|
Hello. Definite longer story definitely not short (I apologize for the rambling length... I don't know what is and isn't important, so scan at will, please... I am sorry...): Recently my computer (Dell XPS 400, Windows XP Service Pack 3, Internet Explorer 7 with phishing filter and pop-up blocker on, SiteAdvisor, up-to-date McAfee Virus Scanner and Firewall, and a Linksys Wireless-G WRT54G3G-ST router with its power adapter plugged into the wall electrical outlet and a network cable from it directly connected to my computer.) got a drive-by Generic.dx trojan without me downloading anything from one of the few sites I visit daily. My internet connection crawled, and I now have no connection at all. I've been getting help from McAfee forums very helpful and quick good volunteers... They recommended Malwarebytes Anti-Malware to me, which I downloaded from my second clean computer (a laptop) to my flash drive, then to my infected computer. I ran it, tried updating it as recommended, and only then discovered the trojan killed my broadband entirely. I scanned with it anyway, and it quickly found and removed/quarantined 11 Adware.MyWebSearch related files, but nothing else. They then gave me a link to an offline updater patch file, and told me scan in safe mode until nothing else was found and check if it fixed my lack of broadband access. Which I did, Malwarebytes found nothing else, but unfortunately I still had no broadband.
Next, they recommended WinsockXPFix. Which I ran and it made all its registry changes OK, I rebooted as required but still no broadband unfortunately. Did using WinsockXPFix make things worse for me with the registry changes it made? I used its registry backup to save the pre-changed registry files prior to running. Should I revert back since I still have no broadband connection? The McAfee volunteers then kindly told me I needed to hard reset the router, though I've tried countless times with no fortune. I'm at a definite loss as to what, if anything, I can do to hopefully get my broadband back, please...
It's very confusing with the numerous different variations to reset routers, and what I need to do for my router model (Variations: Unplug this cable/adapter exactly where, or not; hold the reset button between 5-30 seconds; rebooting the computer, or not; waiting 1 or 2 minutes between various steps, or not - and for all of these at what exact point in the reset process.).
I reset it once before with the reset button, routers page at http://192.168.1.1, default admin password, then changed it for security, etc; but this time I can't get it to work. I'm happy as can be to try again, to get a walk-through maybe, anything please... When I go to http://192.168.1.1 now, or any other address, Internet Explorer gripes at me that I'm offline, which is annoyingly correct. I don't have, and never had Zone Alarm, but disabling my McAfee Firewall doesn't help. IPCONFIG at the Command Prompt gives me a Windows assigned address of 169.254.X.X
I was going to use the routers Setup Wizard CD to try to reset the router, and if that failed to try to get its firmware version number to maybe upgrade. But I was going to ask here first for expert advice since I've read many things that can go wrong while upgrading firmware. However, scanning the CD (Without running the CD.) McAfee found the virus W32/HLLP.Philis.ini in the file "D:\_desktop.ini" on the CD. McAfee didn't delete the file, I don't know why. I scanned my entire computer several times and no infections were reported. I uploaded the file several times to both www.virustotal.com (39 online virus scanners), and virusscan.jotti.org (20 online virus scanners) and every time every virus scanner reported no possible infections. Is my up-to-date McAfee virus scanner reporting a false positive and yet Jotti and Virustotal's 2 McAfee scanners report the file as probable clean? Is "_desktop.ini" a legitimate Linksys file? I found no information on Linksys/its forums about it. My problems just keep multiplying...mentioning of more problems...
Finding that suspect file on the CD I decided to instead download the Setup Wizard from Linksys (Router product page: http://www.linksysbycisco.com/US/en/support/WRT54G3G-ST/download Actual file: http://downloads.linksysbycisco.com/downloads/WRT54G3G-ST_SetupWizard_4_2_06042008.zip) to my flash drive, then to my infected computer that is connected to the router. I ran it (Downloaded file version: 4.2.0.007 - Original CD Setup Wizard version: 4.0 printed on CD front.) and it immediately gave 1 of 3 options: Mobile Broadband Only, Broadband WAN Only, or Broadband WAN and Mobile Broadband. I don't know what damage, if any, I caused by continuing. It looked like it was trying to go through the entire router setup process. I thought it would take me to some options to reset the router, as I've read in the User Guide and elsewhere - that was my understanding. The setup process stopped at only 30% done "Router not found, please make sure the router is properly connected and try again." How much overwriting of original router setup files did I do by continuing? I'm entirely confused. Doesn't the Wizard check if the router has been previously setup prior to setting it up again? Did the version difference cause my router to not be detected by the Setup Wizard? Did the Generic.dx trojan that killed my broadband trash my computer settings so bad that my router is undetectable/essentially not setup?
Update of sorts: I tried one last time to reset the router, and I unplugged/plugged the network cable. Doing that I still had no broadband on my main usage Dell XPS computer that's connected to the Linksys router. However, my laptop, with Data Card in the router, was for the first time able to find the network - the constant connection and speed is brilliant, it's what it allways has been on the laptop (Since the trojan/router problems, my laptop only had broadband with the Data Card in the laptop.). Maybe the network cable simply wasn't re-connected properly/entirely during 1 of the many reset attempts, it indeed could also explain the downloaded Setup Wizard not being able to find the router/only getting 30% done.
Laptop Command Prompt IPCONFIG /ALL with Sprint Data Card inserted in laptop computer slot: IP Address = 174.158.XX.XXX (Sprint) Subnet Mask = 255.255.255.255 DNS Servers = 68.28.90.91 68.28.82.91
Laptop Command Prompt IPCONFIG /ALL with Sprint Data Card inserted in router: IP Address = 192.168.1.1XX Subnet Mask = 255.255.255.0 Default Gateway = 192.168.1.1 DHCP Server = 192.168.1.1 DNS Servers = 192.168.1.1 Since my laptop started working with the Data Card in the router I haven't tried again to reset the router, nor have I tried the downloaded Setup Wizard. I don't want to mess anything up further than I have(?) / the trojan has, and I need some expert advice, please, as to which of the 2 if either I should do (first?). On my laptop computer only, typing http://192.168.1.1 in Internet Explorer gets the pop-up for username and password, but I haven't proceeded. I've read you shouldn't reset the router and/or(? Is it both or just 1 please?) upgrade the firmware unless the computer is directly connected to the router - which my laptop is not. On my other computer that still has no broadband, Internet Explorer still tells me I'm offline when typing http://192.168.1.1 into it. My IP Address on it is still a Windows assigned 169.254.X.X and a Command Prompt PING 192.168.1.1 returns with "Destination host unreachable.", as it allways has and same with all other addresses (Except for 169.254.X.X).
Annoying 2nd "update" of sorts, apologies for length, as allways: I've been so focused on the trojan/broadband killing that I've cluelessly largely forgot that I have dial-up with AOL. Trying AOL dial-up also does not work, the insanity thickens... AOL software tells me to check my connection, but all phone cords are plugged in as should be. I plugged a phone directly into the wall outlet and I get a dial tone, I can call out OK, and the phone rings and gets calls OK. Device Manager-Modems-Properties-Device Status says the modem is working properly, and Resources Tab shows no conflicts. Diagnostics Tab's Query Modem looks OK to me, as does the log, but as allways I'm definitely no expert. I didn't change any settings anywhere. I have noticed off and on that checking IPCONFIG it says my IP Address is 192.168.1.100 It lasts maybe a day (then goes back to 169.254.X.X), maybe longer, I don't know - I don't check that often to pin it down (Should I?). During this time neither my broadband, nor my dial-up works. I can PING 192.168.1.100, but nothing else. I'm convinced the evil trojan killed both my broadband and dial-up - I've never had a problem with my Conexant D850 56K V.9x DFVc Modem prior. Also, I'm not convinced the trojan is not still lurking everywhere on my computer, I think it is...
Any and all help in restoring my broadband/dial-up is greatly appreciated, please... Thank you!
|