Suspect my problems are due to virus but virus software says no

[pantichd]

My dad's PC will not connect to anything using IE. Every address returns "Page cannot be displayed" message. However, if I go to command line and ping something it comes back with a reply.

Doing "ipconfig" returned a strange name in the DNS Suffix field. I didn't write it down but it was something stupid like "this.is.invalid.configuration" or something like that. I tried several things at his house and then just gave up and brought it home. At my house, when I run ipconfig the DNS Suffix field shows nothing but the IP address, Subnet Mask and Default Gateway look right.

If I reboot into safe mode it DOES connect to internet with IE. This leads me to think that it's some kind of virus.

He had an expired (didn't tell me) copy of Norton so I installed a copy of ZoneAlarm Suite. Ran scans for viruses and spyware. It found no viruses but a few spyware entries. Cleaned those out but the problem still persists.

What else can I try?

Any help would be appreciated.

PS - This is running XP SP2

 

[BadBigBen]

in the RUN box (or CLI / CMD window) type: ipconfig /flushdns

this will reset the DNS cache...

then type: netsh winsock catalog reset

this will reset the winsock entries to factory defaults...

then check the HOST file and Spyware/malware, easiest way is to use an app like SpyBot S&D...


Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[pantichd]

Thanks.

I flushed the dns and reset the winsock entries. By the way, (I didn't know this until the command didn't run and I had to dig around a bit) it should be "netsh winsock reset catalog".

Then I rebooted and ran ipconfig again. The DNS suffix is still blank.

Opened Hosts file from C:\Windows\System32\Drivers\etc folder. It has a crapload of entries all with 127.0.0.1 ip address. They are preceded by a comment saying it was inserted by Spybot and then followed by another comment saying it's the end of entries inserted by Spybot.

I removed all those entries and just left the following line in
127.0.0.1 localhost

Then I rebooted again. Running ipconfig still returns a blank DNS suffix.

Now when I double-click on IE nothing happens.

Grrrr!

 

[pjw001]

I also have a "crapload of entries all with 127.0.0.1 ip address" put there by SpyBot and my system works fine.

When you say "Now when I double-click on IE nothing happens", do you mean that IE does not even load?

If so, I'm not sure what is going on.

If IE loads, try pinging a site and then type the IP address into the a IE address bar.

I also do not have anything in DNS suffix.

It may be your subnet mask or default gateway that is wrong.

Having found a site you can ping, try tracert.

Not sure what this will prove.

Good luck.

 

[G0AOZ]

It could be you're suffering from the conflict between a very recent Microsoft patch (KB951748) and Zone Alarm Security Suite. I found this out by chance yesterday. Uninstall the patch, and get the latest download from Zone Alarm. Check this site:-

http://www.zonealarm.com/store/content/home.jsp?lang=en&ctry=GB&dc=56pus

The big yellow box mid-way down the righthand side of the screen gives you the info...

Hope that helps.

ROGER - G0AOZ.

 

[BadBigBen]

Sorry about the the NETSH command there, I was a bit tired last night when I wrote that, but no harm done since you found out how to do it anyways...

G0AOZ brings up a valid point to be looked at... if you have ZA then uninstall it for testing or update the PATCH (I read somewhere there is a v2 of the patch now out)...

also take a look at:

Identifying A DNS Problem In Your Internet Service

http://networking.nitecruzr.net/2006/05/identifying-dns-problem-in-your.html

The DNS Server Settings On Your Computer

http://networking.nitecruzr.net/2006/03/dns-server-settings-on-your-computer.html

Problems With The LSP / Winsock Layer In Your Network

http://networking.nitecruzr.net/2005/05/problems-with-lsp-winsock-layer-in.html

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[pantichd]

BadBigBen,

No biggie!!! I appreciate the help.

 

[pantichd]

Thanks everyone for all your replies.

I'm still going to try and figure this out but it just dropped in priority because my dad said to just get him a new PC. This was like the last straw for him. He's been bugging me to just get him a replacement PC for awhile anyway.

The current one is an old Gateway with <300MB RAM, an old 15" monitor and a dog-slow CPU.

Just got on NewEgg (love that site!) and got the components for a pretty slick unit that'll last him and my mom a long time. All they do on there anyway is just browse the web and read/send emails.

Again, thanks everyone for all your help.

 

[BadBigBen]

Oh, well no problem there...

if you run into any problems there later on, you know where to find us... <grin>



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[Sympology]

I know your on about getting a new pc, but have you tried putting in a manual DNS entry?

take a look at OpenDNS. You don't have to pay for the service, just look for the DNS IP addresses and add these.

http://www.opendns.com/

Only the truly stupid believe they know everything.
Stu.. 2004