42 replies to this topic

[hyebba]

Hiya and thank you for helping me!

I've been getting help from IndiGenus, one of the malware techs, and he feels we're pretty clean as far as malware goes. You can check out what all he did here: http://www.malwarebytes.org/forums/index.p...mp;#entry157558

I am having pretty severe connection issues, I think. I am running firefox browser, Avast Anti-virus, and windows firewall (I had installed COMODO, but wasn't confident in my ability to run it properly, so I uninstalled and went back to Windows)

I have gotten a new modem from my ISP, just in case it was a hardware issue.

Web surfing is at a crawl and I have to either click a link multiple times, or refresh the page many times if there is any hope in connecting. Many times I just get a 'connection was reset by the server" or "could not find server" error message in firefox.

IE is slow also.

I removed extensions, add-ons, and extra toolbars from firefox...helped some.

Brand new hard drive (less than two months old, problems just started a little over a week ago.

I also have a VOIP phone and people can't hear me (comes through very broken), but I can hear them fine. But I drop a lot of calls.

Cable light on modem is solid, PC light flashes (should be solid as well)

Please help me get running again..I am unable to work. THANK YOU SO VERY MUCH!!
~heather

[exile360]

Greetings Heather and welcome

I will try to see if I can't help you with your issue. Please read carefully and let me know if you have any questions.

Create a batch file:

Note: You will need to save any work before double clicking the "fix.bat" file because it will automatically restart your computer

• Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  ipconfig /release
  ipconfig /renew
  ipconfig /flushdns
  netsh winsock reset all
  netsh int ip reset all
  shutdown -r -t 10
  del /f /q %0

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file fix.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it runs it will automatically restart your computer
  
• Once your computer boots again, check to see if your internet performance has improved

Please let me know how it went.

Thanks

[hyebba]

exile360, on Nov 14 2009, 01:05 AM, said:

Greetings Heather and welcome

I will try to see if I can't help you with your issue. Please read carefully and let me know if you have any questions.

Create a batch file:

Note: You will need to save any work before double clicking the "fix.bat" file because it will automatically restart your computer

• Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  ipconfig /release
  ipconfig /renew
  ipconfig /flushdns
  netsh winsock reset all
  netsh int ip reset all
  shutdown -r -t 10
  del /f /q %0

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file fix.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it runs it will automatically restart your computer
  
• Once your computer boots again, check to see if your internet performance has improved

Please let me know how it went.

Thanks

Hello Exile! thanks for helping me!

That little fix thing is pretty cool. Can I keep that and run it periodically if I'm slowing down? I had renewed the IP already in hopes that's what it was, but nope. And unfortunately, nothing changed after running the fix.

When I restarted the browser, it took probably 20 seconds for the page frame to even open, then another 30 seconds for the home page to start loading. The status bar lights up halfway and then hangs.

Question. I had COMODO firewall, but uninstalled it because I'm not real confident in my ability to use it properly. but it's not uninstalled. When I go back to add/remove programs, it shows there, but won't let me click on the 'remove/change' button. I even tried product where name is="COMODO" uninstall in the cmd window, but it says no instances are found. I have a feeling having this still on here is going to start causing me problems (COMODO restarted when the computer did) Can you tell me how I can go about getting that uninstalled? I'm sure just deleting the files isn't the right thing to do.

thanks! and I will patiently wait for your direction!
~heather

[exile360]

Hello again

You can keep the fix around if you'd like, but it's overkill in most cases so if you want something simple to reset your internet connection you can use the same one that I do:

@echo off
ipconfig /release
ipconfig /renew

Just make that into a batch file as you did with my last set of commands (this one won't delete itself either ).

As for Comodo, yes, it does sound like it may be the cause of the issue. We'll try a few things to see if we can't remove it completely:

Step 1:

Run the Windows Installer Cleanup Utility:

• Download the Windows Installer Cleanup Utility from here and save it to your desktop
  
• Double click it to run it and accept the End User License Agreement and follow the onscreen instructions to complete the installation
  
• Once it finishes, go to C:\Program Files\Windows Installer Clean Up and open msicuu.exe
  
• Find Comodo on the list and select it by clicking on it once and then click the Remove button
  
• Confirm that you want to remove it and allow the tool to get rid of it
  
• Reboot when that's complete to see if your issue is resolved

If that did not get rid of the problems then please continue to Step 2

Step 2:

Please download Sysinternals Autoruns from here.

• Save Autoruns.exe to your desktop and double-click it to run it.
  
• Once it starts, please press the Esc key on your keyboard.
  
• Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures
  
• Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
  
• When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.
  
• Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
  
• Attach the Autoruns.zip folder you just created to your next reply

I will review your Autoruns.arn file and guide you on manually getting rid of any leftover Comodo components that are loading and possibly causing your problems.

[hyebba]

Thanks for the bit of code, I appreciate that!

I ran the clean up tool (which is also very neat) but Comodo doesn't show up in the list. It DOES show up in the Add/Remove Programs section of the control panel, it's in program files, and it starts when I reboot. acchggggh!!

Attached is the file. Thanks again for your help.
~heather

Oh, i had to change the extension name to .txt because it said I did not have permission to load a zip file. Let me know if that actually works.

thanks!

[exile360]

Open Autoruns and let it scan and once it completes, click on the indicated tab and right click the entries listed and select Delete:

• Click the Logon tab and delete the following:
  [indent]COMODO Firewall Pro (Verified) Comodo CA Limited c:\program files\comodo\firewall\cfp.exe[/indent]
  
  
• Click the Services tab and delete the following:
  [indent]cmdAgent COMODO Firewall Pro Helper Service File not found: C:\Program Files\COMODO\Firewall\cmdagent.exe[/indent]
  
  
• Click the Drivers tab and delete the following:
  [indent]cmdGuard COMODO Firewall Pro Sandbox Driver (Verified) Comodo CA Limited c:\windows\system32\drivers\cmdguard.sys
  cmdHlp COMODO Firewall Pro Helper Driver (Verified) Comodo CA Limited c:\windows\system32\drivers\cmdhlp.sys
  Inspect COMODO Firewall Pro Firewall Driver (Verified) Comodo CA Limited c:\windows\system32\drivers\inspect.sys[/indent]

Once that's complete, reboot your PC and go to C:\Program Files and delete the Comodo folder if present. If you'd like you may also delete the following from C:\Windows\System32\drivers:

• cmdguard.sys
  
• cmdhlp.sys
  
• inspect.sys

Please let me know how it goes and how things are working now.

Thanks

[hyebba]

exile360, on Nov 15 2009, 02:55 PM, said:

Open Autoruns and let it scan and once it completes, click on the indicated tab and right click the entries listed and select Delete:

• Click the Logon tab and delete the following:
  [indent]COMODO Firewall Pro (Verified) Comodo CA Limited c:\program files\comodo\firewall\cfp.exe[/indent]
  
  
• Click the Services tab and delete the following:
  [indent]cmdAgent COMODO Firewall Pro Helper Service File not found: C:\Program Files\COMODO\Firewall\cmdagent.exe[/indent]
  
  
• Click the Drivers tab and delete the following:
  [indent]cmdGuard COMODO Firewall Pro Sandbox Driver (Verified) Comodo CA Limited c:\windows\system32\drivers\cmdguard.sys
  cmdHlp COMODO Firewall Pro Helper Driver (Verified) Comodo CA Limited c:\windows\system32\drivers\cmdhlp.sys
  Inspect COMODO Firewall Pro Firewall Driver (Verified) Comodo CA Limited c:\windows\system32\drivers\inspect.sys[/indent]

Once that's complete, reboot your PC and go to C:\Program Files and delete the Comodo folder if present. If you'd like you may also delete the following from C:\Windows\System32\drivers:

• cmdguard.sys
  
• cmdhlp.sys
  
• inspect.sys

Please let me know how it goes and how things are working now.

Thanks

Hello hello.

I did all of the above and it's still hanging up real bad. "Sever not found" and "Connection was reset by server" error messages, super long time for pages to load.

Thanks for helping!

[exile360]

Create another batch file:

• Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  netsh int ip reset resetlog.txt
  ipconfig /renew
  del /f /q %0

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file fix.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Check to see how your internet performs now and let me know

Also, please do a new scan with Autoruns as instructed in my earlier post and zip and attach the Autoruns.arn file so I can make sure there's no more Comodo leftovers. If you're out of attachment space on the forum you can click My Controls at the top of the page and then click Manage Attachments on the left and delete the original Autoruns.zip file you posted as I've already downloaded it so I won't need it again .

Thanks

[hyebba]

exile360, on Nov 16 2009, 12:42 AM, said:

Create another batch file:

• Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  netsh int ip reset resetlog.txt
  ipconfig /renew
  del /f /q %0

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file fix.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Check to see how your internet performs now and let me know

Also, please do a new scan with Autoruns as instructed in my earlier post and zip and attach the Autoruns.arn file so I can make sure there's no more Comodo leftovers. If you're out of attachment space on the forum you can click My Controls at the top of the page and then click Manage Attachments on the left and delete the original Autoruns.zip file you posted as I've already downloaded it so I won't need it again .

Thanks

Hi! I ran the code as a .bat file and no change in the internet behavior. Still sloooooow as can be. I've attached the .arn zip file but had to rename it .txt for the forum to let me upload it.

Thanks for helping me with this!

[Strangedays]

Have you tried to disconnect the Voip from the pc to troubleshoot

[hyebba]

Strangedays, on Nov 16 2009, 04:35 PM, said:

Have you tried to disconnect the Voip from the pc to troubleshoot

Yeah, I did that before I started looking for help. Will you be taking this thread over for Exile360?

Thanks,
H

[exile360]

Nope, Strangedays was just offering some additional advice, I'm still here .

Open Autoruns and let it scan and once it completes, click on the indicated tab and right click the entries listed and select Delete:

• Click the Internet Explorer tab and delete the following:
  [indent]AVG Safe Search File not found: C:\Program Files\AVG\AVG8\avgssie.dll[/indent]

Keep Autoruns open and for the following entries just uncheck the box to the left of each listed entry do NOT delete them:

• Click the Logon tab and uncheck (do not delete) the following:
  [indent]Adobe ARM Adobe Reader and Acrobat Manager (Verified) Adobe Systems, Incorporated c:\program files\common files\adobe\arm\1.0\adobearm.exe
  Adobe Reader Speed Launcher Adobe Acrobat SpeedLauncher (Verified) Adobe Systems, Incorporated c:\program files\adobe\reader 9.0\reader\reader_sl.exe
  RoxWatchTray RoxMMTrayApp Module (Verified) Sonic Solutions c:\program files\common files\roxio shared\10.0\sharedcom\roxwatchtray10.exe
  SunJavaUpdateSched Java™ Platform SE binary (Verified) Sun Microsystems, Inc. c:\program files\java\jre6\bin\jusched.exe[/indent]
  
  
• Click the Internet Explorer tab and uncheck (do not delete) the following:
  [indent]Java™ Plug-In 2 SSV Helper Java™ Platform SE binary (Verified) Sun Microsystems, Inc. c:\program files\java\jre6\bin\jp2ssv.dll
  JQSIEStartDetectorImpl Class Java™ Quick Starter binary (Not verified) Sun Microsystems, Inc. c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll[/indent]
  
  
• Click the Services tab and uncheck (do not delete) the following:
  [indent]JavaQuickStarterService Prefetches JRE files for faster startup of Java applets and applications (Verified) Sun Microsystems, Inc. c:\program files\java\jre6\bin\jqs.exe[/indent]

It also appears you have at least 2 or 3 toolbars installed (Live, Yahoo!, Google). I'd highly recommend removing any that you don't need as their features can slow browsing speeds. Reboot your computer. Please let me know how it goes and how things are working now.

Thanks

[Strangedays]

Exile is correct and as having once worked for a cable company all the new modems in the world don't help if the problem is at the trap outside. Your ISP could do a diagnostic check if you call support. Not saying that's what it is but could be.

[exile360]

Absolutely, and thanks for the input Strangedays . I've had to do such tests with my ISP (AT&T DSL) several times to correct connectivity issues that were either on their end or a problem with the modem or its configuration.

[Strangedays]

No problem Exile. Just trying to help some

[Strangedays]

If you have other cables to use switch them out as well. One could be going on it's way out.

[exile360]

Also, use the same connection on a different computer if you've got another one, that will tell you if the problem is with the PC or the connection/modem/ISP.

[hyebba]

exile360, on Nov 17 2009, 12:14 AM, said:

Also, use the same connection on a different computer if you've got another one, that will tell you if the problem is with the PC or the connection/modem/ISP.

Wow, you guys are awesome! Thanks Strangedays! (You too, Exile! )

Ok. I deleted/unchecked all the items you directed me to and rebooted.

Surfing seems mostly fine, a few hangups and a couple of 'firefox could not find server' messages, but all in all much faster than it has been. Still not optimal, especially with it being so new and all, but definitely doable.

Strangedays: I will definitely get with my ISP again tomorrow and have them run some more checks. I had called once before and they told me my connection was fine, but I will have them dig and make sure I know exactly what it is they are doing.

I have some more ethernet cables that haven't been used, so I will swap those out and see if that helps.

Is it okay if we leave the thread open for another day just in case it starts hanging again? That will also give me a chance to try the above recommendations and see how it all works out.

Thanks to both of you! the world is a better place with guys like you! (hey, this tech stuff can make anybody mad...your presence is greatly appreciated!)

[exile360]

Yes, we'll keep it open and you're very welcome. As for FireFox, please go to your add-ons and list them here for me in detail please in case any of them should be disabled as well.

Thanks

[hyebba]

exile360, on Nov 17 2009, 12:43 AM, said:

Yes, we'll keep it open and you're very welcome. As for FireFox, please go to your add-ons and list them here for me in detail please in case any of them should be disabled as well.

Thanks

Hi and good morning Exile!

Add-ons that are currently active in Firefox:
java deployment toolkit
Java TM platform
Mozilla default plugin
shockwave flash


Ok, my ISP was out here for a few hours. They reconfigured my signal and replaced all cabling from the outlets to the street.

STILL having issues.

but I did come across something. I pinged my:
IP address - it was fine. 32 out and 32 in on all four.
default gateway - fine 32 out 32 in on all four
then i pinged the DNS and got the following error:

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.



C:\Documents and Settings\heather>ping dns

Pinging dns.innomedia.com [207.69.131.10] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 207.69.131.10:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\heather>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : innomedia.com
IP Address. . . . . . . . . . . . : 192.168.251.199
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.251.1

InnoMedia is the name of the device i use for my VOIP phone. I do not understand why the DNS would be named to that device name. I had disconnected the innomedia device for about two days and ran everything straight from the modem to the PC so that I could rule out the innomedia device and the problems actually seemed a bit worse.

I'm a fool when it comes to this type of stuff, but is there anything there that we can use?


thanks for hanging in there with me! I truly appreciate you!
~Heather