SOLVED Cannot upload anything!

[Spook72]

Recently my PC just stopped been able to upload anything, anywhere. Even on speedtest site, it will not upload. Using wimdows 7 of course and i have no idea what it is. Can anyone please give me any ideas im stumped!!

 

[TrainableMan]

First thing whenever a computer that has been working fine for months suddenly stops: Reboot to safe mode (w/o networking) and run a complete virus scan. If you don't have an anti-virus then, in regular mode, install Malwarebytes Anti-Malware for the test and have it update itself; then reboot into safe mode and run it.. You might even want to run TDSSKiller and RKill in safe mode before you attempt the scan (links to these can be found in the Freeware DB).

-Disable any firewalls (do not leave it this way, just check it isn't the cause
-try running the browser in safe mode to make sure it isn't an add-on interfering
-check your network drivers for updates.
-look at the most recent programs installed that do anything network related and maybe uninstall

those are some thoughts off the top of my head, run the virus scan and let us know more detail


or try disabling any firewalls

 

[Spook72]

With Thanks!

First of all thankyou! kind sir for giving my problem some of your time....Ok i ran these scans you spoke of..........

http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 10/05/2012 11:54:47 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_265_ActiveX.exe (PID: 4728) [WD-HEUR]
1 proccess terminated!
Checking Registry for malware related settings:
* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]
Backup Registry file created at:
C:\Users\all user\Desktop\rkill\rkill-10-05-2012-11-54-53.reg
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* No issues found.
Program finished at: 10/05/2012 11:55:00 AM
Execution time: 0 hours(s), 0 minute(s), and 13 seconds(s)
as you can see one process was terminated but nothing seems out of the ordinary.
Then went onto router(bob lite) and disabled firewall in router and windows firewall and nothing changed so far...
Checked network drivers all up to date no prob there...
Would a tracert help at all?

 

[TrainableMan]

Did you run RKill in safe mode? & after you ran RKill did you run a complete virus scan with your A/V? If not you really need to do those things in safe mode, RKill is ot an anti-virus, it just stops virus protection routines so that your A/V works properly and nothing is hidden from it.

Also, how are you attempting to upload? via a browser? FTP? torrent? Can you, for example, play Internet spades?

If it is by browser, which browser? Have you tried a different browser?

 

[Spook72]

Yes ran it in safemode and then carried out scan in safemode using MSE, nothing.
Yes i tried Google chrome and Explorer.
I am a little lost with FTP and torrent i am sorry not sure?
Can't upload to Facebook or anything at all.
I dont know if this helps or not but a while back i kept getting Java update available so i gave permission to let it update and it came back saying i was up to date, yet i still got this update message a few times...it no longer appears.
I also noticed in Google chrome trying to upload vid to FB it seems to keep resetting like it is going to upload stops and goes again if that makes sense to you Stays at 0% though?

 

[Spook72]

Just checked internet spades and no prob there.

 

[Spook72]

Update.... i ran the rkill and tdsskiller again this time the correct way (had networking on) w/o networking and found Java exploit x5 running, cleaned those up and rebooted still cannot upload though.
Don't kow if this helps but i tryed uploading to facebook its a no go went into Developer Tools clicked on network to sus it out and found this:-<html><head><script type="text/javascript">if (document.domain.toLowerCase().indexOf("facebook.com") != -1) { document.domain = "facebook.com"; }if (window.top.postMessage) { window.top.postMessage("{\"current\":0,\"total\":0,\"time_elapsed\":1349416852,\"start_time\":0}", '*'); } else { window.top.VideoUploadProgress.getInstance().update_progress( 0, 0, 1349416852, 0);}</script><meta http-equiv="refresh" content="2" /></head><body></body></html>

 

[TrainableMan]

So obviously you do have upstream transmissions of some form. I don't actually need you to FTP or run a torrent, I was merely trying to learn what type uploads you had tried. Tracert (Trace route) just checks to see what servers you bounce through to get to your destination, it will likely get through just fine, sounds like strictly HTTP uploads are giving you trouble.

As for JAVA, it does periodic updates all the time, bloody annoying nuisance if you ask me. Even if you disable automatic updates they are turned back on again the next time you manually update. Anyway, I wouldn't think it would be causing you upload issues but you can make sure you have the latest version easily enough, go HERE and click "Do I have Java".

I couldn't find anything about Java Exploit X5 in a search so I don't know what that might do to your system.

You said you tried disabling Windows Firewall and that didn't help. Any chance you set up a domain or a proxy server or anything like that? Have you called your ISP and had them walk you through the proper setting in your router (if they supplied it) because if it isn't forwarding the right ports or protocols, stuff like that, then things just don't work. If your router is separate from the modem then take the router out completely and try a direct connection to your modem.

 

[Spook72]

Java Exploit.

Sorry to be more precise..Exploit:Java/CVE-2012-4681.ACT
Exploit:Java/CVE-2012-4681.ACX
Exploit:Java/CVE-2012-4681.ACZ
Exploit:Java/CVE-2012-4681.ACW
Exploit:Java/CVE-2012-4681.ACY
these were the 5 i found

 

[Core]

Remove Java entirely and download and install its most recent version directly from Oracle.

 

[TrainableMan]

All 4 are brand new, MSE just started detecting them Oct 4th. No other info.

Encyclopedia entry
Published: Oct 04, 2012

Aliases
Not available

Alert Level (?)
Severe

...

Technical details are not currently available for this threat.

do you have a secondary A/V? I recommend you download and install the freeware version of MBAM. Do not allow it to start a free trial or install any toolbars or whatever the latest round of extra junk you have to uncheck when it installs for free. But if you can get past their attempts to make money, this works as a great passive secondary A/V. It is passive meaning it only runs when you tell it to (if you start the trial that is active and runs in memory just like MSE (you don't want two active A/Vs because they can conflict and even if they don't it will slow your system even more than one does).

I have no idea what if anything they do to your computer. It's possible they took over your DNS host or who knows what else. You might try the things in my last post including calling your ISP.

At this point I have no other ideas.

If this condition is an effect of that virus then a backup of your data (using windows easy transfer) and then a complete reinstall of your OS may be your best option. I'm not saying that is the only answer; I'm just saying I don't know and that is the absolute safest thing I know. Like I said, try w/o router, try ISP. And I am out of ideas.

 

[TrainableMan]

Core, even the latest JAVA has the weakness. Article. You are better off w/o java at all if you can survive w/o it.

 

[Core]

Both of those articles are outdated, it was patched in 7u7.

You're on the nose about getting rid of Java entirely, if at all possible... I know a lot of devices use it, and all platforms have weaknesses, but I have personally never liked Java and wish it would just die already. It was born slow.

 

[TrainableMan]

Both? I only included one link.

 

[Core]

Both? I only included one link.

I meant the article and the Microsoft Encyclopedia entry. Oracle reported the flaw back in August, so I don't know why it's taken this long to appear in the MSE Encyclopedia...

 

[TrainableMan]

I guess with thousands of new viruses each month, it takes a while to write the heuristics to detect it, thoroughly test it to avoid false positives, and finally release it to the production environment.

 

[Spook72]

Thankyou Core did this..still no good

 

[Spook72]

Ok i might get rid of Java alltogether and see if it helps...Thankyou so much for all your time guys very much apreciated.

 

[TrainableMan]

Uninstalling Java can't fix the problem of no uploads, it just prevents Java exploits from getting in. But what I don't know is what, if anything, those exploits that already got in, did to your system; that would be what might have to be undone. Uninstalling Java wouldn't help with that.

 

[Core]

Run HiJackThis and post the log here, maybe there's something that will stand out. It's a long shot, but at this point....