No Internet in Normal Mode; Works in Safe Mode

Hello,

I'm running a Gateway NV Series and as of last night I have fallen victim to the problem that Windows 7 seems to be plagued with. My internet has completely stopped working, both Ethernet and Wireless. I have tried many of the fixes suggested in this forum and others, but none of them have worked. So I booted into safe mode with networking and low and behold, the wireless and Ethernet work just fine here.

Why is this?

I don't like to run the internet on safe mode, and I would to have my computer back working at normal capacity. How can I fix this?

Specs on my laptop are here:
Gateway - Laptop with AMD Athlon™ X2 Dual-Core Processor - NightSky Black - NV5211u

Hi and Welcome to SF.

Your safe mode loads up with the bare essentials to get things working. Using builtin drivers i would think and no third party softwares. If your safe mode don't work, more than likely u have a system/hardware issue.

As for your normal mode, go into Device Manager, any noticable issues?

Please list the steps that you have tried so far in trying to fix the issue. This will help us to understand the problem better and find a resolution for you.
As aem mentioned, third party software will load in normal mode and not in safe mode, which I believe is the most likely cause of your problem.
Did you install any new software just prior to the problem occurring? It may have been installed just before, or before the last shutdown/reboot.
If you have installed something new, and you think it may be likely that it's causing a startup issue in normal mode: Please download and install CCleaner. if you don't want to download it in safe mode, It can be installed to a USB memory stick after downloading it on another pc. (uncheck "install Yahoo Toolbar" during installation). After install, open CCleaner, click tools - startup. Expand all columns so they are visible on the one page, take a screen snip using the snipping tool and paste it back here. This way we can check to see if there are any conflicting programs that may be blocking your internet access.

Like I said earlier, with limited information to go on, this is my first guess, my apologies in advance if I'm off the mark Post back and we can investigate further

Okay - here's what I have tried.

I am posting in Safe Mode with networking currently, the wireless works fine here.

1] I have tried removing the program bonjour from my computer at the suggestion of this and other forums, after several attempts, I was able to fully remove it.

2] I have rebooted the wireless router that I'm using, a netgear model that was giving me NO problems until yesterday night.

3] I have troubleshot the wireless connection from the connection center only to get a response of 'Windows detects that you are connected to the internet, but microsoft.com isn't loading' error.

4] I have attempted, numerous times, to run my ispconfig to see if I have a missing value to no avail.

5] I have both set back and updated my wireless and motherboard drivers with no effect.

Last night, I installed a program used for blocking isps that I have used on several different XP machines with none of these problems - I was downloading things on iTunes on a public network and wanted to keep my information protected.

This morning I used a separate computer to install and run malwarebytes thinking that this issue was malware messing with my connection.

Here are CC Cleaner caps:
http://img.photobucket.com/albums/v156/Ryoakiyama/Capture1.png
http://img.photobucket.com/albums/v156/Ryoakiyama/Capture2.png

Lets see. If you boot into normal mode, you loose all your adapters, hence can't access the internet via direct cable to modem/router or through wireless (that's what i meant by losing all your adapters). Correct?

Have you tried restoring the OS to prior date?
Maybe try Last Know good configuration..?

If you have, then just log back onto normal. Go to Event Logs see what errors there are. then Go to Device Manager, and see if there are any issues. You don't need to be connected to the internet to download the drivers if any is missing. We can do that for u (or you can relog back in safe mode to do that yourself).

Sust out out your event logs and Device Manager first.

Thanks for replying with further info. See How to Post a Screenshot in Seven Forums for an easier way to attach screen snips
What is the IP blocking program that you installed? Have you tried disabling/uninstalling it? I didn't see any reference to it in your startup lists.
The first entry in your first capture produces some suspicious looking search results:
Associated Malware Groups

The unsafe files using this name are associated with the malware groups:

• System Back Door
• Cloaked Malware

File Behavior

GREG.EXE has been seen to perform the following behavior:

• The Process is packed and/or encrypted using a software packing process

GREG.EXE has been the subject of the following behavior:

• Added as a Registry auto start to load Program on Boot up
• Created as a process on disk
• Deleted as a process from disk

Do you know what the Program Files(x86)\Gateway folder/program was installed for?
If not, I would be inclined to disable it in CCleaners startup (also disable Adobe speed launcher) then run a full antivirus scan using you installed av product, followed by a full malwarebytes scan. Preferably do these scans in safe mode.
Post back and let us know the results of your scan, attach logfiles if possible.

Just for convenience sake, I'm attaching your screen snip:
Also search results for full folder destination of GREG.exe seem to show that it's not common

Will do. Turned off greg.exe. No idea what it was installed for, so I'll disable that and the Adobe thing and run the scans in safe mode. Will see what happens and report back.

edit: I removed the programs that I'd put on yesterday right off the bat thinking that they'd been the issue. No luck.

You can try this..
Start - Run - msconfig - services tab - check mark hide all ms services - uncheck all the listed.
Startup tab - uncheck all. Apply - Close and restart machine. Now try.

Have you installed any third party firewall?

dre@ms said:

You can try this..
Start - Run - msconfig - services tab - check mark hide all ms services - uncheck all the listed.
Startup tab - uncheck all. Apply - Close and restart machine. Now try.

Have you installed any third party firewall?

Click to expand...

Doing this will stop all of your installed programs from starting... including theati control centre, acer launch manager, java update service, audio centre and antivirus.... not recommended or really necessary.

I think for now we should maybe concentrate on getting a clean bill of health for your system, as GREG.exe has been known to be malicious and could be part of the problem.

Once you have completed the full system scans, please post back the results here in a reply, add the logs as an attachment if possible.
After you have done that, please download HijackThis. You can either use the installer or download the executable and save it onto a usb stick to run on the system. After installation, run it and save a logfile - attach the logfile here or copy paste it into a reply. IMPORTANT - close the program after saving the logfile and don't remove/fix anything... I'll analyse the file and let you know what you should fix, if anything. You can seriously wreck your installation if you randomly fix entries...

Okay, so I've done both the AV scan and the malwarebytes scan - Malwarebytes found two files that I told it to take care of and right now it seems to be okay.

I didn't run the msconfig and turn off all services because I figured that it would fail to turn on a bunch of my stuff already. I'm thinking that once y'all see the two attached log files, I'm going to try to boot into normal mode and see what happens.

Will report back.

Okay, here are shots of the hijackthis scan. Couldn't get it to save an actual log - so here are snips.

e: I booted into normal mode with still no luck.

Please go to (where c:\ is your install directory):
C:\Program Files (x86)\Trend Micro\Hijackthis
copy the HijackThis.log (edit - select all, edit - copy)
paste the info back in here...

Also, from what I could see in the images, it looks like you are running AVG Free AND Norton Internet Security, is this right?
If so, please uninstall one of them... If uninstalling Nortons, remove it using the Norton Removal Tool
Running multiple antivirus programs will almost always cause conflicts.

Okay. Here is the hijack this log file.

Will be uninstalling norton shortly. The programs were both installed at day one of this computer's operation and I hate hate hate removing Norton so I just never bothered.

YES!

It is working again!

It must have been Norton - which had somehow started it's own install process right before all this stuff started happening!

Thank you so so much for your help. This was so frustrating and your helpful suggestions helped me to both figure this stuff out and also fix this problem. You are wonderful.

anamatics said:

Okay. Here is the hijack this log file.

Will be uninstalling norton shortly. The programs were both installed at day one of this computer's operation and I hate hate hate removing Norton so I just never bothered.

Click to expand...

Norton loves to leave remnants of itself lyig around after uninstallation. The removal tool does a good job of getting rid of the rest of the rubbish
Thanks for posting the log... I'll get back to you shortly

Great to hear that it's finally fixed

There's nothing else wrong with your logfie that I can see, only 1 unnecessary entry
Open HijackThis - scan only - check the following and fix:
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

Also, as a side note, you seem to have a few registry entries that are no longer being used by (uninstalled?) applications.
You might like to try CCleaners registry cleaner function. I've been using it for years without any issues, as have many others here.
Open CCleaner - Registry - Scan for Issues - Fix Selected Itms - Yes to backup changes - save - fix all selected issues. Repeat until no more issues are found. Sometimes there'll be one that will reoccur, just leave it, it's fine, just a part of windows temp cache/memory

Alright, I'll get that file. You've been completely amazing. Thank you so much.

Great going. SymNRT (Norton removal tool) has we term doesnt really delete the remnants. We have to manually delete the Norton/Symantec folders from your user directory. This tool will remove the application when Norton's uninstaller doesnt do the job well.