This might not be the right forum but will sure intresset experts (and me)

Hi

I am new to this forum but not to Comodo and computeras over all. I have the most remarkeble problem.

For like 4-5 months ago my Internet randomly shut down. Not in complete but it slowed down the connection speed to like 1kb/s or 1b/s. The Commodore 64 loaded faster (Bruce Lee on tape anyone? Stopped at 263 counters? And then U could get ?Load error. wellwell). No virus. No Trojan. Scanned with AVG, Malaware, Ad-awrae , SpyDoctor. Nothing. No harware failure (Connection indicated 100Mbit/s), no DNS error when I called them. Netstat works when internet is down. Neither MSN, browsing or email works. Its all dead. Soulution? System restore.

Ive searched the Internet for this problem and found simular problems but not exactlly this one. Now I have downloaded CIS and uninstalled AVG and hopefully this will get rid of the problem. But I have to ask you guys. WHAT is this problem??? Noone seem to know.

Beats the hell out of me. I would go to download.com and get these 2 programs (hijack this) and (wireshark)

I would start with this (gotta start somewhere, right)

  1. Post a (hijack this) report here.
  2. play with the wireshark program, it might give you a clue
  3. call the phone company and ask if there working on the lines in your neighborhood

Haha the Phone Company… for 5 months? HiJack Ive tried but not posted it here. Will try the other program. My computer worked fine today which is a good thing.

I sujest you follow this guide…

  1. Back-up all your files and folders using a back-up program, for example Comodo Back-up

  2. Download following programs and install them

[u]Superantispyware
Direct downloadlink from publisher
External downloadlink
External downloadlink 2

Malwarebytes Antimalware
Direct downloadlink from publisher
External downloadlink
External downloadlink 2

Bitdefender Free (32 bit only !)
Direct downloadlink from publisher
External downloadlink
External downloadlink 2

  1. Check for definition Updates (Important!).

http://i39.tinypic.com/2cfqqs6.png

http://i39.tinypic.com/zix5b7.png

http://i42.tinypic.com/8yt5w0.png

  1. Allow each program to scan. Scan one at a time.

http://i43.tinypic.com/20hxd9j.png

http://i40.tinypic.com/2yzhced.png

http://i40.tinypic.com/2q8x17m.png

  1. Let the programs clean the infections.

http://i39.tinypic.com/2wdc278.png

http://i42.tinypic.com/jua2dl.png

  1. Reboot into normal mode and see if you find any remains of the virus

  2. Download and install Hijackthis. Afterwards, do a system scan and safe a log file. A text file will open in notepad, safe this one and later upload it together with your post.
    DO NOT FIX ANYTHING YET !!!

http://i40.tinypic.com/2nbblon.png

  1. when posting back please include :
  • The hijackthis log
  • the name of the malware the programs said

Xan

Hi Nicklas,

For a more exact troubleshoot we need a bit more details but assuming this is not caused by a “rootkit” and a spamrun or something similar, you could try the following things now, and compare them when things are bad…

ping your default gateway (use ipconfig /all to find it’s ip address).
This should give a stable result, if your on Copper it should respond between 1 and 3 ms.

then test if dns resolving works type:
nslookup www.ripe.net
And see if that resolves to an address.

Now ping that address on dns name, my response time is 10ms to www.ripe.net.

Now make a traceroute to it:
tracert www.ripe.net

This will output like this:
7 9 ms 9 ms 18 ms PC11.er1-asd5.nl.euro.net [194.134.161.11]
8 10 ms 14 ms 10 ms gw.amsix.nikrtr.ripe.net [195.69.144.68]
9 10 ms 9 ms 9 ms gw.transit.nsrp.ripe.net [193.0.3.1]
10 12 ms 10 ms 11 ms aquila.ripe.net [193.0.19.25]

Every hop along the way will report it’s response time from them to you so you can find where the delay is “starting”

Hope this helps a bit.

Haha the Phone Company... for 5 months?
I knew someone here was going to think its funny. But, I can understand why!!

At my house, we had the internet come in and out(incuding phone service) for 8 months and at random times. After a long time trying to figure it out. One day, I decided to call the phone company. Apparently they were doing some major work in the area for a long time. But to keep the story short. They eventually finished it and problem solved. <–right before winter too. :o

WOW!!! Thanxx for all this reply. What knowledge outthere. I will defenetly follow your advice but forgive me if I not respond too quickly because I have much work right now but check in cause I will do this. Again, thanxx!

Ronny: How do you ping something and how do you work the ripe-page? I am totaly lost there.

It is possible to trace in ms Dos and it always times out at step 4. Could U gudie me throguh this on a “baby” level?

eXPerience. Comodo AntiVirus Qurantined the zlib.dll fiel which causes Botdefender to a non-run. Evenm if I restore the file I get a error message. I ran a online quickscan though with Bitdefender and it showed no results.

I will run Superanti and Malaware. Done that before and there is no show of malware. One question here is also if it WILL find anything while Internets running fine or if it will find something when it craches? I problbaly should do both huh?

I will do this, paste logs and the Hijack log here. I am sorry this takes time but I am choked right now but very thankful!

From the original post, if everything has run fine since changing from AVG to CIS, there could have been some problem with your AVG installation.

Unless it occurs again and you are happy with your HJT log I would not be concerned.

No problem, if you are on XP open a command-box (start, run, cmd, now press enter). Now there will open a black window with something like:

C:>

now if you type ping here and press enter it will show you a few options, like below.

[i]Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
[-r count] [-s count] [[-j host-list] | [-k host-list]]
[-w timeout] [-R] [-S srcaddr] [-4] [-6] target_name

Options:
-t Ping the specified host until stopped.
To see statistics and continue - type Control-Break;
To stop - type Control-C.
-a Resolve addresses to hostnames.
-n count Number of echo requests to send.
-l size Send buffer size.
-f Set Don’t Fragment flag in packet (IPv4-only).
-i TTL Time To Live.
-v TOS Type Of Service (IPv4-only).
-r count Record route for count hops (IPv4-only).
-s count Timestamp for count hops (IPv4-only).
-j host-list Loose source route along host-list (IPv4-only).
-k host-list Strict source route along host-list (IPv4-only).
-w timeout Timeout in milliseconds to wait for each reply.
-R Use routing header to test reverse route also (IPv6-only).
-S srcaddr Source address to use.
-4 Force using IPv4.
-6 Force using IPv6.
[/i]
Now if you type ping forums.comodo.com and press enter it will look like this:

[i]C:>ping forums.comodo.com

Pinging forums.comodo.com [91.199.212.149] with 32 bytes of data:
Reply from 91.199.212.149: bytes=32 time=28ms TTL=53
Reply from 91.199.212.149: bytes=32 time=31ms TTL=53
Reply from 91.199.212.149: bytes=32 time=30ms TTL=53
Reply from 91.199.212.149: bytes=32 time=29ms TTL=53

Ping statistics for 91.199.212.149:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 28ms, Maximum = 31ms, Average = 29ms
[/i]



The above command also issues an automatic DNS Query for translation of forums.comodo.com to address 91.199.212.149 you can also do DNS querying with the command line tool nslookup.

type nslookup forums.comodo.com and press enter in the command-box it will look like this:

[i]C:>nslookup forums.comodo.com
Server: <address/name of your nameserver>
Address: a.b.c.d

Non-authoritative answer:
Name: forums.comodo.com
Address: 91.199.212.149
[/i]

Hope this helps a bit.

I will try that next time it happends. But the plot thickens. It happend yesterday. I booted in safe mode with network to see if I could connect to Internet. No such luck. Same problem. I then restarted in normal mode and voila: Internet now worked. Without me doing any systemrestore.

My computer told me when I tried to shut it down later that 8e4 didnt respond. I googled that with out any success.

Please check your Windows System Eventlog, maybe there is something there that could explain a few things…

Id love to but how do I do that and should I look for something particular?

Click start, run, then type eventvwr and press enter
That should bring up the Event Viewer, select the "System log and specially look for “Warnings” or “Errors”.

Very intressting. I will really inspect this the next time the error occurs - 4 now I lost track of when it happend the last time and the systemlog is quiteful of information. But thanx again. it also fun to learn!