Virus/Firewall Problem

[evil_villainess]

My Windows XP computer contracted a virus when downloading a file a few
months back. Back then I tried to figure out what the problem was but the
computer would always freeze before anything was accomplished; all I was
aware of was that there was a mentioning about a blue screen error. The
problem worsened to the fact that my computer wouldn't operate in safe mode.
6 months later (I decided not to touch my computer until I found a way to fix
it) I was able to turn on my computer and access my account; however, I
discovered that I was not able to access the Internet. I tried unplugging the
cables of the modem and router and then replugging them with no success after
several attempts and then I attempted to run a diagnostic connectivity test
where it explained that "Windows cannot connect to the Internet using HTTP,
HTTPS or FTP. This is probably caused by firewall settings on this computer.
Check the firewall settings for the HTTP port (80), HTTPS port (443) and FTP
port (21)." I then checked my firewall setting and saw that the HTTP, HTTPS
and FTP ports were not listed as a exception and I added them and also
checked them off as exceptions. However, I was still unable to connect to the
Internet. I also was unable to turn the automatic updates on. What do I do to
solve this problem?
*p.s i have access to another computer if that helps at all

thank you in advance

 

[Gerry]

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.Microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Kayman]

My Windows XP computer contracted a virus when downloading a file a few
months back. Back then I tried to figure out what the problem was but the
computer would always freeze before anything was accomplished; all I was
aware of was that there was a mentioning about a blue screen error. The
problem worsened to the fact that my computer wouldn't operate in safe mode.
6 months later (I decided not to touch my computer until I found a way to fix
it) I was able to turn on my computer and access my account; however, I
discovered that I was not able to access the Internet. I tried unplugging the
cables of the modem and router and then replugging them with no success after
several attempts and then I attempted to run a diagnostic connectivity test
where it explained that "Windows cannot connect to the Internet using HTTP,
HTTPS or FTP. This is probably caused by firewall settings on this computer.
Check the firewall settings for the HTTP port (80), HTTPS port (443) and FTP
port (21)." I then checked my firewall setting and saw that the HTTP, HTTPS
and FTP ports were not listed as a exception and I added them and also
checked them off as exceptions. However, I was still unable to connect to the
Internet. I also was unable to turn the automatic updates on. What do I do to
solve this problem?
*p.s i have access to another computer if that helps at all

Preferred practice is to 'flatten' and rebuild a computer that has been
exposed to malware.
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx
http://technet.microsoft.com/en-au/library/cc512595.aspx

Clean Install Windows XP
http://www.elephantboycomputers.com/page2.html#Reinstalling_Windows - What
you will need on-hand
--and--
http://www.michaelstevenstech.com/cleanxpinstall.html
--or-- (even better because its illustrated and more reader friendly)
How Do I Install WindowsXP
http://xphelpandsupport.mvps.org/how_do_i_install_windows_xp.htm

It is defenitely advantageous to create an 'image' of the operating system
and create a data/file backup of the affected PC.
The image can then restored to the impacted PC and the user's data/file is
subsequently restored to the operating system.

An experienced and properly prepared user can do that in substantial less
time than scanning with complex and sophisticated AV applications.

Alas, since many users are less prepared and/or lacking the experience;
Scanning with an AV apps. is the only option, unless the user consults a
computer technician.
If you're one of the many less-experienced users, try to go through the
succeeding steps 1-4:

1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive (presumably WinXP (C and click OK.
http://support.microsoft.com/kb/310312

3.Using a surrogate computer, download:
http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html

3a.Insert the rescue disk into the infected computer and scan the system
for virus infections.

After successful execution:
4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

Additional references:
Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx
(Skip: Run an Online Scan of Your PC for Malicious Software).

How to optimize or reset Internet Explorer
http://support.microsoft.com/kb/936213
Applies to: Windows Internet Explorer in Windows Vista

How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer for Windows XP and
Windows Internet Explorer 7 in Windows Vista

GMER - is an application that detects and removes rootkits.
http://www.gmer.net/index.php

For additional assistance in relation GMER scan results consult either:
http://www.thespykiller.co.uk/index.php?board=3.0
--or--
http://antirootkit.com/forums/index.php?sid=9e746bb696ac0bb38781ffe4361c3a17

CCleaner - Free
Cleans temporary internet files, cookies, history, recent urls, application
MRUs, etc. ...(*Tune out the registry scanning/fixing option!*)
http://www.ccleaner.com/download/builds/downloading-slim

If Windows Defender is utilized go to Applications, under Utilities
uncheck "Windows Defender" (so it won't delete the history of WD).
If you wish, click 'Options' button the 'Settings' [check] 'Run CCleaner
when the computer starts'.
--or--
Setup CCleaner to Automatically Run Each Night in Vista or XP
http://www.howtogeek.com/howto/wind...-automatically-run-each-night-in-vista-or-xp/

Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Good luck

 

[evil_villainess]

the only error i found was in the application log the event ID is 1000, the
source is Application Error and the descriptions is as follows:[ Faulting
application googleupdate.exe, version 1.2.131.7, faulting module
googleupdate.exe, version 1.2.131.7, fault address 0x00006eef. For more
information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp ]

 

[David H. Lipman]

From: "evil_villainess" <[email protected]>

| My Windows XP computer contracted a virus when downloading a file a few
| months back. Back then I tried to figure out what the problem was but the
| computer would always freeze before anything was accomplished; all I was
| aware of was that there was a mentioning about a blue screen error. The
| problem worsened to the fact that my computer wouldn't operate in safe mode.
| 6 months later (I decided not to touch my computer until I found a way to fix
| it) I was able to turn on my computer and access my account; however, I
| discovered that I was not able to access the Internet. I tried unplugging the
| cables of the modem and router and then replugging them with no success after
| several attempts and then I attempted to run a diagnostic connectivity test
| where it explained that "Windows cannot connect to the Internet using HTTP,
| HTTPS or FTP. This is probably caused by firewall settings on this computer.
| Check the firewall settings for the HTTP port (80), HTTPS port (443) and FTP
| port (21)." I then checked my firewall setting and saw that the HTTP, HTTPS
| and FTP ports were not listed as a exception and I added them and also
| checked them off as exceptions. However, I was still unable to connect to the
| Internet. I also was unable to turn the automatic updates on. What do I do to
| solve this problem?
| *p.s i have access to another computer if that helps at all

| thank you in advance


You said "blue screen error"

Commonly known as the Blue Screen of Death (BSoD).
It has a specific message and shows hexadecimal errors codes.

What EXACTLY was the error message in the BSoD condition ?

 

[evil_villainess]

As I previously mentioned, I contracted the virus about 6 months ago (it was
near christmas of last year to be exact) so I dont recall what exactly the
message said. All I know is that when I was able to access my computer after
it contracted the virus (it was probably a week or two after) I recieved a
message from windows I believe, stating that my computer has just been
recovered from a serious virus or error and it mentioned that my computer has
contracted the blue screen error. It also gave me a bunch of suggestions as
to fix my computer and I tried a few of those but before I was able to get
any progress done my computer froze. I then decided to contact a family
member whom is much more tech savy than I am who suggested that I should
delete everything from my computer and starting all over again; keep in mind
that was before I was finally able to access my administrator account. So to
answer your question david, I am not exactly sure of what the message was
concerning the BSoD condition.

 

[Elmo]

My Windows XP computer contracted a virus when downloading a file a few
months back. Back then I tried to figure out what the problem was but the
computer would always freeze before anything was accomplished; all I was
aware of was that there was a mentioning about a blue screen error. The
problem worsened to the fact that my computer wouldn't operate in safe mode.
6 months later (I decided not to touch my computer until I found a way to fix
it) I was able to turn on my computer and access my account; however, I
discovered that I was not able to access the Internet. I tried unplugging the
cables of the modem and router and then replugging them with no success after
several attempts and then I attempted to run a diagnostic connectivity test
where it explained that "Windows cannot connect to the Internet using HTTP,
HTTPS or FTP. This is probably caused by firewall settings on this computer.
Check the firewall settings for the HTTP port (80), HTTPS port (443) and FTP
port (21)." I then checked my firewall setting and saw that the HTTP, HTTPS
and FTP ports were not listed as a exception and I added them and also
checked them off as exceptions. However, I was still unable to connect to the
Internet. I also was unable to turn the automatic updates on. What do I do to
solve this problem?
*p.s I have access to another computer if that helps at all.

thank you in advance

Burn one of these to a CD (using a working machine) and boot the
infected machine with it:

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

BitDefender works..

 

[David H. Lipman]

From: "evil_villainess" <[email protected]>

| As I previously mentioned, I contracted the virus about 6 months ago (it was
| near christmas of last year to be exact) so I dont recall what exactly the
| message said. All I know is that when I was able to access my computer after
| it contracted the virus (it was probably a week or two after) I recieved a
| message from windows I believe, stating that my computer has just been
| recovered from a serious virus or error and it mentioned that my computer has
| contracted the blue screen error. It also gave me a bunch of suggestions as
| to fix my computer and I tried a few of those but before I was able to get
| any progress done my computer froze. I then decided to contact a family
| member whom is much more tech savy than I am who suggested that I should
| delete everything from my computer and starting all over again; keep in mind
| that was before I was finally able to access my administrator account. So to
| answer your question david, I am not exactly sure of what the message was
| concerning the BSoD condition.

Sorry, you keep using the term "virus" yet you have not shown nor provided proof that you
had a "virus".

If you had malware, the likelyhood of a virus is low compared to being infected with a
trojan. If you were infected with a virus such as the Virut then that needs to be stated.

You information is vague at best and withut specific information then the advice I will
provide is to backup your data, wipe the PC and re-install the OS from scratch.

 

[Gerry]

Looks like you have identified the problem:
http://antivirus.about.com/od/windowsbasics/ht/googleupdate.htm

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

the only error i found was in the application log the event ID is
1000, the source is Application Error and the descriptions is as
follows:[ Faulting application googleupdate.exe, version 1.2.131.7,
faulting module googleupdate.exe, version 1.2.131.7, fault address
0x00006eef. For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp ]

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.Microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and
double click on the error you want to copy. In the window, which
appears is a button resembling two pages. Click the button and close
Event Viewer.Now start your message (email) and do a paste into the
body of the message. Make sure this is the first paste after exiting
from Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[evil_villainess]

The reason why I know that it's a virus is that when I downloaded the
infected file a loadind bar window appeared on the screen and said that a
virus was loading. Back then everything happened so fast that I was unable to
react quick enough to do anything or obtain more information as to what was
actually happening.