no internet connection & major malware issues

Hello!
First of all, know that I havent gone through the malware removal guide mostly because my IE is not working anymore as of this morning (i am typing from my roomates laptop, an apple) and it is the dell pc that is not working. I dont know if that has to do with the amount of security now installed on the computer, but it makes it impossible to download alot of the necessary programs on the malware removal guide (which has helped in the past)

I have Ccleaner, Ad aware (cannot update definitions no internet connection), just installed norton internet security 2008, super anti spyware.

I have run all of these several times in safe mode and in normal mode, and when I am in normal mode the following reads on my desktop background :

A severe threat has been detected on your pc
your computer has several fatal errors due to spyware activity. Your address is (IP Address) and via this address an unauthorized access was gained by another computer. It is strongly recommended to install antispyware software to close all security vulnerabilities.


What originally happened:
on monday evening a blue screen appeared on the pc with white text talking about how the system shutdown and the physical memory had been dumped and dumping had finished. It said that if it was the first time that happened that I should restore to last normal mode or if it was a repeat to boot in safe mode. After this happened it took forever to start windows, the toolbar will appear and no icons.
Warning messages keep appearing in the bottom right hand corner of the screen (yellow triangle with exclamation mark) and yellow bubbles that say "your computer is infected windows has detected spyware infection! It is recommended to use special antispyware tools to prevent data loss...
Everytime I run a spyware program it keeps on detecting malware.

I am at my wits end...the last scan came up with the following:
trojan csrss gen
adware clickspring /resident
adware click spring-variant
trojan zquest
adware adservs
trojan unknown origin
trojan rootkit in core
dialer.dial/gen variant
trojan vx game
trojan zquest installer
malware ultimate defender

i have already changed settings on my computer to show hidden extensions, etc.
i have fixed the msconfig

its not shutting down automatically and showing the blue screen anymore
i have gone through the add/delete programs list and there is nothing suspicious...i guess my next step is that i will undo the firewall on the security center page and see if that is what is interfering with me connecting to the internet...otherwise...what can I do if I cant connect?
thanks

 

Welcome to MG's!

First, disable everything you have installed as in antivirus and antispy.

Next, you'll need to download the utilities below from another computer and transfer them via USB or CD to the infected computer.

• SmitfraudFix (by S!Ri)
• HijackThis 1.99.1
  • Downloading, Installing, and Running HijackThis

I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

ATTACH THE FIRST LOG NOW BEFORE CONTINUING OR YOU WILL OVERWRITE IT!!!! And then immediately continue on to the below steps.

How are things working now?

 

here is the log from the smitfraud

 

Here are the logs for the 2nd smitfraud (cleaning) and for the hijack this.

 

Can you access the internet on the infected machine now? If so, please run as many steps from the below as possible.

If you do not have internet access, attach a fresh HijackThis Log with the ShowNew & GetRunKey Log.

 

Just an update--still no internet connection. I dont know how to say this technically, but my local internet connection is up (shown by the computer icon lighting up in the right hand side of my toolbar) but usually when the internet works in my apartment there are two connections (thus, two different computer icons lighting up in the toolbar.) this second icon has not popped up. When i try to reestablish a network connection it says my broadband connection is already up (but it is not showing up).

Also, I dont know the exact wording but when I try to connect it says there are problems with the TCP/ICP stuff and to contact my service provider.

When I click on the firewall that already comes with windows it says because of some difficulties occuring I cannot access the controls to the firewall. It is not letting me access the firewall controls.

Also, windows has its own clean up program and while it was running it said there was a backdoor that was only partially removed in the clean up process...why is this?

so, maybe the internet connection is working and I am just not seeing how to figure it out to reconnect, or maybe something got screwed up in the process of trying to clean or when it got bugged? who knows.

My next step is to run the two programs you told me about (get run and show new)and post the logs to them. thanks for your help...you give me hope that I can tackle this and not have to resort to the geek squad..eek!

 

Before you attach any further logs, run ComboFix and attach the log with GetRunKey, ShowNew & HijackThis Logs.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

 

Okay so here is the logs from the programs I ran today. I am trying to see whats going on with my computer and I ran ipconfig on the command prompt. It said an internal error had occured and I had to get a hold of microsoft, I think my computer is really screwed this time. Attached are the logs. Also, its impossible to close/disable norton internet security 2008, I have to turn off all the settings each time it boots up.

 

2 replys with the logs you requested.

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Pre-Instructions:
Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Please make sure the Viewing of Hidden Files & Folders is enabled per the READ ME.

Now, please run HijackThis and click on the Open the Misc Tools Section button on the open page. Then select Open process manager on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click Kill process. Then click yes.

After killing all the above processes, click Back.

Step 3:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 4:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 5:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 6: Begin here after rebooting from Step 5!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 7:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Step 8:
Finally, I would like you to install the current version of Sun Java: Sun Java Runtime Environment

Step 9:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

hey
thanks once again for the post, things are ok, heres a few things I had questions with:

When I went to kill this program in hijack this it was no longer there, even though I saw it was in the last log was recorded on my computer. Thus, I did not kill it because i could not find it in the list of open processes:

vmolwhsx.exe

Also, I followed all the steps and still no internet connection. When I try to click on the internet explorer icon on my desktop a box pops up that says the following:

Web Page unavailable while offline
The web page you requested is not available offline.
To view this page, click connect
Connect Stay Offline

When I try to see what is going on with the windows firewall it pops up with the following:
windows firewall settings cannot be displayed because the associated service is not running. Do you want to start the sharedaccess service?

When I click ok it says windows could not run the sharedaccess service.

Also, when I try to repair the local internet connection it pops up saying:

Failed to query TCP/IP settings of the connection. Cannot proceed.


So....I guess let me know what you think of the logs.

 

here is the last log

 

Everything is looking better however I see traces of McAfee and Norton.

Which antivirus so you use? Also, I would be willing to bet Norton is your problem, did you purchase it? Would it hurt to uninstall?

If we can uninstall, let me know but do not do anything until you hear from me.

 

I bought norton after the computer screwed up to see if it would help get rid of any of the major issues. I don't have a problem uninstalling it since I really can't figure out how to disable it completely. As far as mcafee I don't know why its still around. I will wait to hear from you as to what you suggest I am open to anything.

 

Personally, I recommend AVG AntiVirus with Comodo Firewall however it's up to you.

If you would like to keep it let me know, if not I will have you run a fix to completely remove Norton & McAfee.

 

if removing it means having internet access I would probably like to get rid of it. Let me know how.

 

Download the following two tools and transfer them to the machine. Once transferred, run them one at a time rebooting between each tool.

McAfee Consumer Product Removal Tool 2.0.117.14

Norton Removal Tool (SymNRT) 2008.0.1.19

 

hey,
I did the removal tools today and everything came off well, but still no internet connection. Its still giving me the TCP/IP message that I posted in earlier threads and the firewall is still not accessible. Also, sometimes still I open the my documents or my computer window and a box pops up that is asking if I want to work offline or connect to the internet. any ideas as the next step to take? Besides that the computer is working awesome. Thanks so much.

 

Download WinSock XP Fix 1.2 and transfer to the problematic computer.

Run this, reboot and let me know if the connection resumes.

By the way, how do you connect to the internet? I assume everything is connected properly and the service is active and configured properly? Just making sure

 

hey,

I was on the phone with my service provider AT&T for like three hours the other day. They even had me talk to secondary support for a while...all in all we concluded that there is a problem with the DHCP client? They had me run services.msc and instead of the DHCP saying "started" it says "starting." They said I would probably have to take it to a PC technician. Any advise? Should I try to post in the internet connection problems forum?
thanks for your assistance

 

I would recommend the Software or Networking Forum.

Good Luck!