After rootkit.zeroaccess removal, cannot restart BITS service

I had this nasty rootkit, I'm pretty sure I have it beat (combofix). I cannot, however, get a LAN connection now. I've removed and added my network card from device manager, I've done everything I can think to do, but I think the issue is that my BITS service won't start. When I try to start it, it says:"windows could not start the BITS service on the local computer...error code -2147014846"

I have also tried all of the steps in this article to no avail:
http://www.itexperience.net/fix-the...service-specific-error-2147942402-0x80070002/

Can you guys help me?

 

Hi and welcome to Major Geeks, mattbiel!

Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and then attach the requested logs to your next reply when you finish these instructions.

• **** If something does not run, write down the info to explain to us later but keep on going. ****
• Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes, you could use a flash drive too, but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

* Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated - our system works the oldest threads FIRST.
​

 

Thank you so much for taking my case. I have read and completed everything in the READ & RUN ME FIRST. Logs attached.

The computer appears to be clean of viruses, malware, and rootkits. The issue that remains is that I cannot get an internet connection. My local area connection status says "Acquiring network address" and it just keeps saying that.

My Background Intelligent Transfer Service (BITS) in the Services.msc will not start and it gives me the error code 2147014846.

I did run the Repair Connection tool in SAS, but no luck. I will attach the first 4 logs to this reply and then the last log to another reply.

 

Last log here

 

Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
MpKsl2f0491d1
MpKsl67a44fcd
MpKsl81efae0d
MpKslc2024b92
MpKsldea29de6
[COLOR="DarkRed"]FireFox::[/COLOR]
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\22qjgwq8.default\
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
[COLOR="DarkRed"]FCopy::[/COLOR]
C:\WINDOWS\system32\dllcache\afd.sys | C:\WINDOWS\system32\drivers\afd.sys
[COLOR="DarkRed"]Folder::[/COLOR]
c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates
[COLOR="DarkRed"]Registry::[/COLOR]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

========WARNING========
The below is specifically for mattbiel's computer
Do NOT run the below if you are not mattbiel
Doing so may damage your PC!
========WARNING========

Next... I have attached a afd.zip file to this post
Inside of it is:

• afd.reg
• fixme.bat

Extract both of these files to your desktop.
Now double-click afd.reg and allow it to merge into the registry.
If you get a success message, reboot your computer at this time.

Once you have rebooted...

Double-click fixme.bat and then test your internet connection.
Also attach the fixme_results.txt file on your desktop this created to your next message. (How to attach items to your post)

Now install the current version of Sun Java from: Sun Java Runtime Environment

Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Note: This will automatically update all the logs inside MGlogs.zip

 

Thank you thisisu.

I did all instructed. Logs attached.

Progress:
After running the fixme.bat my connection now shows "connected" and I have an IP address. So we are close!

However, I am unable to browse using a browser and I cannot ping a website from command prompt.

 

Please download SystemLook by jpshortstuff to your desktop.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:

  :filefind
  afd.sys
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (How to attach items to your post)
  Note: The log be found on your desktop entitled SystemLook.txt

 

Here is the SystemLook log file.

 

Attached is another .zip file with two files inside of it:

• afd2.reg
• afdfix.bat

Extract both to your desktop.

Double-click afd2.reg and allow it to merge into the registry
Once it has merged successfully, reboot your computer

Once you have rebooted...

Run afdfix.bat by double-clicking it.

Test your internet connection. Attach the new log file it creates on your desktop too.

 

I want you to run the below too:

Please download Windows Repair by Tweaking.com to your desktop.

• See the download links under this icon:
• Double-click tweaking.com_windows_repair_aio.zip and extract the Tweaking.com - Windows Repair folder to your desktop.
• Now open this folder and double-click Repair_Windows.exe.
• Click the Start Repairs tab on the far right.
• Click Custom Mode so there is a bullet in it.
• Click the Start button (bottom right)
  Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
• Click Unselect All
• Put a checkmark in the following items:
  • Reset Registry Permissions
  • Register System Files
  • Remove Policies Set By Infections
  • Repair Winsock and DNS Cache
  • Repair Windows Updates
  • Set Windows Services To Default Startup
  Note: Leave everything else unchecked
• Now click the Start button (bottom right)

Give this some time to fully run, do not restart too early. The resetting of registry permissions typically takes a while.

 

Here is the afdfix.bat log. I rebooted after the afdfix.bat. I also ran the Repair_windows.exe as per your instructions and rebooted after that was finished. No luck yet. Still cannot ping or browse.

 

Are there any devices in Device Manager that have errors? What about if you View > Show hidden devices. Are any problematic devices listed in Non-plug and play devices?

Can you try uninstalling and reinstalling the following device under Network Adapters from Device Manager

• Broadcom NetXtreme Gigabit Ethernet

Just uninstall it, and then Scan for Hardware changes so it reinstalls.

Also what happens if you go into Control Panel > Network connections > Local Area Connection 5 > Right mouse click and choose Repair

If that does not work, please run the following:

Please download Microsoft Fix it 50203 to your desktop.

• Double-click it to run.
• Reboot when asked to.

Once you have rebooted, test your internet.

Please download OTL by Old Timer to your desktop.

• See the download links under this icon:
• Double-click OTL.exe to run (Vista and Win7 right click and select Run as administrator)
• When the window appears, underneath Output at the top-right, make sure Standard Output is selected.
• Select Scan All Users.
• Check the boxes beside LOP Check and Purity Check.
• Copy the text in the code box below and paste it into the text-field.
  
  Code:

  netsvcs
  /md5start
  afd.sys
  atapi.sys
  csrss.exe
  explorer.exe
  ipsec.sys
  netbt.sys
  regedit.exe
  services.exe
  svchost.exe
  tcpip.sys
  userinit.exe
  winlogon.exe
  /md5stop
  %systemdrive%\*.*
  %systemdrive%\MGtools\*.*
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.sys /90
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %windir%\assembly\GAC\*.ini
  %windir%\assembly\GAC_MSIL\*.ini
  %windir%\assembly\gac_32\*.ini
  %windir%\assembly\gac_64\*.ini
  %windir%\assembly\temp\*.ini
  %windir%\assembly\tmp\u /s
  %allusersprofile%\application data\*.exe
  hklm\system\currentcontrolset\services\dhcp
  hklm\system\currentcontrolset\services\afd
  hklm\system\currentcontrolset\services\netbt
  hklm\system\currentcontrolset\services\tcpip
  hklm\system\currentcontrolset\services\ipsec
  hklm\software\microsoft\windows\currentversion\run
  hklm\software\microsoft\windows\currentversion\runonce
  

• Now click the button.
• When the scan is complete, Notepad will open with the results of the OTL scan.
• Close Notepad.
• There will be two log files on your desktop entitled OTL.txt and Extras.txt.
• Attach both OTL.txt and Extras.txt to your next message. (How to attach items to your post)

 

Thank you for continuing to help me!

There are no devices with errors in devices or hidden devices in device manager

There are no problematic devices in non-plug-and-play devices.

I uninstalled and reinstalled my Broadcom ethernet adapter. No connection to internet.

I repaired my local area connection. No connection to internet.

I ran the Microsoft Fix-it and rebooted when it asked. No connection to internet.

I am attaching the log files from OTL scan, run as per your instructions.

 

Now we need to make use of OTL by Old Timer.

• Double-click OTL.exe to run (Vista and Win7 right-click and select Run as administrator)
• When OTL opens, copy the text in the code box below and paste it into the text-field.
  
  Code:

  [COLOR="DarkRed"]:otl[/COLOR]
  O15 - HKU\S-1-5-21-2927344550-626447612-3570322425-1004\..Trusted Domains: localhost ([]* in Local intranet)
  [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [2011/11/12 15:23:32 | 000,002,489 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word (2).lnk
  [2011/04/22 20:10:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
  [2010/01/06 15:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
  [2011/02/24 06:11:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\AVG10
  [COLOR="DarkRed"]:commands[/COLOR]
  [emptytemp]
  [resethosts]
  

• Now click the button.
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• When complete, Notepad will open.
• Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (How to attach items to your post)

• Now open OTL again and click the button
  Note: This automatically updates the OTL.txt log on your desktop.
• Attach OTL.txt to your next message. (How to attach items to your post)

You may also want to try resetting your IE settings if you have not done so already

Start > run > inetcpl.cpl *ENTER*
Advanced tab > Reset... > Confirm > OK

 

I tried resetting my IE settings as per your instructions. No connection yet.

I tried installed a newer version of Firefox (upgrade), my own idea. No connection yet.

Curiously(?), my Carbonite backup seems to be working as the log files that are generated onto the desktop seem to be backing up.

Log files from your last instructions attached.

 

So Carbonite is backing up.

Are you able to update the following programs?

• SUPERAntiSpyware
• MalwareBytes' Anti-Malware

 

No, neither Malwarebytes nor SuperAntiSpyware will update.

I may have thrown you off track by saying that Carbonite appears to be backing up. I don't know that it is backing up for sure, it's just that there are status dots on files and some of the status dots have turned green.

 

Use SystemLook again...

With the following:

Code:

:filefind
dhcpcsvc.dll

Then attach the new SystemLook.txt to your next message.

I know that you have already run TDSSKiller but I need you to follow the directions here because there are certain features we need to toggle on:

Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)

 

Attached are the logs from the System Look run and the TDSS Killer run with the appropriate switches made.

I also tried installing a USB wireless network adapter. It connects to my wireless network, but same result (no internet) when trying to ping or surf the web.

I can ping my gateway though.

 

Ok those logs look good.

I would like you try the below.

Click Start, and then click Run.
In the Open box, type regedit, and then click OK.
In Registry Editor, locate the following keys, right-click each key, and then click Delete:

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

When you are prompted to confirm the deletion, click Yes.
Close the Registry Editor.

Locate the Nettcpip.inf file in C:\WINDOWS\inf and then open the file in Notepad.
Locate the [MS_TCPIP.PrimaryInstall] section. Change the Characteristics = 0xA0 entry by replacing 0xA0 with 0x80. Save the file. Exit Notepad.
In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
On the General tab, click Install, select Protocol, and then click Add.
In the Select Network Protocols window, click Have Disk.
In the Copy manufacturer's files from text box, type C:\WINDOWS\inf, and then click OK.
Select Internet Protocol (TCP/IP), and then click OK. It will report as unsigned, this is the one we want! Do not choose Microsoft TCP/IP v6!

Note This step returns you to the Local Area Connection Properties screen. However, the Uninstall button is now available.
Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
You will be asked to reboot your PC for the changes to take affect, go ahead and do this now.

Once you have rebooted...
In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
On the General tab, click Install, select Protocol, and then click Add.
In the Select Network Protocols window, click Have Disk.
In the Copy Manufacturer's files from text box, type C:\WINDOWS\inf, and then click OK.
Select Internet Protocol (TCP/IP), and then click OK.
Restart your computer.
Test your Internet connectivity.

 

I followed your instructions. Found and deleted the registry keys.

I edited the .dll so that I could uninstall.

I uninstalled the "Internet Protocol (TCP/IP)"

Rebooted

Re-installed "Internet Protocol (TCP/IP)"

Rebooted

Unfortunately, still no internet access

 

Can you try resetting your modem and router?

 

I have a modem/router gateway combo unit. I reset it and then reconnected. Still no internet access.

I can also "see" another wireless network (other than my own) and the computer will connect to it and get an IP address but again, no internet, no ability to ping anything other than the gateway.

I also have three other computers connected to my gateway and all three connect without issue, both before the reset and after.

 

Can you get me an updated MGlogs.zip by running C:\MGtools\GetLogs.bat

 

Absolutely. Attached is the updated log zip file.

Thank you for continuing to stick with this. I feel like we are running out of options. I'm happy to go as long as you have ideas, and I'm appreciative of your time. Are you starting to think (as I am) that this may not be fixable?

 

I don't mind.. besides I enjoy a challenge

We have to be really close too, heh.

Here's a few more suggestions:

Now we need to make use of OTL by Old Timer.

• Double-click OTL.exe to run (Vista and Win7 right-click and select Run as administrator)
• When OTL opens, copy the text in the code box below and paste it into the text-field.
  
  Code:

  [COLOR="DarkRed"]:files[/COLOR]
  C:\WINDOWS\System32\drivers\afd.sys|C:\WINDOWS\$hf_mig$\KB956803\SP3GDR\afd.sys /replace
  sc qc dhcp /c
  sc qc netbt /c
  sc qc ipsec /c
  sc qc tcpip /c
  sc qc afd /c
  netsh int ip reset resetlog.txt /c
  netsh winsock reset /c
  ipconfig /flushdns /c
  ipconfig /all /c
  ping google.com /c
  ping 192.168.1.1 /c
  [COLOR="DarkRed"]:commands[/COLOR]
  [emptytemp]
  [resethosts]
  

• Now click the button.
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• When complete, Notepad will open.
• Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (How to attach items to your post)

Please download WinSock XP Fix by Fabio Pinto to your desktop.
See the download links under this icon:

• Double-click WinsockxpFix.exe to run.

• Click the Fix button.
  Note: You will hear a long beep -- This is normal.
• Reboot your PC
• Let me know if internet connection works.

 

I found this in your logs. I hope you did not use a registry fix from another thread as that may have been the problem all along. Those registry patches are for specific users and their specific system setup.

Yours is slightly different from the default so let's try the below as that may be the culprit.

========WARNING========
The below is specifically for mattbiel's computer
Do NOT run the below if you are not mattbiel
Doing so may damage your PC!
========WARNING========

Attached is netbt_mg.zip

Inside is:

• netbt_mg.reg
• netbt_mg.bat

Extract both of these to your desktop.

Run netbt_mg.reg first and then reboot your PC.
Once you have rebooted...
Run netbt_mg.bat and then test your internet connection.
Also attach the log provided: fixme_results_3.txt

There may be other problems with the registry but I will need more time to review these.

 

Wow. Who ARE you? I am stunned that you are willing to help and stick with this through to the end. I am so thankful for you and your knowledge. Thank you!

You fixed it.

Attached is the log of the last OTL run you had me do.

After OTL ran and I rebooted at its request, I opened IE and to my pure shock there was Google, staring me in the face like an old lost friend.

I DID NOT run the Winsock XP fix that you also directed me to. I was afraid to mess up what is now working!

I have also now installed Microsoft Security Essentials.

What do you think it was in that last batch of instructions for OTL that did it?

Thank you so much.

Thank you.

 

I did not see your post (#27) until I had already posted my response (#26). The computer seems to be 100% clean and the internet is now working.

You mentioned that there may be other registry issues. Should I just use the computer and if I come across problems start a new post? Do you think the computer needs more work on the registry now?

 

:cool You're welcome.

:-D

Good call

I think it may have been the different copy of afd.sys. Although your current one was also legit / from Microsoft. I was positive the one I replaced it with this time was for SP3.

Leave the registry alone Surf safely!

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!