Can't use Internet Explorer or access connections...

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by wakka, Sep 25, 2005.

  1. wakka

    wakka Private E-2

    Hi,

    Someone used my computer tonight and a trojan named Trojan.Spy.Html.Smitfraud.c was believed to be the culprit. I got my display settings figured out, but now I can't use IE or browse the Network Connections (just freezes on a white page).

    I used AVG and moved around 130 items to the vault ... I don't believe IE was working before I did that though, so it may have not caused the problem. I put everything back though, from the vault to see if it was the cause but it was not.

    So, if someone would help me, I'd really love it.

    P.S. - I'm using Firefox right now ... that's how I'm on this site.
     
    wakka, Sep 25, 2005
    #1
  2. wakka

    wakka Private E-2

    Something else I just discovered ....

    I cannot run Spybot SD nor Ad-Aware ... failed to initialize. I just installed both of them.
     
    wakka, Sep 25, 2005
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you run your scans in safe mode? Do you have the ability to download programs on another computer and burn them to a CD so you can copy to the problem PC? Or are you able to download using FireFox? If you can use Firefox then follow the steps below. The only thing you will not be able to do with FireFox is the online scans.



    Please follow the steps below:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
    chaslang, Sep 26, 2005
    #3
  4. wakka

    wakka Private E-2

    Chaslang,

    Thanks for the reply.

    I already have it fixed now but here is a recap of what I ran in to:

    1) Network Connections folder no longer active.
    2) AVG found that wininet.dll was infected with Virus.Win32.Nsag.a (or as AVG put it: Win32/Nsag)
    3) wininet.dll was not healable, so I quarantined it.
    4) Internet Explorer still didn't work
    5) I researched and found out what the DLL did, and luckily, the site I was on, allowed you to redownload the DLL.
    6) Upon redownloading the DLL ( http://www.dll-files.com/dllindex/dll-files.shtml?wininet ), and pasting it into the Windows\System32 folder, my computer after restarting immediately regained full access to the Internet and hard drive (no more access denied errors)
    7) Now I'm a happy monkey, lol.

    Hopefully, this will help someone else with the same problem.
     
    wakka, Sep 26, 2005
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    wininet.dll problems happen quite often. Smitfraud problems are one of the main reasons. Just replacing the file will probably give you internet access but it has not removed the rest of the files related to smitfarud from your PC. You could get reinfected.
     
    chaslang, Sep 26, 2005
    #5
  6. wakka

    wakka Private E-2

    Ooh, I already ran AVG and another virus scanner..I can't remember what it's called though, crap. I think it's something like DOD 32 or similar. They removed about 110 different files. Mostly in the Temp directories. I've yet to run Ad-Aware and S&D; but I will soon.

    Thanks again, Chas.

    wakka
     
    wakka, Sep 26, 2005
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes! That's fine but it still does not mean they are finding the problem files that Smitfraud can deposit on your PC. In many cases it requires some manual steps. You may want to run the below:

    Download smitRem.exe and save the file to your desktop.

    Double click on the file to extract it to it's own folder on the desktop.

    Reboot into safe mode.

    Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish.

    The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please attach this log to your next reply.

    Also note: you should not have more than one antivirus application installed.
     
    chaslang, Sep 26, 2005
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds