Cannot find server/Page cannot be dispalyed

Hi,
This problem may be slightly long but I will do my best to shorten it.
A friend wanted me to check their computer for spyware, etc, etc.
They have Windows Xp with Norton Virus Protection.This is what I did:
* Ran free spyware scan - detected 27
* Task Manager - all appeared fine
* StartUp (Msconfig) - unchecked "msbb "
* Registry - all appeared fine
* Tried to get into Internet Explorer - cannot find server
* Set up computer with MSN - Internet access was fine thru MSN
* System file checker - sfc /scannow - no problems
* Control panel-Add/Remove - Windows Setup - unchecked and rechecked
Internet Explorer - Internet Explorer still cannot find server
* Checked IP Address - active IP address present
* Modem (Broadband Connection)- unplugged it and plugged back in
* Ran free Virus Scan - 9 Trojans found - NonCleanable
- ISTBAR.H
- PORNDIAL.BP (4)
- DYFUCA.B
- DLEF.FB (3)
* Maintenance - deleted cookies - temp.int files
* Ran CWShredder - went too fast to know what it did
* System Restore - disabled it
* Ran free Virus Scan again - same 9 trojans found again
* System Restore - enabled
* Click to "show hidden files & folders and unchecked to show the protected
operating system files "
* Registry - deleted "cxq and mhq" per one of the directions to remove
trojan files
* Ran another free spyware scan - found 380 infected files & 102 folders
* Ran Norton Virus - found nothing
* Security - "use SSL 2.0 AND 3.0 were checked
* Parental Control - disabled in Norton Security
* IP Address ping - 4 packets sent and 4 reply's recieved
* Internet Explorer still cannot find server
ANYONE HAVE AN IDEA OR SUGGESTION...I AM EXHAUSTED & AT A LOSS....

 

Several things you could try.

- Take a look at the hosts file. Some malware baddies will load it with bogus addresses matched with sites they don't want you to find. Security sites that could help diagnose or clean them for the most part.

- You didn't specify what spyware cleaners you used but most on here like a combination of spyware blaster, spybot, and ad-aware. Spyware blaster is mostly passive protection as is the immunize feature of Spybot.

- Download Hijackthis, save it to a non-temp folder so you won't lose any backups it makes, run a scan and have it create a log file. When you save the file it should open in notepad. Post the contents here.

I'm moving this to the security section since it sounds malware or viral related and it will get better looks there.

 

Hi,
The first spyware scan I did was from www.spywareguide.com
The free virus scan was from www.housecall.com
The second free spyware scan was from www.noadware.com

I would like to mention that after I downloaded MSN getting in and out of the Internet thru MSN was fine for a few days (while I tired in-vain to find out why the server could not be found for Internet Explorer), now I can not even gain access into the Internet thru MSN. I also could not find MSN Explorer in the Add/Remove programs. As I wanted to delete it.

I have done alot of troubleshooting on computers looking for and removing spyware-adware-malware-torjans and viruses and this has been the toughest so far to figure out.

 

First of all, noadware is a scam. Know a guy 2 weeks ago, paid $35 online via credit card for registration number to allow full cleaning and there was no place to enter the number, hence no full cleaning. Clicking help opened an AIM buddy window.

It sounds like a broken winsock chain. You didn't specify the OS so....I think this WinsockFix will work on all. Direct download....will fit on floppy. Check the read me. There is another that specifies all, but will need a file splitter to put on floppies. Let me know if that happens.

There are two free anti-spyware programs that should be added to your toolkit, and they are the only two you need, IMO. Spybot and Ad-aware. Download from my signature. Install and immediately update. Run Spybot and fix everything it finds that is prechecked. Configure Ad-aware for a custom full scan, run and delete all it finds.

Once you get it back online, scan the PC with RAV and again with Housecall. Scan reports from both would be appreciated, as well as posting a HijackThis log.

 

Hi,
I guess I was the luckier one with Noadware because I did just a free scan. I have used Adware, Spybot and Spy Sweeper in the past. I am one who likes to hunt them down. I do apologize for not mentioning the other and final step I did which was, I went to start,search,files & folders, typed in Wsock32.dll and up came to listings: Wsock32.dll C:\Windows\System32 -and- Wsock32.dll C:\1386...I tried changing the last one to from Wsock32.dll (C:\1386) to Wsock32.old and it disappeared...Thats when I left well enoguh alone and came to ol'reliable Microsoft BBS for assistance...

P.S... As for running Hijack this and posting it, I've never done that but will try and do so later on today...

 

Hi,
It just dawned on me, that I can not run "Hijack this" on my friends computer because I can not get into the Internet. So instead I will try the Winsock option and post back as soon as that mission is accomplished...

 

HJT will fit on a floppy also, as well as the log it generates.

 

Okay thanks. I will see what I can do and keep everyone updated...

 

Click.

 

Hi,
Thanks for the latest info...I'll be awhile reading it cuz it's 28 pages long. Let you know if that works too...

 

C:\1386 - if that is C:\I386 then it is the windows install cab files from the install CD and the folder was placed on the Hd so you could run sfc and fix any bad or missing system files without needing the install CD in the drive.

 

Thank you for that info, very much appreciated. Maybe it's safe to assume then when I tried to change it to "old" that's why it disappeared off the screen ? It was the last thing I did before stopping and posting here. I will not make it over to my friends house tonight as previously figured, so hopefully this weekend I can and will post back with the yeah's or nah's of how everything went...

 

******************** UPDATE *********************
Mission accomplished...To make a long story short I followed the directions of "How to determine and recover from Winsock2 corruption" from Microsoft Knowledge Base Article# 811259 and the Comcast home page comes up just fine where before all it would say is "Cannot find server-page cannot be displayed "...

However, Internet Explorer needs to be downloaded and every time it does so, it hangs at 87% and says the following:

SOFTWARE INSTALLATION
The software you are installing has not passed windows logo testing. To verify it's compatability with windows xp. This software will not be installed, contact your system administrator.

I also noticed the home page even though it was now accessible, that it also changed twice on me each time I rebooted. I was able to change it back but something told me, there was more house cleaning that needed to be done. So I ran "Spy Sweeper" and it found numerous adware plus three more trojans to go along with the other 9. I beleive the items found were blocking the downloading on Internet Explorer 6. I will be returning to my friends house within the next couple of days to try once again (now that spy sweeper has found more infections) and see if Internet Explorer will do a complete install. I will keep you all posted, and as always your help is always appreciated...

 

Thanks for the update.

 

Hi,
Here's the final problem, and can not seem to put my finger on the cause. As a result of losing Internet Explorer (and since it's been re-installed), a prompt kept coming up on reboots saying Internet Explorer has been removed, etc, etc. So I have been trying to reinstall it but with no luck. What's puzzling is, I can get into the Internet thru the Comcast connection (Home Page) and the same thru MSN. Internet Explorer is listed in the Add/Remove programs as well. The error message that comes up is as follows:
"Set up was unable to install all the components. Please close all applications and try running again "...
Every time I do it says file missing from directory, do I want it to get those files from the Internet. I click YES and it reboots everything, restarts and the same problem happens. It gets as far as 87 % and ceases. I'm at a loss as to whats triggering this. My gut feeling is, there's still something lurking around and I've yet to fish it out, not sure...

 

Now that is strange, or what you are seeing is an IE update. IE6 is the default internet explorer in XP, and cannot be uninstalled. It's not listed in the add/remove nor in windows components. It can however, be repaired. Try method 2.

Have you run online virus scans? Did you make a HijackThis log to post so we can see if there's something amiss?

 

Hi,
Thanks for the quick reply once again...Yes I have tried both steps one and two, and it was step 2 along with deleting Winsock and Winsock32 from the registry plus I beleive the reinstall of the TCP/IP protocol that repaired the Internet Explorer connection.

I was fortunate enough to have prior knowledge of Internet Explorer not being able to be uninstalled from Add/Remove because it's a built in feature with Windows Xp, but when I tried it anyways, a prompt came up afterwards asking if I wanted to change the settings or something to that affect.

You are correct with it being a IE6 Update. A matter of fact a message would also pop up during the process of trying to install it requiring IE6 Service pack 1 must be completed (I believe). I tired that also and would get the same problem when it reached 87 %...

I am wondering if there is some kind of glitch that this is one of those times since access is being allowed to just leave well enough alone ??? I have tried disabling the firewall, virus protection and the parental control before and that did not change the outcome. One other thing that happens that I can not attribute to being or having any direct cause is every time, Spy Sweeper detetcts the home page being changed and asks if we want to change it or return it to Comcast. That's the scoop.

 

Click.
Click.
Click.

 

Hi,
Thank you...I won't be able to do the Hijack thing for another couple of days due to other pending computer calls. I will be sure to do as directed and post back...I also will hold off on doing anything else until the Hijack thing is done, posted and further advice provided as requested...

 

OK, thanks. I'd just like to make sure the machine is all clean before we try to do any more repairing. Something amiss could be the problem too.