Virus Removal (no network connection in normal mode) only in safe mode))

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by FMcapital, Sep 23, 2010.

  1. FMcapital

    FMcapital Private E-2

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You did not complete all of the below:

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.
    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
     
  3. FMcapital

    FMcapital Private E-2

    Last edited: Sep 23, 2010
  4. FMcapital

    FMcapital Private E-2

    Last edited: Sep 23, 2010
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hmmm, let's do this and see how we get on:

    The MBAM log show you took no action. Did you indeed fix what it found after attaching the log?

    Uninstall the following softwares:

    • Ask.com Toolbar
    • Java(TM) 6 Update 20
    • Java(TM) 6 Update 5

    Tell me what is inside of this folder:

    • C:\ProgramData\{94E7A161-5A7B-460F-BD45-76DE70D977A9}
    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix exit HJT.


    Download and run OTM.

    Download OTM by Old Timer and save it to your Desktop.

    • Right-click OTM.exe And select " Run as administrator " to run it.
    • Paste the following code under the [​IMG] area. Do not include the word Code.

    Code:
    :reg
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
    "MyWebSearch Plugin"=-
    "My Web Search Bar Search Scope Monitor"=-
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
    "SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
    "CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
    "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search Bar"="Search Bar"="http://search.msn.com/intl/searchpane/en-au/prov2.htm"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
    ""="http://home.microsoft.com/access/autosearch.asp?p=%s"
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search Bar"="http://search.msn.com/spbasic.htm"
    "Use Custom Search URL"= dword:00000000
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
    @="http://"
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
    "ftp"="ftp://"
    "gopher"="gopher://"
    "home"="http://"
    "mosaic"="http://"
    "www"=http:// 
    
    :files
    C:\Windows\TEMP\SEPFC68.tmp
    C:\DFR3CB2.tmp
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\g4s9yxyk.tmp
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\Low
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0076.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0077.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0078.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0079.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0080.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0081.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0082.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0083.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0084.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0085.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0086.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0087.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0088.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0089.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0090.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0091.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0092.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0093.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0094.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0095.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0096.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0097.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0098.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0099.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0100.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0101.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0102.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0103.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0104.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0105.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0106.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0107.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0108.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0109.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0110.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0111.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0112.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0113.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0114.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0115.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0116.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0117.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0118.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0119.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0120.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0121.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0122.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0123.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0124.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0125.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0126.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0127.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0128.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0129.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0130.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0131.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0132.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0133.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0134.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0135.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0136.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0137.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0138.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0139.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0140.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0141.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0142.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0143.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0144.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0145.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0146.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0147.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0148.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0149.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0150.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\SFK0151.TMP
    C:\Users\Fillmore Media Tower\AppData\Local\Temp\~DF8580.tmp
    
    :Commands
    [emptytemp]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large [​IMG] button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it into notepad, save it as something appropriate and attach it into your next reply.

    NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.


    Reboot your machine and install the most current and up to date version of Java available here at the below link:

    Java Runtime 6

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

    Does the webroot software you are using include antivirus???

    If you still cannot access the internet in normal mode then I think you will have to visit the software forum for further assistance. So let me know.
     
  6. FMcapital

    FMcapital Private E-2

    In C:\ProgramData\{94E7A161-5A7B-460F-BD45-76DE70D977A9}.

    these are the files.

    *OFFLINE (folder)
    *{8B287B75-DF8D-40C8-9620-8E4492C38EF1}
    *instance.dat
    *mia.lib
    *WRInstall.dat
    *WRInstall.lan
    *WRInstall.par
    *WRInstall.res

    I ran OTM, View attachment 09242010_105129.log
     
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You did not answer my questions, check my last post carefully.

    You also forgot this:

     
  8. FMcapital

    FMcapital Private E-2

    I did upload this MGtools Log file. It is a couple of responses below. Site will not allow me to upload again to a new post.
     
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You attached it before once yes, but I now need an updated set of logs ;)

    You are trying to attach the OLD Mglogs.zip! Do this again:

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.
     
  10. FMcapital

    FMcapital Private E-2

  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I have reviewed the last set of logs and am not seeing anything unusual. Now, to go back to a previously asked question which you did not answer:

    Also, tell me, are you able to connect to the internet in normal mode now?
     
  12. FMcapital

    FMcapital Private E-2

    Yes, my web-root subscription is anti-virus protected. During full sweep, scan finds nothing. Only network connection I get is in safe made. Still no normal mode connection. If it was a lan connection problem, I wouldn't be able to access a network connection in safe made.
     
  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

  14. FMcapital

    FMcapital Private E-2

  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am thinking you may have to visit the software forum/networking forum to further discuss why you cannot connect to the internet in normal mode, but for now, just do this again and let me have one final sweep through before I decide what to suggest next.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds