Virus/spyware or Windows XP or firewall problem?

[Claeren]

Hey all,

A female friends laptop is all messed up. She had it down in the States and was on the hotels wireless internet. The next time she tried using it the internet wouldn't work with some message about the firewall being active coming up. But when you try to change the firewall settings it won't let you and it says you are locked out. Stranger yet, it looks like the internet is connected but at a low speed?? Also, as the browser tries to load the first page it says it is connecting but it is to some strange IP address in the bottom of the IE browser window? It always fail to connect though?

Any ideas?

She says she did not download anything but on the otherhand she had no anti-anything software on her computer either!

She was seriously going to throw out her nice laptop instead of trying to fix it!! ack!


Any other info needed?


Thanks!
Michael.

[boobaloo]

The connecting to some strange IP address in the bottom of the window would lead one to think hijacking virus. Is she in Calgary? Check around for a reputable computer geek company that can clean it....regular virus scanners cannot always detect some of the sneakier ones...Oh and one more thing...AVG antivirus is free and reasonably reliable/comprehensive.

[Claeren]

She is back in Calgary...

I have AVG on my own computer at home actually. If i downloaded a recent version and loaded it on to her computer directly is there a chance that is could fix the problem?

Thanks!



Claeren.

[boobaloo]

She can certainly try it, it would not hurt. Spy-bot is another free downloadable program that is pretty good at detecting most spywares...make sure the file definitions are up to date, and it also has an "immunization" which blocks some spyware from coming in. I am not sure if the hijack will allow her to go to a website and download these things, but it's certainly worth the try. Some of these hackers who write the programs deliberately include lines that will not allow you to go to sites with programs to fix what is wrong. She should try it, anyway. If not, you can always try saving the downloaded program file to a DVD and putting it on her computer that way.

It's very likely the problem...the hotel has free internet, so there is no firewall protection there, either, and they aren't likely to spring for the type of antivirus programming you would need to cover an open network like that.

[Claeren]

Cool, thanks, i will try that! It is worth a start before taking it someplace else to get fixed.





Claeren.

[llama64]

The firewall issue sounds like a virus/malware issue. As mentioned, Spybot or Ad-Aware should help.

Another idea you might want to try is checking if that strange ip address is a local address (127.0.0.1 or 192.168.x.x). Maybe she accidentally turned on a proxy connection? I've done that in IE before and confused myself for a while.

[Claeren]

The firewall issue sounds like a virus/malware issue. As mentioned, Spybot or Ad-Aware should help.

Another idea you might want to try is checking if that strange ip address is a local address (127.0.0.1 or 192.168.x.x). Maybe she accidentally turned on a proxy connection? I've done that in IE before and confused myself for a while.

Yeah, the first one!! Zeros and ones in the IP!

How do i turn that off?!



Claeren.

[Bobblehead]

Yeah, the first one!! Zeros and ones in the IP!

How do i turn that off?!



Claeren.

127.0.0.1 is the loopback address, and it means you computer is trying to talk to itself. Therapy may be required. (jk)

Edit: thinking about it, if everything is trying to go there, I wonder if the HOSTS file is fubared.

It is found in the directory: C:\WINDOWS\system32\drivers\etc

The file doesn't have an extension (it is simply called "hosts") but it is a text file.

Here is what a totally clean one should look like:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

[Claeren]

^ cool, thanks! I will check that.


Also, to check the proxy forwarding, is this all i need to to:
http://mcobit.business.nd.edu/kb/kb.cfm?Action=NEWQuestion&gid=1424

[Claeren]

HEy all,

I figured it out and yes, her computer was doing the proxy forwarding. Once i turned that off the internet started working grreat!!


Her firewall is still not working and i am going to load on some anti-malware programs next time i have a chance.



Thanks all!
Claeren.

[halibut]

spybot Search and destroy -
http://www.safer-networking.org/index2.html

Avast Home edition A/v (free and works better than AVG imo) also it doesn't alter your email signature.
http://www.avast.com/eng/avast_4_home.html

http://www.firewallguide.com/software.htm - personal firewall review

Firefox w/ no script, adblock plus, and IE Tab extensions work wonders.
http://www.mozilla.com/en-US/firefox/

Four things I highly recommend. It is amazing how much the last item stops crap from flowing in.