Cannot access internet in normal Windows, but no problem in Safe Mode

[cosrocket]

My friend has a PC running Windows XP. He called me and said while he was on the internet, he lost his connection and since then has not been able to access the web. I went over and tried to trouble shoot the problem. After checking his connection and seeing that it was fine, I booted into safe mode, and in safe mode there is no problem connecting to the internet. I booted back into normal mode and cannot connect. I noticed that he was not running an antivirus program so that makes me suspiscious that it could be a virus, although the computer is behaving fine otherwise (no popups or messages or anything like that, and for the computers age it is running at the speed you would expect.

I installed Malwarebytes in safemode and ran it, but it didn?t find anything maliscious. I also wanted to do a system restore to an earlier time, but it was turned off all this time so there is no restore point to roll back to.

So the big question?what do you think the problem is? And short of doing a reformat which would really be a last resort because his PC has files all over the place, what is the next step in trying to rectify this problem. Other than this the PC seems to be running ok, so I would really like to avoid such a drastic measure.

[pupdawg21]

Is the system getting a valid IP address in Normal mode?

[sanctified Veteran]

If can access internet in safe mode then It's safe to assume a third party driver loading in normal mode it's the cause.

[cosrocket]

Is the system getting a valid IP address in Normal mode?

Yes, it did have a valid ip address in normal mode

[Dot Matrix]

Boot into normal mode, and see if you can grab a screen of the running processes, and then post it here. It'll help us figure this out, but speaking from experience, it's either going to be a piece of malware hiding in the system or a driver issue.

[sanctified Veteran]

Have you looked at your running services on normal mode?

[cosrocket]

If can access internet in safe mode then It's safe to assume a third party driver loading in normal mode it's the cause.

I checked in device manager and the ethernet card says there is no problem. Do you think it is corrupted?

[sava700]

sounds like an infection .... run avast home free boot scan and malwarebytes, should take care of any major issues. A ccleaner run couldn't hurt.

Check IE's network options make sure no proxy setting is done as most infections will change this to gain alternate access for its needs. You won't be able to update avast and malwarebytes without a connection. If you still can't get it working like that then pull the drive..slave it to another computer and scan malwarebytes on it or super antispyware.

[sanctified Veteran]

I checked in device manager and the ethernet card says there is no problem. Do you think it is corrupted?

The tricky thing it's that it can be anything from an ethernet driver addon to a bluetooth driver (yes, it can happen that way). Im fairly sure it's a driver or service issue since it works in safemode. Try totally wiping the ethernet driver and reinstalling. If that does not work try disabling one by one every suspect service in service manager,

[Gerowen]

Malware that is loading in normal mode? If you have a valid IP, try to ping a few things. Try to ping your router, then try to ping Google (8.8.8.8 is their DNS server, or just google.com). I've seen some nasty malware that did things like this if you started in normal mode.

[raid0]

Disable all services then reboot. Start each services one by one and reboot until you find which one is doing the issue

[cosrocket]

I appreciate all of the respones! I'm going to check a few other things tomorrow and get back. I did check if there was a proxy set but there wasn't.

[Arachno 1D]

Turn off the firewall and see if it still occours

[KillTheIrishman]

Turn off the firewall and see if it still occours

WTF? Are you serious? If there is an infection, by some chance, that would only worsen things. I would recommend running Comodo Free and see what it comes up with. Also, checking what others have already suggested.

[Axel]

WTF? Are you serious? If there is an infection, by some chance, that would only worsen things. I would recommend running Comodo Free and see what it comes up with. Also, checking what others have already suggested.

It won't worsen anything. What do you expect is going to happen suddenly if the firewall is disabled? There's a high chance he's behind a router anyway, so he'll still be "firewalled" by that.

[KillTheIrishman]

It won't worsen anything. What do you expect is going to happen suddenly if the firewall is disabled? There's a high chance he's behind a router anyway, so he'll still be "firewalled" by that.

How do I know a router is involved- he never stated that there was? You don't.. There is an obvious issue. If he really wanted someone to help, he'd have them do a remote session.