Gavin's networking

[in Aldershot]

Unfortunately, the Advent has been so reluctant to connect to websites recently that I find myself using my wife’s more modern Toshiba laptop instead. I cannot get to the bottom of why Firefox cannot connect in circumstances where NetSurf connects immediately – they both go through the same router, use the same DNS servers, etc. It occurred to me that malware might be the culprit, and I have tested with a number of packages that claim to detect it, with nothing showing up so far.

Firefox and XP. Not an unheard of combination.

Okay then.

1. Is the problem occasional or all the time?
2. Are you using wired or WiFi?
3. Right-click on the network icon and choose “Status” from the menu.
   In the window that appears, telling you packets sent and received, etc, click on the “Support” tab.
4. What is your Address type, IP address, netmask, and gateway. [does this all match the RISC OS setup?] [if a fixed IP address, is there anything else clashing using the same IP address?]
5. Can you go to google.com? Can you go to avast.com? If not, what happens?

That’ll do for starters. ;-)

Thanks Rick.
1. Very frequent.
2. WiFi.
The Advent gets its IP address dynamically from the router.
What has just happened right now is typical. During boot up I first get a message saying that the WiFi is connected, with a good signal. A few moments later the icon acquires a red cross and a message announces that the connection is broken. The icon changes to show shuffling balls being tossed back and forth, to indicate that the Advent is asking the router for an ip address. Then a message comes up to say that I have limited internet connection (i.e. none). The “Support” tab shows wrong values for the ip and netmask values – namely 0.0.0.0 and 255.255.0.0 respectively. I click on “repair” and this time I was lucky – it worked.
For my TCP/IP settings I give the Alternate Configuration tab the data for my LAN.
5. If I enter google.com/ into Firefox the green wheelie keeps on wheeling, and it says “Connecting…” . This goes on forever.
Avast, however, it reaches. I am using AVIRA at the moment.

Happy New Year.

I’d try using a static IP address.
Do you have anything else connecting wirelessly?
If yes, is its connection reliable?

Do you have anything else connecting wirelessly?

Yes, my wife’s Toshiba Satellite. It is not on at the moment but its connection is reliable. A propos Firefox on the Advent flunking “google.com”, NetSurf on the Raspberry Pi brings it up in a flash (diverted to google.co.uk). I am very puzzled at the difference. The Toshiba appears not to suffer the Advent’s problems (it is faster, of course). I have compared the internet settings of the two, and they are identical.

Do you suppose some anti-google malware/adware has crept in? I have been scouring Firefox’s about:config but have not seen anything relevant.

I’d try using a static IP address.

Cough!

The phrase to use is “use a manually assigned address” – as opposed to a DHCP assigned address which could be either dynamic or static. Static being the version where the DHCP server has a reservation for that particular MAC address and therefore the client is always assigned the same IP.

i.e DHCP assigned can be static or dynamic, manually assigned can only be static.

The point being that static does not mean it is manually assigned.

I have compared the internet settings of the two, and they are identical.

Check the content of the hosts file (should be almost non-existent, and the lmhosts similarly).

A few moments later the icon acquires a red cross and a message announces that the connection is broken. The icon changes to show shuffling balls being tossed back and forth,

Let’s – for the moment – assume that the problem is a failing connection and not malware¹.

Do you have a spare LAN cable? If so, turn off WiFi and plug the ethernet socket directly into your router. Does everything work now or not?

¹ For malware, take a peek at http://www.2-viruses.com/how-to-fix-google-results-hijacker-google-redirect-virus-problem – it might be worth reviewing your Firefox add-ons and such.

For malware, take a peek at

Following the advice there, I had a look at C:\WINDOWS\system32\drivers\etc\hosts .

It was about 335K in size! There must have been near a million lines of the form
127.0.0.1 blah-blah
which comments asserted had been put there by SpyBot, presumably to block nasty sites. I don’t think I have SpyBot anymore. Anyway, I made a backup of the old hosts file and deleted all the lines in the new except
127.0.0.1 localhost
I will report on how things go.
Can routers get infected by malware? I have an old Belkin wireless router. Even when connected by an ethernet cable, fetching the router’s control webpages is incredibly slow.

If I enter http://lexicity.com in NetSurf the page opens immediately. If I do it with Firefox I get the endless “Connecting…” message and nothing more happens. So I do not think it is anything to do with Google.

If I enter http://lexicity.com in NetSurf the page opens immediately. If I do it with Firefox I get the endless “Connecting…” message and nothing more happens. So I do not think it is anything to do with Google.

What is the proxy setting in firefox?

What is the proxy setting in firefox?

No proxy.

I made the mistake of installing Spyhunter. I could only do this by downloading it with NetSurf, firing up Virtual Acorn on the Advent and transferring the installer using Access. It told me that I had 35 nasties in the registry, inside:
[RK]{Adware.Helper} …
[RK]{Adware,SuperWeb} …
[RK]{Adware.Webfuii} …
[RK]{Adware.WebGet} …
But when I clicked the “Fix” button it asked me for $30. In other words Blackmailware. In any case it was unusable because its unscrollable dialog pages were too high for the Advent (1024×600) so that the control buttons that made things happen were beyond reach. Cheesy software. I have uninstalled it now.
Does anybody know how to clean away adware? I came to the conclusion that AdCleaner was blackmailware too, but I could be wrong. If Microsoft makes it so difficult to remove dodgy stuff from its products, you could say that it is an accessory to crime, or at least to gross discourtesy.

1/ Remove any optimisation or antimalware tool
2/ Use CCleaner to remove all temp files and suppress unwanted boot services
3/ Launch Malwarebyte to remove all threats (simply the best tool for viruses)

Or reinstall all the PC :)

In other words Blackmailware.

That’s normal, sadly. Quite a number of products will tell you what needs to be done, and demand payment prior to doing anything.

Does anybody know how to clean away adware?

Depends upon the adware. And whatever else you may have on your system.

If Microsoft makes it so difficult to remove dodgy stuff from its products,

First question – how did the stuff get there in the first place?

I run an XP system. I tend to stay in Admin mode. I’ve been doing that for years now. Never had AdWare. Why? I tightly restrict what I allow to run on my system, and stuff I’m not sure about I’ll throw to https://www.virustotal.com/ for forty-odd second opinions.
Sites may try to appeal to your good nature by pleading for you to view their adverts, but what they are really asking you to do is permit unknown third party content (not even provided by them) to load on your machine.
Software may come with lots of extras (toolbars and such) included. This isn’t a recommendation, nor does the software author vouch for these extra products. They just get paid to include that crap with their product.
In both cases, the answer is NO.
This doesn’t mean your computer is invulnerable now, it just means that a lot of malware/virus entry points are the user, and when the user understands…..

The last thing, a firm hand is necessary with children. “Yes, you can use the computer, but you install anything and you lose computer privilege. Forever.”. And stick to it. If the kid needs something, the parent can evaluate it and install it. You don’t want to know the messes I’ve had to deal with thanks to children installing everything they could download.

Of course, it’s a bit late now. But for next time. ;-)

you could say that it is an accessory to crime, or at least to gross discourtesy.

It would not be terribly hard to hide something in a piece of RISC OS software that could install itself into the system, record all of your keypresses, and periodically send the data to my server for recording. A little more effort, and I could find a way to get this to start up with the computer. A little more effort and I could get it to cache its data until there is network activity like you fetching a web page (so there won’t be any network activity when you aren’t doing anything on the internet). Hiding a program inside other programs is medium/difficult (depending upon level). Hiding a running piece of code from the user is actually quite simple. Can you remove it from RISC OS? Yes, fairly easily, that’s one of the benefits of the system. But one of the downsides is being able to see that it is there in the first place.

Now consider malware. Malware is, essentially, a non-replicating virus. It has no real intention to infect your programs, once it is in your computer that’s all it wants. Some malware is fairly easy to spot. Some malware (the likes of tdss) is extremely difficult to spot. Some malware is impossible to spot directly. It will intercept Windows API calls and provide fake information to hide its presence. The best way to scan a Windows system for malware and such is to download a scanning package based upon a bootable Linux and use that to scan. With Windows live and the filesystem mounted, you can never be sure you aren’t being lied to by the very thing you are trying to find.
Why? Because that is the nature of the beast. Windows’ only problem is that it is extremely complex, and this greatly complicates the job of removal. Unfortunately, these operating systems are disc based so system files can be implicated by virtue of being modified.

Thanks for the advice. I use CCleaner regularly. I also ran Malwarebyte after uninstalling Spyhunter but it reported no adware. Of course it is possible that Spyhunter’s 35 items were just fictions. But I did have Webfuii at one point, and I thought that I had got rid of all traces.

The difficulty with reinstalling is that the Advent has no CD drives, or disk drives of any sort. I do not think I was supplied with any backup copy of XP Home Edition on any sort of medium when I bought it from PC World. Only my Iyonix has a CD drive, and that cannot cope with anything but very ancient CDs.

There seems to be technology lag; who has CD drives these days? Would Microsoft supply me with a new copy of XP on a memory stick? Downloading is out of the question, as broadband in my village struggles to reach 50Mbits/sec.

Of course it is possible that Spyhunter’s 35 items were just fictions.

It’s possible, yes.

I do not think I was supplied with any backup copy of XP Home Edition on any sort of medium when I bought it from PC World.

Sounds about normal. :-/

Do you have a recovery partition? Some computers set aside a part of the harddisc (as a hidden partition) to contain a way to reinstall. Often this is accessed through some magic keypress when the machine is booting. You know, like F10 goes into SetUp.
See if you have this.

There seems to be technology lag; who has CD drives these days?

Everybody. You can get USB DVD readers and writers quite cheap (I have three of them I picked up from boot sales) which mean potentially any USB enabled device can read DVDs and CDs. A fair few of them can boot from a USB drive as well. (depends upon your BIOS capabilities – and there might be peculiarities like it needs the drive plugged into a specific USB port).
My EeePC 901 came with a recovery CD (or was it a DVD?). It has no optical reader…

Would Microsoft supply me with a new copy of XP on a memory stick?

Is there such a thing as a “new” version of XP these days?

Downloading is out of the question, as broadband in my village struggles to reach 50Mbits/sec.

Hohoho… Yes. Because 50Mbit is lethargic, right?

Downloading is not out of the question. Because my rescue-PC has a SATA drive and my legit copies of XP don’t support SATA, I sourced a version that does. Download? It took about an hour and a half. At 2 (TWO) megabit!
You think you struggle to reach fifty megabits? Running flat out with a tailwind, I get a 25th of that. It isn’t the end of the world, one just needs to learn to multitask their activities, like “download taking some time? perfect excuse to put the kettle on!”, and so on.

XP has been out of support – even extended support – for a long time now, so you’ll get no help from Microsoft.

You could upgrade to Linux for free.

If you have to stay on Windows, you’ll probably have to get at least 8.1 nowadays.

XP has been out of support – even extended support – for a long time now, so you’ll get no help from Microsoft.

We pushed out a set of updates for XP to a couple of thousand installs just before Christmas.

Even the general public can pick up on critical updates by accessing the POS revision stuff.
I’d agree about loading linux though, and making a bootable memory stick to do the install is quite simple.
Live boot helps you test before install.

I tried AdwCleaner 4.106 in addition to Malwarebytes to rid my old XP computer of commercial spyware and it seemed to do the trick. Review can be read at: http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml. It’s free.
XP is vulnerable since support was dropped from Microsoft but should be alright if you only want to use it for V.R.P.C use.

Most of the time, I use both of them. AdwCleaner for fast cleaning + CCleaner to remove files, then Malwarebyte in complete mode (all options on – very long scan) to remove all unwanted software.