Mother's Laptop - Internet works, yet doesn't

[Denholm]

This is a rather peculiar problem that my mother's laptop is experiencing. The Internet works just fine, yet in the end, doesn't.

Okay, apparently something is requesting or sending a bad checksum to my mother's laptop after it finishes loading anything off the Internet. For example, I will load an Internet page through FireFox or Internet Explorer. After the page loads it immediately goes to a, "Page cannot be displayed" screen. The only way to prevent it is to press Esc to stop page loading before the page has finished loading. However, some other sites, such as microsoft.com, will work just fine.

I have also noticed this problem when downloading updates for AV and AM/AS software. ESET NOD32 can't update, it manages to get half the file, then fails to update. Spybot Search & Destroy downloads the entire file, then returns an error, "Bad Checksum." I did, however, manage to get the files after multiple attempts.

I performed AV scans via ESET NOD32 and Ad-Aware Pro 2007. Nothing returned. I also performed AS/AM scans via Ad-Aware 2007 and Spybot Search & Destroy. Nothing returned. I then ran an anti-rootkit scan with AVG Anti-Rootkit free. Nothing returned. So afterward I ran CCleaner to clean up temporary files and dump junk data. Afterward I defragmented the hard drive with O&O Defrag. Still, the Internet won't work properly.

Then I got curious as to if there may be some odd entries in the windows host file. There were, two entries that led to other IPs than 127.0.0.1, I erased those entries without thinking about it (sorry). So... any ideas about the problem or how to fix it?

If this information is insufficient, let me know. I'll try to help you out however possible.

EDIT: My mother's laptop uses Wireless Internet, yet I also tried using wired Internet (CAT5 to the router) while the wireless connection was disabled and the problem was still not resolved.

[drdeathx]

She has too many DRDEATHX pictures on the hard drive.....LOL ..... delete some of em!!!!!

[Denholm]

If they're there, she used a nifty algorithm to hide those pictures in the background picture.

[drdeathx]

 

[BaldEagl]

Maybe it has something t odo with security settings in the browser, the Windows firewall, the security software or somewhere else.

[Denholm]

Well, I disabled the windows firewall since it is relatively useless and doesn't do anything but slow you down. I'm not sure if it's the browser, though. It worked just fine until just about two weeks ago when the problem slowly started getting worse to a point now that you can not access the web at all, although you have a pristine Internet connection (Tested it by sending a file from my comp to her shared folder, it went through.)

I also don't believe the security software would cause this, if you want, I can try restoring defaults on NOD32. I tweaked some of the settings to monitor all inbound traffic for malicious connections or software. Yet two of our other computers use the same settings and have no problems.

[BaldEagl]

Evidently there are issues similar to this being reported by Spybot Search & Destroy users.  Try uninstalling, then re-installing Spybot Search & Destroy.

If you'd like an alternative to Spybot Search & Destroy I use SpywareBlaster for active control and Bazooka for clean-up (but have never needed it).

[Denholm]

I'll do that. Hopefully the network doesn't get blocked before then.

[Denholm]

It worked, for a moment....

I uninstalled spybot and the problem completely dissolved. Afterward I downloaded Spybot from download.com and installed it to regain the same measure of protection. After a reboot the problem was still not visible. However three minutes later after downloading Spybot updates the problem re-appeared.

So this time I downloaded and installed ThreatFire on my mother's laptop and scanned her entire system. ThreatFire picked up two worms, a trojan and a malware package. Both were located in the System Volume Information Folder. Afterward I rebooted, since ThreatFire recommended to do so in order to complete the quarantine process. After the reboot, whatever it was causing the issue got pretty mad... Now, regardless of what I do, both the wireless and wired connections will only get, "limited or no activity" on our network.

So, thinking it was Spybot again, I uninstalled it. However this time the problem remains and the laptop remains in lock down from Internet access.

Any other ideas, or should I ship it to my friend who knows how to play with laptop HDs?

[BaldEagl]

The System Volume Information Folder stores your restore points.  It seems unlikely to me at least that anything in there was causing the issue and I'm guessing that ThreatFire may have returned a false positive. 

The problem had disappeared from the time you uninstalled Spybot until you ran the Spybot updates so obviously the updates are the cause of your problem.

You mention you've already uninstalled Spybot.  Try uninstalling ThreatFire too as there may be shared files (because they are similar programs) that got left behind for ThreatFire to use. 

If the problems not resolved at that point, then make sure that both the Spybot and ThreatFire folders are completely deleted along with any content.

Hopefully that will do it.  If I were you I wouldn't re-install Spybot.

[Denholm]

I'll do that a bit later today. Thanks for the help so far.

[2bighorn]

Very often firewall, antivirus and other security software step on each other toes, therefore it is very important how you use all those utilities, ie proper configuration.

For example, if you run NOD32 (ver 3 and above) in default configuration, you can't have any other software performing same functions. You'd have to disable any anti-spyware protection in your firewall and other software (spybot incl.)

I use outpost pro, NOD32 and spybot on my main workstation. I disabled proxy on NOD32 for all internet application for which outpost gives me better control.

I don't use any of Spybot's memory resident protections, firstly because that's outpost and NOD32's job, secondly, I'd have the same problem you have. It just wouldn't work.

Use spybot as spyware scanner/cleaner and immunizer. That's all you need from spybot. Do NOT run spybot's TeaTimer if you already have anti-virus like NOD32.

[Denholm]

Thanks bighorn, I'll change around our other two systems to prevent this from happening.

Okay, so I uninstalled both SpyBot and ThreatFire, the last of the remaining security applications. Afterward I checked the registry for entries of either of the two and erased entries accordingly. I also checked the entire system for any traces of spybot or threatfire files/folders. After having taken a good hour to clean all of this I restarted the system. The network connections will still only receive, "limited or no connectivity."

Any other ideas?