Need help troubleshooting internet connection - looking for tutorial

arayfo1 · 02 Jan 2015

Copied text after using cleaning tool Bill recommended:

# AdwCleaner v4.106 - Report created 02/01/2015 at 04:50:14
# Updated 21/12/2014 by Xplode
# Database : 2015-01-01.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Adam - ADAM-PC
# Running from : C:\Users\Adam\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\globalUpdate
Folder Deleted : C:\Program Files (x86)\PC Drivers HeadQuarters
Folder Deleted : C:\Users\Adam\AppData\Local\globalUpdate
Folder Deleted : C:\Users\Adam\AppData\Local\CrashRpt
Folder Deleted : C:\Users\Public\Documents\ShopperPro

***** [ Scheduled Tasks ] *****

Task Deleted : YTDownloader

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\Public\Desktop\Google Chrome.lnk
Shortcut Disinfected : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Shortcut Disinfected : C:\Users\Public\Desktop\Opera.lnk
Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
Shortcut Disinfected : C:\Users\Adam\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Key Deleted : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Value Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [YTDownloader]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKCU\Software\GlobalUpdate
Key Deleted : HKCU\Software\Myfree Codec
Key Deleted : HKLM\SOFTWARE\GlobalUpdate
Key Deleted : HKLM\SOFTWARE\Myfree Codec
Key Deleted : [x64] HKLM\SOFTWARE\ShopperPro
Key Deleted : [x64] HKLM\SOFTWARE\YTDownloader

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v34.0.5 (x86 en-US)

-\\ Google Chrome v39.0.2171.95

[C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www-search.net/search.aspx?s=E9Nztugdu0338,8afe833c-c74d-4537-bfad-dc4fc1775467,&q={searchTerms}

-\\ Opera v26.0.1656.60

[C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www-search.net/search.aspx?s=E9Nztugdu0338,8afe833c-c74d-4537-bfad-dc4fc1775467,&q={searchTerms}
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : aaipilfmheplbcghignccoiiebekkdhe
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : elchiiiejkobdbblfejjkbphbddgmljf
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : ffhfoagmjcnkolneahbpagjcjjaeofbg
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : hjghiofiijcepdnocbgefbdlbckjfheg
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : iklgpchfbohgmghgfagediakopecfmbm
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : kfgaibfbmkjgmimhbbaikfnpkkjkpoan
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : lmnbobhffedhdhfpcjkjphcfpeeiocdn
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : kjpifmjicccpbkfjdkehimhgklfkbanh
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : hoidflomjnnnbiemmkjdjkkialmhbago
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : ekpibplnnkfdcafdpoekhoffegcajene
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : ipljmghelflfikejmgkmlmpjmehfjodc
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : ejddjnilmdncjilbfjgameihlklfpohp
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : eagomcfjiefffhpaejnlpjccikpipdoe
[C:\Users\Adam\AppData\Roaming\Opera Software\Opera Stable\preferences] - Deleted [Extension] : aonedlchkbicmhepimiahfalheedjgbh

*************************

AdwCleaner[R0].txt - [4897 octets] - [01/01/2015 23:15:49]
AdwCleaner[S0].txt - [5696 octets] - [02/01/2015 04:50:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5756 octets] ##########

Slartybart · 02 Jan 2015

Thanks Adam,

AdwCleaner is one of the best and safest tools I know of to clean up a system. It found and cleaned a bunch of things that are known buggers and it 'repaired' your browsers search as well.

Don't worry about the tracking cookies found by any AV scan - they're just cookies ... the number of things found will change as you visit different sites. For the most part, these cookies are harmless.

Your system was apparently infected (ask toolbar, shopperPro - I'm not certain about the other things found, but I trust AdwCleaner).

There's always a debate about AV pgms ... I use MSE at the moment, but have used Avast and AVG in the past - all do a good job and all are free. You only need ONE active real time AV pgm running at any given time though - pick one and uninstall any others - they fight for resources and might cause some conflicts if more than one is running.

A good followup to AdwCleaner is Old Timer-Temp File Cleaner (TFC)
Restart your machine in case there are any system operations pending

Click here to download Old Timer-TFC.
>> save the application to your Desktop.

Old Timer-TFC is a standalone application, there is no install.

Save your work and close all open windows.
TFC will close ALL open programs including your browser!

Right click, run as administrator TFC

Click the Start button to begin the cleaning up temporary files and folders.

Do not work on other things while TFC is running - most applications use some sort of temporary files. Just let TFC run by itself on the machine until it completes.

If TFC prompts you to reboot, do so immediately.

If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.

Run TFC, even if you decide not to run the MalwareTips guide below

Information

Malware scanners often reset defaults to easily accomplish their task of cleaning. Browser homepage and search engines are good examples of things that might get reset. This means that you might have to change a setting back to your preference - it's a minor inconvenience and a small price to pay for a clean system.

If you want to be extra certain about cleaning viruses, MalwareTips has a good shotgun approach tutorial.
How to easily clean an infected computer (Malware Removal Guide)

It's a lot of scans and it takes a while, but if you decide to run through the guide, do it in one session. This is a project - don't attempt to do it piecemeal - that will give Malware a chance to re-root. Some scanners take a long time, others run fairly quickly - I'd plan for 8-9 hours of maintenance time (nothing but scanning your system - no games, no surfing the net ...)

Step 5: RogueKiller is one scan I do NOT recommend.
Some people have reported issues after running it (I'm not sure why), so just skip Step 5

Do the steps in the order given - don't skip any (other than step 5

)
Run them all (except step 5) even if the reports come up clean.
Follow the instructions, reboot if instructed.
DO NOT reboot after Rkill (step 2)

Make sure you pay attention when you install the scanners
- some offer other software at install time
- uncheck any 'extra' software (usually a toolbar or browser)

When you've run all of the scanners, reboot a final time
then follow the instructions in OPTION TWO of SFC /SCANNOW Command - System File Checker

Copy C:\Windows\Logs\CBS\CBS.log to your Desktop (it is a protected file so you cannot attach the original)

Attach the copy of the entire CBS.log to a new post (you might have to zip it if it's too large)

Bill
.

arayfo1 · 02 Jan 2015

Thanks a lot, Bill. I'll check out Old Timer-Temp File Cleaner now & I may try the shotgun approach some time tomorrow or Sunday. Did you happen to read my comment about having a network cable unplugged? I also noticed that the IPV4 address on the LAN was set to static whereas everything else was set to dynamic.

arayfo1 · 02 Jan 2015

I was receiving a *CONNECTION WAS RESET* message each time I tried to open up a new tab so I decided I would try to set the IPV4 LAN address to dynamic to see if that would make a difference. I also deleted the LAN driver and then restarted the machine. I'm still getting the same *network cable unplugged* message, but I do seem to have a connection for right this moment.

Slartybart · 03 Jan 2015

I saw that you said there is no cable plugged in, but it sounds like you're getting a message - can you post a screen shot?

Making changes to the IP configuration will reset the connection - that is normal.

Setting the address to dynamic is fine (I doubt it will make a difference though - it might if there were collisions on the static address) - we made it static last Jan to try to get you connected then. If you have a lot of issues connecting or staying connected after setting it to a dynamic address, then revert to the static one. If you don't remember what it was, look back at the information you posted in the beginning of this thread.

Since you're not using the Ethernet connection, you could, if you want to, disable the device in network connection and sharing - change adapter settings - disable Ethernet (not your wireless adapter). You'll have to remember that you did this if you ever connect wired - you'll have to enable the adapter then. Let's see the message you're seeing.

Bill
.

arayfo1 · 03 Jan 2015

Network cable unplugged

arayfo1 · 03 Jan 2015

"Making changes to the IP configuration will reset the connection - that is normal."

No, I meant the message that I receive within the actual browser page whenever I attempt to open up a new tab or click on a link on any website whenever the internet connection is being interrupted. Instead of "This web page is not available" it will say "connection was reset". This occurred prior to making any changes to the IP configuration. I would take a snapshot, but it's not currently giving that message.

Okay, I will disable it (LAN) for now, but I'm not sure that will make a difference. At this point, I'm thinking I might need to do like you suggested and try the shotgun tutorial approach, but I am open to suggestions.

Edit: I don't know why I keep calling it LAN whenever it's called a Local Area Connection. Sorry about that.

Slartybart · 03 Jan 2015

Local Area Network (LAN) - same thing :)

I only suggested disabling the Ethernet adapter as a workaround to the "cable not plugged in" message since I'm not clear on where you're seeing that. If it's in the adapter window, don't sweat it ... that's just telling you that there isn't a cable plugged in on the adapter. If there is a message that pops up telling you there is no cable plugged in, then that's something else and disabling the Ethernet adapter should stop that message.

Ah, I see - "connection reset" when you open a new tab. Hmmmm, does it connect to the page you tried to open in the tab?
This does sound to me as though there's still something you need to clean up - see if the shotgun Malware guide resolves the issue.

Post the logs from the scans here so a member can review what was found and cleaned. You can do that after all scans are completed.

Bill
.

arayfo1 · 03 Jan 2015

Slartybart said:

see if the shotgun Malware guide resolves the issue.

Post the logs from the scans here so a member can review what was found and cleaned. You can do that after all scans are completed.

Bill
.

Okay, I had problems getting a connection long enough to try the shotgun malware guide this evening. I will try again first thing tomorrow morning and check back in with you some time tomorrow night if not the following morning.

arayfo1 · 07 Jan 2015

Maybe some time this weekend. I suddenly got busy.