Pinging 216.109.112.135 with 32 bytes of data:
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Ping statistics for 216.109.112.135:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
C:\Documents and Settings\Matt>ping yahoo.com
Ping request could not find host yahoo.com. Please check the name and try again.

C:\Documents and Settings\Matt>nbstat -n
'nbstat' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\Matt>nbtstat -n
Local Area Connection 2:
Node IpAddress: [0.0.0.0] Scope Id: []
No names in cache
C:\Documents and Settings\Matt>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : desktopmax
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connecti
on
Physical Address. . . . . . . . . : 00-11-11-69-0D-A5
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 0.0.0.0
Subnet Mask . . . . . . . . . . . : 0.0.0.0
IP Address. . . . . . . . . . . . : fe80::211:11ff:fe69:da5%4
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 255.255.255.255
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : FF-FF-FF-FF-FF-FF-FF-FF
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : fe80::ffff:ffff:fffd%5
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled
C:\Documents and Settings\Matt>

And here it is after I manually assign the IP address etc I had written in my book (note this will disappear after rebooting).

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Matt>ping 216.109.112.135
Pinging 216.109.112.135 with 32 bytes of data:
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.
Ping statistics for 216.109.112.135:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
C:\Documents and Settings\Matt>ping yahoo.com
Ping request could not find host yahoo.com. Please check the name and try again.

C:\Documents and Settings\Matt>nbstat -n
'nbstat' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\Matt>nbtstat -n
Local Area Connection 2:
Node IpAddress: [0.0.0.0] Scope Id: []
No names in cache
C:\Documents and Settings\Matt>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : desktopmax
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connecti
on
Physical Address. . . . . . . . . : 00-11-11-69-0D-A5
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 0.0.0.0
Subnet Mask . . . . . . . . . . . : 0.0.0.0
IP Address. . . . . . . . . . . . : fe80::211:11ff:fe69:da5%4
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 255.255.255.255
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : FF-FF-FF-FF-FF-FF-FF-FF
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : fe80::ffff:ffff:fffd%5
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled
C:\Documents and Settings\Matt>

Finally, here is the ipconfig /all from my laptop

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\KMJS6223>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : KOHC040
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : earthlink.net
Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . : earthlink.net
Description . . . . . . . . . . . : Intel(R) PRO/Wireless 3945ABG Networ
k Connection
Physical Address. . . . . . . . . : 00-19-D2-B7-16-0E
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.103
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained. . . . . . . . . . : Friday, July 04, 2008 2:51:30 PM
Lease Expires . . . . . . . . . . : Friday, July 11, 2008 2:51:30 PM
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Cont
roller
Physical Address. . . . . . . . . : 00-17-A4-DB-05-0F
C:\Documents and Settings\KMJS6223>

I hope that you can help & thank you for taking the time to attempt to do so.

Matt

[hermes]

I would recommend that before you fix the infection and keep the PC isolated from the laptops in case you have a self replicating trojan. Try downloading a trojan/spyware/bot cleaner and a root kit detector from a separate PC and run it from a USB key. It sounds like you have something in the registry or root that is changing your connection.

This is interesting:

Host Name . . . . . . . . . . . . : desktopmax
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No

No IP routing enabled. Something has disabled it. There lies one problem.

If you manually configure the IP you will not pick up the external DNS settings from the router DHCP, and will have to make sure the address is excluded from the DHCP pool and the router has granted access to the PC mac address. I would troubleshoot the DHCP and access issues first. Can you get to the router web page from the PC?

Also, don't delete:

Tunnel adapter Teredo Tunneling Pseudo-Interface

[Couriant]

That and you are running IPv6, which is not natively comptible with IPv4. You will need to disable/remove IPv6 which I believe is in the Network Properties of your network card. It will show as Microsoft TCP/IP Version 6

[TerryNet]

If you still have malware the following may do little or no good. But if your PC is "clean" these will at least help.

1. Uninstall ipv6 (you don't need it and occasionally it causes strange problems):

Start - Run - ipv6 uninstall - OK

2. Run these repairs:

(From a JohnWill post)

TCP/IP stack repair options for use with Windows XP with SP2.

Start, Run, CMD, OK to open a command prompt.

Reset WINSOCK entries to installation defaults: netsh winsock reset catalog

Reset TCP/IP stack to installation defaults. netsh int ip reset reset.log

Reboot the machine.


3. If you still get IP 0.0.0.0:

(from a JohnWill post)

IP addresses of 0.0.0.0 are normally caused by one of the following.

Diagnosis:
1. DHCP Service not running.
2. Duplicate IP address on the network.
3. Bad NIC card drivers.
4. Defective NIC hardware.

Resolution:
1. Check Control Panel, Administrative Tools, Services. The DHCP Client service should be Started and its Startup Type should be Automatic.
2. Turn off ALL of the computers and other network connected devices, reboot the router, then restart all the computers and other network devices.
3. Check for upgraded drivers and/or reload the Network drivers.
4. Replace the Network Interface Card.

[whynot2]

Thanks folks.

I thought that the malware was gone... after Web Sweeper ran, it seemed to be ok until I removed Web Sweeper after the trial finisihed. My wife told me that in the same session, she removed a couple of other "rarely used" programs, but doesn't remember what they were.

Hermes
I have no idea how to troubleshoot DHCP and acess issues at this point. I can not get to the router web page (assuming it is entering http://192.168.0.1 into my web address bar?). I don't know what that tunnel thing is so I don't think I would delete it unless I could do so by accident?

Couriant & TerryNet
I uninstalled IPv6 per your instructions. I also ran the repairs, but will they work with SP3 (I think I have SP3 not SP2)? The first step gave me a message that Winsock Catalog was successfully reset, but the second one didn't give me any response.

After doing this, upon reboot, it didn't find any IP address (not showing 0.0.0.0 it shows "blank"."blank"."blank"."blank").

I checked the DHCP client as you suggested and it is started and automatic startup.

I haven't done #2 (turn off all devices and reboot the router), I will as soon as my wife finishes up some work stuff on her machine.
To reboot the router, do I just unplug it? Which one the D-Link one or the one from the ISP (Toshiba)? I guess they're hooked up as a "bridge", whatever that means.

#3 - Check for upgraded drivers... do I do this on my laptop & then import it over off a flash drive or something? This one kind of concerns me, as the "local area connection 2 properties" (where I have to click into TCP/IP to see my IP address) shows connect using - "Intel(R) PRO/100 VE Network Conne". My D-Link manual shows it as "D-Link DFE-530TX + PCI adapter #2". The tech support guy at D-Link and the ISP both said not to worry about it.

#4 - I assume that this is a piece of hardware inside my computer, correct?

Another piece of info that might help.
When trying to remove the original piece of malware, my wife followed some instructions on line that supposedly changed the registry. That didn't work (why I picked up Web Sweeper trial), and didn't seem to have any ill effects since the computer/internet functioned ok after that, but I've been told to never do anything with the registry, so that worried me a bit at the time.

[whynot2]

Ok, I did #2 - shutting everything off and rebooting the routers (I disconnected power on both for 10 seconds) and it did not help.

But I think I may have misspoken about the IP address showing up as "blank"."blank"."blank"."blank" - that was for manual IP (and of course, automatic IP button was clicked.

ON the "detials" it shows the IP address as 169.254.69.132 I don't know what this is, but it is what the IP keeps defaulting to and then it does not connect to the internet.

[whynot2]

OK, I grabbed the updated driver for the Intel pro/100 VE & installed it on the desktop (went from driver date in 2004 to 12/07), but that didn't help either.

[TerryNet]

Yes, those repairs still work with SP3.

An Autoconfiguration IP of 169.254.x.y means that no Dhcp server was found on the network, so Windows made that assignment. You do have a Dhcp server on your network, assuming your laptop in the above ipconfig is connected to your router, so the possibilities are a bad router port, a bad cable, a bad NIC, problem with the driver, or a firewall problem.

Try to connect the laptop using the same router port and cable to test the first two.

Try to connect the desktop in Safe Mode with Networking to mostly test the last one.

Your desktop ethernet adapter, at least the one that was enabled in your ipconfig, is the Intel(R) PRO/100 VE. Did you get the latest driver from your desktop manufacturer's web site? I don't understand what the D-Link manual has to do with it. Did you install a D-Link PCI card?

[whynot2]

Originally Posted by TerryNet

Yes, those repairs still work with SP3.

An Autoconfiguration IP of 169.254.x.y means that no Dhcp server was found on the network, so Windows made that assignment. You do have a Dhcp server on your network, assuming your laptop in the above ipconfig is connected to your router, so the possibilities are a bad router port, a bad cable, a bad NIC, problem with the driver, or a firewall problem.

Try to connect the laptop using the same router port and cable to test the first two.

Yes, I did this and the laptop works fine.

Originally Posted by TerryNet

Try to connect the desktop in Safe Mode with Networking to mostly test the last one.

OK, I turned off the windows and mcafee firewalls and restarted in safe mode with networking. I tried coonecting to the internet with IE with no luck. I had IE "diagnose connection problems" and it told me to consult my modem troubleshooting guide. It looks like it's still grabbing that 169.254.69.132 address.

Originally Posted by TerryNet

Your desktop ethernet adapter, at least the one that was enabled in your ipconfig, is the Intel(R) PRO/100 VE. Did you get the latest driver from your desktop manufacturer's web site? I don't understand what the D-Link manual has to do with it. Did you install a D-Link PCI card?

I got the latest driver from Intel website. I don't know if the D-Link manual (actually the quick instillation quide) has anything to do with it, I just noted the discrepency & was worried that I had lost the D-Link driver. I didn't instal a PCI card.

Thank you for taking the time to try to help me.

[TerryNet]

If the McAfee firewall was 'disabled' or 'turned off,' somehow got misconfigured, or got corrupted fighting the good fight against malware it may still be blocking in Safe Mode with Networking. Suggest you try the McAfee Removal Tool: http://service.mcafee.com/FAQDocumen...107083&lc=1033

Until you get connected to a network you don't need no stinkin' firewall. You can reinstall it later.

[whynot2]

Thanks all, for the help. It turns out to be a failed modem. I put a new one in & everything is working fine.