How to Disable Internet Connection?

B

bobbo2

n00b
Joined
Jun 21, 2009
Messages
20
I have one computer I started using just for recording/playing video on the tv. Yesterday it picked up a virus (System Security) when I was transferring files from it via my LAN. I downloaded a Malaware Program to delete the virus but the program won't execute and install-- neither will any other program.

I think I'm stuck with having to reinstall WinXP using the rescue disk (Hope it works). When I am back and running I would like to completely prevent the possibility of virus from the internet. I went to My Network Places and disable the Internet Connection but that disabled all my computers on the LAN!!! Seems to me it should only disconnect THAT computer, but no, it took down the whole system.

I assume that removing IE7 and Firefox from the puter will help but not be 100? I'm going to remove them anyway assuming some/most viruses use the browser to get into the system.

Any other ideas/cautions? Thanks.

Progress===I found the following:

: How to disable Internet connection without disabling the LAN/network?

1. From the Start menu, select either Control Panel, or Settings and then Control Panel.
2. Double-click Network Connections, and then Local Area Connection. In the Local Area Connection Status dialog box that appears, click Properties.
3. Click to highlight Internet Protocol [TCP/IP] , and then click the Properties button.
4. Select the radio button for Use the following IP Address, and enter the IP address of your computer.
5. Enter the correct code for the "Subnet Mask" field.
6. Enter the correct information for the "Default Gateway" field, in this case that would be deleting all the information.
7. Enter the correct information in the "Preferred DNS Server" field and the "Alternate DNS Server" field, in this case that would be deleting all the information. .
8. "OK" your way out of the properties.

But I get hung up at step 4 as the three computers on my LAN all have the same IP Address. Seems once again my entire LAN might go down AND once again, seems something isn't right in my house if the unique IP for each COMPUTER is in fact shared by the three computers on my LAN. Seems like some menu pull down item is stuck in the cybersphere? I'm also damn scared why/when my other two computers will pick up this same virus==it is rather close afterall. Each computer is running different firewalls and AV programs and anti scrip running software.
 
Last edited:
Sounds like you are using a USB modem and all PC's get internet only when your computer is booted?
The cure is to get a networked modem/router and connect all PCs to that.
Then you can use the method you have tried.

ps all computers CANNOT have the same IP address on the same network and still be able to use the network.
It sounds like you mistook the internet address (which they will all make use of) as the local IPs.
 
Thanks Nenu--I have a wireless/wired 4 port ethernet based router accessing the Internet thru my Comcast Modem. We both agree there should be unique IP addresses. Right now, I am transferring files off the infected computer and don't want to shut down my main computer to see what works and what doesn't. I just installed a new router, but before that, computers could individually connect to the internet regardless of which ones were on or off==but who knows, there are so many variables.

The virus is preventing all programs from running. Can't try System Restore as it won't display. Will try Safe Mode after all the files get transfered off. I know I will get the computer back as I will reformat the disk and install linux if I have to, but my first question still remains: How to prevent web based viruses totally/100 percent. For the last month, I unplugged the rounter from the internet when making file transfers and all was good. I just got lazy thinking I was being too cautious==but if a computer will NEVER be used on the internet, why have it vulnerable to the internet? Should be a simple switch==but it never is.
 
Maybe your modem isnt performing NAT but they still should not have the same IP.
Is it possible your are reading the wrong information?

There is no 100% guarantee of not getting a virus unless the PC is not networked and contains nothing that is infected.
You need to take steps to protect yourself as best as possible.
This is the reason security software exists.

Make sure you have at LEAST:
A good firewall, well setup
A decent AV
Decent malware scanner(s).

I also use PG2 which is an IP blocker and download the pre-prepared blocklists every few days/week that block all 'known' bad places.
This is useful because much malware needs to call home to download the latest nasties or is awaiting instructions. Those places which have been discovered are added to the blocklists, preventing a lot of malware from ever getting a firm grip on your system.

Check your firewall logs to see if any bad behaviour is flagged.
Some of the bad behaviour in my logs gets that IP added to my personal PG2 blocklist so they can never try any other methods of attack.
 
Thanks again Nenu--Logically, the computer is reporting something wrong, or I'm misreading something==like the IP address might be the modem or LAN's IP? I've gone to cmd/ipconfig and gotten a number that doesn't look right xx.x.x.x too small to be an IP but thats what it says. The Virus is interfering with all .exe programs, probably the IP reporting function as well?

I've never understood viruses that destroy a computer. I would think "by design" the virus should be an annoyance, but the 2-3 I have had require 100% attention usually leading to a reformat. I guess I just don't pay attention to the annoyances and my puter is a zombie at night? (smile/rats!)

The virus is restaring the computer every 5 min so its taking time to transfer the recordings I made. Looks like a reformat is in my future later today.

Perhaps the reformat will allow correct IP address and disabling of the internet connection. (Fingers crossed). Physically detaching the cable seems so "physical." I'll report back but all ideas/comments are welcomed.
 
I agree a reformat is a sensible option unless you want to find out what exactly you got.
Its unlikely the virus is interfering with reading the IP's unless all your PCs have it.
Does the same thing happen on all PCs?

Can you post here what ipconfig tells you about your local IP on 2 different PCs, one with the virus?
(remove any sensitive data if you are concerned)

ps its sensible to stop the infected PC from communicating with the other PCs in case the virus/virii can spread through local n/w access.
So fully disabling its network is a good idea until this is resolved.
 
Thanks Nenu==thanks for the interest and expertise. I would go turn on the third computer and use ipconfig to get its address but I want to minmize risk of infection so I'm not going to turn it on until the Infected One is fixed. On my main computer I asked google what my ip was and it came back with nine digits xx.xxx.xx.xx. Then I went to the infected computer and a different website said it had the same IP number. Maybe that was a firefox/google error as I notice on some searches it throws up the last website I was on as the first response--like when checking items from Craigs list, so maybe the IP report just got stuck in the system somehow. But I used the ipconfig self reporting function on my main computer and got that 5 digit report: xx.x.x.x. I guess that is possible but seems weird.

As initially posted, my main computer is filled with anti-virus/firewall stuff to the point where accessing the internet is sometime difficult. "Failure to Connect" is a common message on my main computer, then I have to back off on the safety to get connected. Not the same with the other two computers as they are both special use. The infected one was donated and I only started using it 3 weeks ago. Compaq Presario with 4 year old security. My plan was simply to never to go on the internet with it, but when the lan is connected to the internet and I am transferring files over the lan, the virus attacked. The third computer is my mothers who only uses it to email. I'm happy to reformat and reinstall should it get a virus. She clicks on everything but after 2 years--still no virus.

I don't know how knowledge of what the virus is (System Security) would help in the future so I just want to toast it. It prevents everything from working except file transfers over the LAN and web browsing. Kinda interesting actually--for 2 minutes.

You know, I don't know why I am so cheerful. Computer has a virus, car won't start (a computer sensor issue), I not sure exactly what the mold is on my home made blue cheese, my bonsai bay leaf tree has its own virus, after 10 tries I can't make homemade mayonaisse, and my tooth aches. Nonetheless, the future is so bright, I gotta wear shades.
 
Ah, asking google will always report the routers internet IP, not the local LAN IPs.
ipconfig is the tool to use for local IP's, are these IP's all different?
If all PCs can access the internet, I wouldnt worry about this.
As you are copying data from the bad PC across your LAN, you can unplug the phone cable from your modem so nothing can access the internet while you copy.
The machine you are copying to is suspect now though.

hehe, glad you are cheerful.
btw, its ok to use the other PCs if the one with the virus is turned off.
As I'm sure you will, monitor their behaviour very closely in case they are already infected.
Get the latest AV update and scan them, although this is no guarantee of cleanliness, its the minimum you should do.

This tool called Combofix may be of use to you
I saw it in a thread here so here is the post by |CMF|SoulAssassin
http://www.hardforum.com/showpost.php?p=1034272941&postcount=5
 
Nenu: I truly love computers. How many error/information messages are ever correct? "Your computer's IP Address is: xxxx" is actually the routers IP address? How special is that? Well the infect computer allows for cmd in the run box but won't bring up the dos box. "Everything is corrupted and frozen."

Since you may know, if a computer does not have a browser is it just as easily infected or much, much more rarely? I'm thinking the effort to remove the browsers is almost meaningless but that might just lead me to get lazy when transferring files over the lan.

I've been using AVG anti-virus and run it daily. Use crap cleaner and Ad Aware once a month and several on line scanners (Secunia) when the mood strikes. I also use an anti-scripting program and it constantly reports not allowing script to run==mostly pop up ads so I don't know how many viscious programs it has stopped, but I haven't had a virus since I built this system about 3 years ago.

Amusing--a perfect disease free universe and we pollute it ourselves. Not you and I, but those other guys.
 
Machine would not enter into system restore but would go into safe mode without mouse support. Took awhile but with key commands I installed Malaware Anti-Virus Program and ran the quick scan. It found 491 viruses, all fixed on reboot and the machine is working.

My IP address is unique and two digits away from my main machine. Now, I'll go ahead and try to complete the instruction listed above to disconnect my HTPC from the internet while keeping the LAN functioning.

Wow. Something worked.
 
lol, nice one.
Be aware that other virii/malware may still be undetected as its impossible for AV companies to know everything thats out there unless they are sent it for inspection or experience it themselves.
Personally if I found that many infections, the drive would be wiped.
 
Nenu--good thought. If I knew the recovery partition would work, I'd have no problem doing that. That machine was a donor so I don't know what was on it when I plugged it in. Probably had it connected to the internet for a total of 2 hours over a month.

My main machine hasn't been checked in 3-4 months, is on 24/7 and I surf the web alot but like to think I don't click mindlessly. Malaware showed 46 viri. I closely reviewed them and "almost" left them all in place but went ahead and removed them. Some I think were safe--phone home for updates sort of things but you can never really tell. Will run other AV later in the day.

Thanks for all your encouragement--and check back in 2-3 days. Those instructions for disconnecting from the internet are new to me. Bobbo.
 
I followed the instructions to disable the internet connection in my first post and it works perfectly. Much better than disconnecting the cable because now I'm not getting "You are working offline" notice every 5 minutes. I'm still stripping off other unnecessary programs/features to get to my single purpose machine. System seems quicker (observer bias I'm sure) but with fewer programs checking things, hopefully my recording captures will have fewer errors. I used to get typical audio synch errors especially on the Daily Show and they have almost disappeared. I've noticed this problem crop up very often when another program starts recording on my cable DVR--not always, but often.

Its good to reduce the number of variables and get down to more stable systems.

Does anyone know===while possible, how often can an internet virus get to a computer set up like mine? Physically connected to the internet thru the router and modem but software has it disconnected from the internet. Wake on Lan?

Fun stuff.
 
There are many classes of virus that propagate in a lot of ways.
It is not a small topic so I'll try and sum it up.

Different virii have different goals, there are multiples of the same thing, improvements, hybrids etc, so there are a lot of different virii out there to be detected and more being made constantly.
Some of the most common exploits are for you to be fooled into running a program with a virus, clicking a link which activates a security flaw giving partial or full control of your PC, or a drive by download that uses a browser security flaw to take control of your PC without your knowledge.
They can be transmitted via email, thumb drives, CDs, local networks, the internet...
Bear in mind that some malware running on the web or other PCs is constantly scanning for vulnerabilities in PCs they connect to, so good and well implemented security is important, maybe even for your own network if you dont trust other peoples PCs on it to be clean.
Some exploits are built on vulnerabilities in the core of the operating system and can be triggered if a connection can be made to your PC.
Browser vulnerabilities require you to have your browser open. Anything on the browser screen or hidden from view 'could' be malware designed to download a virus or remote control program.
The OS and Browser receive regular updates to patch these vulnerabilities.
So as you can see there are security holes in practically everything that havent been found yet.
Your machine as default will connect to places on the internet like Microsoft, a time server, a DNS server, these can be intercepted (for example) and if there is an unpatched exploit in the service in use, you can get hacked through it.

If you have a basic firewall that 'blocks inbound connections unless you made the connection', then a clean machine will remain clean unless something happens to help it get infected.
(Remember a standard firewall wont stop your PC making its own connections so if you already have malware, chances are it can easily phone home and download the latest nasty without you knowing)

Its easily possible that your firewall is configured to treat the internet as an unsafe zone and your local network as a safe zone, meaning you might not have any firewall between you and other PCs on your network.
To be sure that this is safe, you must make sure all other PCs are clean and kept clean.

This stinks of paranoia and most of the time you are unlikely to need to consider it.
However, there is no escaping from the threats.
If you value your data/identity/habits, its wise to protect them.

So get a good firewall and AV at minimum and set them up well.
Observe the logs to be sure what is happening.
Keep up to date with patches for every program that connects to a network.

If you must visit 'bad' places, install a Sandbox so your OS is further isolated and you can simply delete the sandbox if there is trouble.
 
Last edited:
You must log in or register to reply here.
Back
Top