A Problem...

Hello all,
I am a long time lurker, and I now have reason to submit my latest conundrum for public comment. Hopefully I can gain some insight.

The Situation:
A friend's laptop (XP Home) was running slowly. He suspected malware, a virus, or much worse. Noting that the laptop only had 256 mb of ram, I advised increasing that to 512. The laptop ran better. The laptop, running behind a router with both encrypted wireless and Cat 5 connections available, lacked a firewall and antivirus program. However, my friend always uses the limited user account and Firefox. So, in spite of the missing critical elements, his practices are relatively safe. (Nor does he have a penchant for Russian porn sites.....)

At his request, I shut down some non essential in services.msc (nothing network related), installed AdAware and Spybot, ran those and only came up with data mining cookies and Alexa toolbar related stuff. All were removed. I then installed Avast antivirus and Agnitum firewall.

At this point, life was good. Connectivity (browser and e-mail) was fine in both the admin and limited users' accounts.

The Results:
Four hours after I left, wireless connectivity was lost, although the Cat 5 connectivity was fine for all accounts. However, when he started or closed the browser, he would get the messgae "aupdate can't open log file."

As a starting point, I suggested looking at ipconfig to check the connectivity. The wireless, Cat 5 and gateway addresses all show up, as well as 169.254.178.127 showing up sporadically, which I understand to be a reserved local link address. The wireless card reported a decent connection, but it then showed that packets were being sent yet none were being received.

Things have gone downhill since. Neither the wireless or Cat 5 is providing connectivity.

My Suspicions (and Confusion):
1) Should I do a more thorough job of running the spware utilities and antivirus? Other utilities?
2) Could the installation of Avast and Agnitum have brought down the connection(s)? I did get a couple of statements from my friend to the effect of "a box appeared-I clicked on it-I don't know what happened." In other words, could my friend's lack of understanding, expecially of the firewall, have led to the destruction of the connections?
3) So, I am trying to form a methodical plan to solve the problem.
a- Should I rerun a set of malware/spware utitilites, given the "aupdate log file" message?
I found no evidence of a browser hijack, backdoor, key logger etc.
b- Should I unistall Avast and Agnitum? I was worried that my friend would not understand
these products. Or, is the firewall, especially if my friend managed to create an incorrect rule,
the culprit? This begs a question: since these products are price friendly, which products (free)
would be best for a less than savvy user?
c- Will networking have to be reestablished from the ground up?

Thanks.

My guess is that it is a configuration problem, since
it happened right after you made changes. Try disabling
the firewall and going through all the network
config stuff. Or do a system restore, back to before
you installed the AV and firewall.
:cool:

I love how people install all of this "Helpfull" software for other people who don't understand it and then wonder why problems occur.

OK, first off, software Windows firewalls, generally have pop ups, or they did back when I used Windows / Software firewalls in Windows. Like it would ask can this program do this? He said something popped up, which was probably a service asking can it do something, he probably said no, and now it doesn't work... Shocking....

Uninstall the firewall, uninstall the anti virii, turn the services you shut down back on.... It's maybe going to work after that. Then, reinstall the Anti Virii software. Let that update, and make sure it works. Then, shut down services one at a time until you have whatever you shut down as shut down and if it's still working, you can safely assume the firewall had a pop up and he didn't read it.

Quote:

---

you can safely assume the firewall had a pop up and he didn't read it.

---

This is most likely your issue

I think Gore has nailed it ;)

MLF

Gore,
I had some suspicions that my recovery process would be similar to yours, less the cynical sarcasm about helpful software. I suppose I should not have installed anti virus and a firewall on the computer, on the assumption that the user was a moron and that it would only complicate matters?
Perhaps the real concern is educating users to the learning curve of firewall pop ups?

Hi and a belated welcome to AO... :p

have you tried doing any of these scans in "Safe Mode", one thing you can try is to go into Safe Mode with Networking option see if you have any connection problems then.

If you are able to go online, I would then recommend a Housecall and let them scan your PC and follow their prompts.


As for services
Elder Geek services info

Or you can do a System Restore to the point before all of these changes and maybe this will reset everything back to normal....

I did try to boot to Safe Mode with Networking at the very beginning of the whole process. The computer stalled. In regular mode, I tried to Housecall and that too stalled. I ran Avast, and it came up clean.

Quote:

---

I had some suspicions that my recovery process would be similar to yours, less the cynical sarcasm about helpful software

---

Dont take it personally....Gore is far to cynical for his age....most of us are used to it. ;)

As for "software" firewalls...I personally dont like them ...as most users dont understand how to use them. When helping out friends\relatives with securing thier internet connections...I reccommend NAT routers....which filter out most of the garbage out there, a good AV\ASW...and regular system updates

Heres a great site to reccommend to users....if they are interested...just found it myself this morning
http://www.malwarehelp.org/

I also*** TRY*** to explain to them about thier surfing and email habits and the importance of updating the system\av\asw etc regularly.

If it is a laptop and they travel with it...I just enable the XP firewal...and pray that they do not get infected by some hotels un secured\malware infested network :eek:

and if they do....I fix it for them...keeps me in a job...and wine :D

MLF

Morgan,
My friend Charlie is a retired math professor. The latop doesn't travel. His computing practices are sound. He is trying to broaden his knowledge at this point. I sure as heck wasn't going to start preaching about IPTABLES on a Linux gateway to him.

Professors are the worse students. You said he was already behind a router.... Why install a software firewall that he knows nothing about when one interface is between him and the net already?

Second, why would you need to talk about Linux in this at all? Or IPTables? what does this have to do with a gateway?...

I am talking about a dlink 604 or similar router...that would allow multiple machines sharing one internet connection....no need to explain to him anything :confused:

even set up for one computer...it is an external firewall....no user interaction required ...other then initial setup ...and occasional reset (show him how to power it down and up again if his internet isnt working)

Blocks most of the crap out there....but will NOT prevent spyware\viris or other malware....that requires...mostly.............. user interaction.

MLF

Quote:

---

Originally posted here by Farrago
I did try to boot to Safe Mode with Networking at the very beginning of the whole process. The computer stalled. In regular mode, I tried to Housecall and that too stalled. I ran Avast, and it came up clean.

---

have you tried a system restore, just prior to when you started to make changes, also a system restore point if enabled will be created prior to Windows updates, maybe you have a bad patch and it corrupted some of your winsock settings, if so you can always get LSP fix and do a repair, sometimes third party install's will corrupt the settings (espescially Malware/SPyware).

Dalek makes an excellent point about LSP extensions and corruption of the IP stack....


I have seen it where you clean a machine.... it breaks things ...such as network connectivity...because the malware has attached itself to the service\app\file\registry etc...and when you remove the malware...it corrupt the configuration\file\service etc


MLF

Thanks to all, the problem was easily fixed. I uninstalled the firewall, rolled back the system restore point to a previous date, and voila! Further thanks to those who provided some good food for thought regarding software firewalls, users' abilities, etc.

You probably took what I said as me being an *******, but seriously, I've been fixing family member's computers for about 3 years, and one thing is usually true:

When you add complexity to a system they already aren't sure about, you add to the problem itself. The best thing, is tell him to go for his idea about learning more about computing in general, and have him read up on firewalls so this doesn't happen again.

Hell when I started in computing about 6 years ago, I thought when you shut down Windows, that "Restart" meant it would restart it from the day it was bought. When I installed something I'd shut down and turn it back on.

from one lurker to another

I have to agree with gore, i've been helping out family and friends with networking issues since i was 15 an you can install a software firewall and configure the crap out of it, and you'll still miss something. (also happens with spybot and the registery monitor).

and i've learnt you get cynical in the It industry very quickly, as i work in a school and regularly go home wanting to kill at least one teacher.

ok, back to topic, for malware and stuff, possibly try installing something like spybot, and just show him how to run the updates and run it once a week.

and as long as he's not doing anything major, i don't see why you can't educate him on using the standard windows firewall, everyone likes to think that they need to be secure, but the chance of it happening to one person doing their day to day stuff, is small.

I know i'm gonna get shot down for recommending products, but that's my 2cents worth

triad :D

Quote:

---

Originally posted here by Farrago
Thanks to all, the problem was easily fixed. I uninstalled the firewall, rolled back the system restore point to a previous date, and voila! Further thanks to those who provided some good food for thought regarding software firewalls, users' abilities, etc.

---

That's good to hear, a lot of users, forget how useful that little option of a system restore can be, it's like a "get out of jail free pass", some users even go so far as to disable this feature because it hogs space (each point requires memory), but if used properly you can get around this by setting "manual" restore points, espescially right after you have done a good clean and flush out the old restore points.

Luck... ;)

Hi, I've got nothing to add really, I'm just in a chirpy mood so thought I'd say hello.

My experience of trying to help people to secure their computers is not good either; you have to remember that if you choose to get involved, what you are doing is signing a free support contract that says, "phone me when ever and where ever if anything goes wrong at all" and then they phone you saying that putting a firewall on you pc has stopped the toaster working and could you buy a new one please.

I always add small print well in advance and let them know that it is their responsibility to know what is going on.


Jonny Small print Froooooooobles