Can Only Access Internet In Safe Mode

[BlackBike]

Hi,

I was not able to remove the update through add/remove programs. So, after some searching online, I learned about removing updates using thte spuninst.exe files in C:\Windows. I used C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe and another spuninst.exe command for another update that had KB951748 in it's file name.

If you want, I can let the computer reinstall the updates, and then just take out the update located at C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe.

[Blade81]

I was not able to remove the update through add/remove programs.

Did you get an error there or why wasn't uninstall successful this way?

[BlackBike]

Hi,

The first time, the update was listed, but it also had the messages "Click here for support info" and "This update cannot be deleted."

However, we let the update be reinstalled and last night, I was able to remove it from the computer using the Add/Remove Programs. I still was not able to access the internet after it was gone.

I've been wondering; supposed I removed all the Windows updates that have been installed around the time of this problem? Since I can't access the internet now, I really don't need the updates, and perhaps I can get the computer back to a level where it could access the internet. That would give a system restore point, which could make it easier to figure out the problem (i.e., add one system update at a time to find out which one may be causing the problem). Do you think that is a good idea?

[Blade81]

Hi

Yes, I think that's a good idea since malware doesn't seem to be the problem causer here Probably need to begin with uninstalling SP3 and IE7.

[BlackBike]

Hi,

First of all, I want to thank you again for your efforts. I have good and bad news. The good news is, I can access the internet through a browser after I removed IE security update KB961260. The bad news is that my internet access also requires that I not have any anti-virus protection installed.

I repeated this three times, so I am pretty sure I'm on to something. I tried with both the 2007 version of CA Security Suite and the current version of AVG Free (I tried twice using AVG Free). I tried having just the KB961260 update installed without anti-virus protection, and with anti-virus protection without the KB961260 update installed. It is only when I have them both uninstalled can I get the browser to connect to the internet.

Of course, that is a silly solution. Surfing the internet without all the MS Security updates AND no anti-virus protection is begging for trouble.

Unless there is some sort of new virus that does not allow the browser to access the internet while protection is in place, I now realize this is not the correct forum for this matter. So, if you aren't allowed to assist me anymore with this, I ask that you at least point me in some direction where I can get an answer to this problem.

Once again, I thank you for all of your time and efforts. I look forward to your next posting.

[BlackBike]

One More Comment,

I saw on one website that Avast! anti-virus had shown success for others. I downloaded and installed it. However, after I rebooted the computer, I lost Browser internet access again. Once I deleted Avast!, I was able to access the internet through my browser. Therefore, it seems that all anti-virus applications stop me from accessing the internet through my browser.

Maybe this IS some kind of malware afterall (a new kind?).

[Blade81]

Hi

There's been Norton installed in the system at some point. Download & run Norton removal tool.



Then locate if present the following file & delete it:

C:\windows\ntbtlog.txt

Restart the computer
Just before the OS loading screen starts hit F8 as if going to safe mode.
From the advanced boot menu choose "enable boot logging" then hit enter.
Post the following file:

C:\windows\ntbtlog.txt

[BlackBike]

Thank You, Thank You, Thank You!

I was really close to giving up hope, but you found the problem; Norton! I think that is pretty crappy of them to leave behind stuff that attempts to force you to use their product. I doubt that I will ever buy or use anything from Norton again.

Once I ran the tool you pointed me to, I can now access the internet in normal mode through my browser. I was also able to install all the IE Security updates and AVG Free anti-virus. All seems to be in good working order. The only problem I had was I was unable to completely remove the C:\windows\ntbtlog.txt file. I deleted it, as you instructed, but when I rebooted it returned. When I rebooted and enabledboot logging, the computer just started up as normal. If there is something I missed, please let me know. I'm hoping that because it is a .txt file, it doesn't do any real harm.

I don't have much, but I would like to offer you $20 for your help. I know it is not even close to a fair payment for all of your experience and help, but it is about the best I can do right now.

Thanks again for all your help!

[Blade81]

You're welcome Norton does leave sometimes stuff behind causing mysterious symptoms.


Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.


THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis



Now lets uninstall ComboFix:

• Click START then RUN
• Now type Combofix /u in the runbox and click OK

Next we remove all used tools.

Please download OTMoveIt3 and save it to desktop.

• Double-click OTMoveIt3.exe.
• Click the CleanUp! button.
• Select Yes when the
  Begin cleanup Process?
  prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet, please allow it to do so.


Delete dds.scr file and related logs if those still exist.


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

• hosts file:
  
  • Every version of windows has a hosts file as part of them.
  • In a very basic sense, they are used to locate webpages.
  • We can customize a hosts file so that it blocks certain webpages.
  • However, it can slow down certain computers.
  • This is why using a hosts file is optional!!
  
  Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
  If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  
  2. Click the start button (at the lower left hand corner of your screen)
  3. Click run
  4. In the dialog box, type services.msc
  5. hit enter, then locate dns client
  6. Highlight it, then double-click it.
  7. On the dropdown box, change the setting from automatic to manual.
  8. Click ok

Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade

[BlackBike]

All Done!

Well, almost all. I chose not to install the hosts file program. Since this is my son's computer, I know he will not faithfully update and use the program (it is hard enough to get him to update spyware and anti-virus programs (smile)).

However, I did do everything else you directed, and everything seems to be working just great. I've asked him several times this past week, and he tells me that everything is running smoothly.

I thank you again for all of your help!