Internet seems to only be partially available? [SOLVED]

FirmSkater

SOLVED! Thank you!

So my girlfriend turned on her computer today, and got the message that this

C:\DOCUME~1\USER\LOCALS~1\Temp\dwm.exe

Was missing an unable to be run.

Afterwards she opened up Google Chrome and found out she couldn't connect to Yahoo.com, Livejournal.com, Facebook.com, Weather.com, and basically every website in her bookmarks or otherwise. Same was true in Internet Explorer and Firefox.

She assumed that the internet was down, reset the router, but it didn't do anything

But, she could connect to Steam, and Instant Message people. After rebooting her computer the error message went away, and she could still connect to Steam, but not to most websites. I had her go through her bookmarks, and we found that Twitter.com was working, along with some other sites.

I had her disable her Windows Firewall, which did nothing. I had her delete her temporary Internet Files, still did nothing.

What does work?
So far we've found:
Steam Program can connect (but NOT to the Steam Store! Only Instant messaging)
Pidgin Program can connect (to AIM)
Twitter (https/twitter.com)
FutureLink (https/asc-osu-csm.symplicity.com)

I have my computer connected to the same network, but have no connection issues at all. For instance she can't connect to penny-arcade.com, but I obviously can.

I tried Googling the error message she received earlier but found nothing of value. She runs Avast! as her AV software - and we can't figure out if it is connected, but I suspect it isn't. Though she says that around the same time that the error message appeared Avast! said that "virus definitions were updated".

Ruckus

I'd say she's got some sort of malware or virus that's probably fucked something up.

Using your own PC, download MalwareBytes Anti-Malware to a USB Key and then run it on her system.

FirmSkater

Luckily, she already has that installed.

I had Avast! running a scan but it didn't seem to be going anywhere. I'll have her stop it and run Malwarebytes

Monoxide

Sounds DNS related. Try this:

Start -> command prompt -> right click -> "Run as Administrator"
type in 'ipconfig /flushdns'
release and renew her IP address

attempt to connect to those sites

also you might want to open C:\windows\system32\drivers\etc\hosts in notepad and see if there are erroneous entries there. if there are, it's likely malware related and you should run a full scan in MalwareBytes or something similar after cleaning up the hosts file

ExpiredHero

DWM.exe is part of the "Desktop Windows Manager" for windows, and should be in your \Windows\System32 folder.

If the computer was throwing up errors about a dwm.exe in a "Temp" folder, i would be 95% confident in saying that you have a malware infection that is using the same exe name.

The usual fixes for malware would be the best place to start (Malwarebytes, Virus Scan, checking it hasn't added a proxy etc). Also, check the Startup tab in MSConfig (Star Menu -> Run -> msconfig) and if it is listed there, disable it and restart the machine. Then re-run all your malware scans.

FirmSkater

Okay, an update. So we ran Avast virus scan and it found the problem, a fake error message Trojan. Locked it up, restarted the computer, and attempted to get to those sites with no luck. Ran a full scan in Malwarebytes' scan and found nothing at all, which leads me to believe the Trojan is gone, but for some reason those sites still aren't working.

Monoxide wrote: »

Sounds DNS related. Try this:

Start -> command prompt -> right click -> "Run as Administrator"
type in 'ipconfig /flushdns'
release and renew her IP address

attempt to connect to those sites

also you might want to open C:\windows\system32\drivers\etc\hosts in notepad and see if there are erroneous entries there. if there are, it's likely malware related and you should run a full scan in MalwareBytes or something similar after cleaning up the hosts file

How exactly do you release/renew the IP address? Just doing 'ipconfig /flushdns' didn't seem to have any effect. I also didn't see an option to "Run as Admin" but that might be because it's running Windows XP.

Ruckus

ipconfig /release
ipconfig /renew

Spudge

ipconfig /release
ipconfig /flushdns
ipconfig /registerdns
ipconfig /renew

also check windows/system32/drivers/etc/hosts open it with notepad. Anything under "127.0.0.1 localhost" should be deleted

edit beaten on all fronts again

FirmSkater

Renew doesn't work, it gives a message saying that "no operation can be performed on local Area Connection 2 while it has its media disconnected." It says the same thing for release. Opening hosts with notepad didn't seem to turn up anything, either.

Spudge

what do you get when you type ipconfig /all

FirmSkater

A lot of information. Is there something specific I should look for?

FirmSkater

Okay I figured it out.

It looks like whatever it was added a proxy, so unchecking the "enable proxy" setting seems to have fixed it all around.

Thanks for your help everyone.