TechSpot

Can only view/use certain web services in safe mode (Long read sorry)

By Everlong18
Oct 10, 2007
  1. I've read a few similiar problems on this forum, but the suggestions on there doesn't fix my problem.

    The problem is I can only view some webpages in safe mode, webpages that have logins such as I have to run safe mode to be able to sign in for the technet forums, or I can only view my inbox at Gmail in safe mode. In normal mode I just get a DNS error saying the page is unavailable.

    The problem started Monday when I came on the PC and noticed desktop shortcuts broken. Windows Live Messenger shortcut wasn't appearing, and a few shortcuts in the start menu had disappeared, run being one of them. So I restarted the PC and the Messenger shortcut had appeared again (run still hadn't). So I tried signing in to Messenger, but was told the service was unavailable.

    I then started up IE (IE7 in Vista Ultimate to be precise), and went on over to the Star Wars Galaxies forums, where I had to login, so clicked the "sign in" link and entered my details. Clicked "log in" and a DNS error popped up, tried refereshing a few times and tried logging in again, but still DNS error. Now, I tried Gmail, but nothing. Just a DNS error.

    I also noticed the IE7 phishing filter isn't available in normal mode eitherm only in safe mode. I get the message that the Microsoft service is temporarily unavailable.

    I can connect to any other webpage without a login page on them, and the only forum I can also login too is lern2play.com, and this forum in normal mode with no problems.

    I've tried resetting IE settings to default, tried another browser (Mozilla), the PC downstairs has no problems accessing the same pages, so can't be a router problem. I've done what other sites have suggested, such as virus scanning but that pulled nothing up, ran Ad-ware and SpyBot - Search and Destroy, but they only pulled tracking cookies up, which didn't fix the problem after deleting them. Hijack this did bring up a few Winsock problems, which can't be fixed

    (If you are familier with Hijackthis, the problems are listed as O10 errors, but are unknown and appear as "O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll2 in the log. They can't be deleted, and I'm told to use a program called LPS to fix them, but LPS doesn't find any problems).

    All this began when I came on my PC Monday, and was working fine the night before. All I can recall dong Sunday night/early hours of Monday was playing games online. Was playing Second Life up until about midnight, then began playing Halo 2 for an hour or so (I can't also login to the Live service for Halo 2 in normal mode).

    I was hoping the monthly Microsoft malicious software scan that came out yesterday would pull something up, but nothing :(

    I've been told to just format and reinstall everything, but I only have a Vista upgrade disk, so would need to start from XP slipstream disk then onto Vista.

    Has anyone got any suggestions or solutions?

    Cheers
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    1.) Download WinsockFix.zip. (by: Option^Explicit)
    2.) UnZip WinsockFix.zip (Pay close attention to where the file is extracted to.)
    3.) Run WinsockFix.exe.
    4.) Click the Fix button.

    See if that helps.

    Also, please post a HJT log as per the instructions HERE.

    Regards Howard :)
     
  3. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Attached the HJT log, and will try the winsock fix.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I really need to see a HJT log from normal mode.

    Run the winsockfix first, them post the HJT log.

    Regards Howard :)
     
  5. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Ran the winsock fix and the O10's seem to have been sorted, but still no luck fixing the problem.
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I can`t see anything that`s obviously nasty in your HJT log.

    Go and read this thread HERE and follow as many of the instructions as you can.

    Post the requested log files and we`ll see if anything shows up.

    Regards Howard :)
     
  7. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Okay, seems to be running fine now in normal mode.

    Downloaded cccleaner and ran that in safe mode. Downloaded them tools and Smitfraud seems to have fixed it. Ran it in safe mode then came into normal mode and ran everything again and seems to be good now.

    Thanks a lot :)
     
  8. Jase123

    Jase123 Banned Posts: 1,012

    Well it wouldn't hurt to post a fresh Combofix and AVG Antispyware log as an attachment. The one of us can check it over. :)

    But if your happy with they way your system is performing, then by all means don't post the logs.

    Regards Jase :)
     
  9. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Hmm, well it's gone again.

    I restarted my comp after I swear it was working, now it's on and off. The phishing filter seems to come on and off. Gmail worked before I restarted and now it doesn't :/

    I'll get on with the AVG Spyware logs now.
     
  10. Jase123

    Jase123 Banned Posts: 1,012

    Yes post the requested logs from here. Follow all instructions exactly.

    Regards Jase :)

    This thread is for the use of Everlong18 only. Please do not post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hi Jase123.

    I`ll let you handle this thread as it don`t take two of us.

    I`ll just keep and eye on things. If you need any help, give me a shout.

    Regards Howard :)
     
  12. Jase123

    Jase123 Banned Posts: 1,012

    Ok mate, will do.

    Regards Jase :)
     
  13. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Okay, had some RL issues call, but left AVG Spyware running (Didn't save log though when I restart comp -_-) but that pulled up a couple of "Low" files called "Not-A-Virus", which I removed and a bunch of "Medium" tracking cookies.
    Everytime I run smitfraud, I can use the Internet fine, but when I restart comp the problem continues.

    I downloaded AVG rootkit, and do a deep scan, but it always gets stuck at 87% then crashes. The directory it gets stuck at is something like C:\User\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data... and so on.


    Will get the combofix one sorted.
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Something is obviously amiss.

    I can only advise you to post the requested log files and hopefully, they`ll reveal what the problem is.

    Regards Howard :)

    This thread is for the use of Everlong18 only. Please do not post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  15. Jase123

    Jase123 Banned Posts: 1,012

    Go into control panel and look for any suspicious programs.

    Looked at your HJT log and i cannot find anything unusual.

    If the problem started on Monday, you could try a system restore, to say Sunday. See how here.

    Regards Jase :)


    This thread is for the use of Everlong18 only. Please do not post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  16. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    I did a system restore to Saturday night on Monday, but the problem still persisted.

    Here's the combofix log and a fresh HJT log. I'm running AVG Anti-Spyware again to get a log. Will take about 40-45mins, so will check back then with it.
     
  17. Jase123

    Jase123 Banned Posts: 1,012

    You haven't attached you HJT log.

    I'll leave the combofix log to Howard, as i am still learning to read them.

    Regards Jase :)

    This thread is for the use of Everlong18 only. Please do not post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  18. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Seems I didn't do it right then.

    Anyway, here it is:

    Edit: Hmm, I uploaded it, but didn't appear and now I can't upload it again.

    Okay here it is.
     
  19. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I can`t see anything in your Combofix log, that would account for your problem.

    I`m not familiar with Windows Vista, but if it has a system restore feature, I suggest you try it and see if it helps.

    Regards Howard :)

    P.s: We don`t need to see a HJT log as your last one was clean.
     
  20. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    I've tried the system restore, that didn't work.

    The closest I've come to fixing it is after running Smitfraud, but when I restart my PC, the problem continues again.
     
  21. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Run Smitfraudfix again and attach the log file.

    Regards Howard :)
     
  22. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    I've attached the "search" log, then the log after cleaning.
     
  23. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I can`t see anything there that would account for your problem.

    I must admit, I`m scratching my head on this one.

    I really don`t know what the problem is.

    Try running AVG Antirootkit again as per these instructions.

    Download the AVG Antirootkit programme. Disconnect from the net and install the programme, then restart your computer.

    Run the programme and click the "Perform in-depth search." Allow AVG to complete the scan. The AVG scanner will give the "Rootkit path"
    Reconnect to the net.

    Let me know the results

    Regards Howard :)

    This thread is for the use of Everlong18 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  24. Everlong18

    Everlong18 TS Rookie Topic Starter Posts: 36

    Did exactly what you told me with rootkit, but it still crashed at "C:\User\Default\AppData\Local\Application Data\Application Data\Application Data...".


    I really have no idea what else it is, like Smitfraud narrows it down a bit, but to actually pin point it is the problem now.

    I'm thinking of just doing a format when I get in from college tomorrow.
     
  25. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I was just going to say. If it were my system, I`d backup my important data and reformat.

    I`m sorry I wasn`t able to help you. :(

    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...