I had a virus now I can't get to the internet

Discussion in 'Malware Help (A Specialist Will Reply)' started by heavenseden, Oct 5, 2010.

  1. heavenseden

    heavenseden Private E-2

    I hand automated doctor virus that left me with a fake security center, fake firewall, adware browser enhancer and group policy that have limited connectivity to the internet. I have done everything and got rid of the doctor the security center but no luck with the firewall. My computer has crashed three times and I have come back from 3 blue screens of death each after running mbam, superantivirus and combofix. Got c0000218a 0x000034
    and 0x000005. I was able to run mgtools zip is attached, I ran killbox but would not let me deleted files attached. ran rkill but it was stopped. Please help me get shut down the fake firewall and get back to the internet. Thanks
     

    Attached Files:

    heavenseden, Oct 5, 2010
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No one asked you to run Killbox to delete anything. You should not be trying to delete files on your own. The C:\WINDOWS\system32\wscntfy.exe file that you tried to delete is a required system file. If you have been deleting files on your own, you may have broken your Windows installation. And in fact I see a lot of files in the C:\windows\system32 folder that do not belong there so I'm not sure exactly what you have been doing on this PC ( for quite some time since some have been there for awhile now ).

    If also looks like no network hardware is being detected so that may be broken. You may be missing drivers.

    Why is this PC being run with no protection installed?



    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O4 - HKLM\..\Run: [trawgd327uhf838jdfdsfdfds] C:\WINDOWS\wininst.exe
    O4 - HKLM\..\Run: [MKevc] C:\WINDOWS\setup.exe
    O4 - HKLM\..\Run: [MKcrc] C:\WINDOWS\login.exe
    O4 - HKLM\..\Run: [MKaoc] C:\WINDOWS\debug.exe
    O4 - HKLM\..\Run: [MKcZ] C:\WINDOWS\mdm.exe
    O4 - HKLM\..\Run: [MKee] C:\WINDOWS\user.exe
    O4 - HKLM\..\Run: [MKerb] C:\WINDOWS\taskmgr.exe
    O4 - HKCU\..\Run: [trawgd327uhf838jdfdsfdfds] C:\WINDOWS\wininst.exe
    O4 - HKCU\..\Run: [MKevc] C:\WINDOWS\setup.exe
    O4 - HKCU\..\Run: [MKcrc] C:\WINDOWS\login.exe
    O4 - HKCU\..\Run: [MKaoc] C:\WINDOWS\debug.exe
    O4 - HKCU\..\Run: [MKcZ] C:\WINDOWS\mdm.exe
    O4 - HKCU\..\Run: [MKee] C:\WINDOWS\user.exe
    O4 - HKCU\..\Run: [MKerb] C:\WINDOWS\taskmgr.exe

    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\temp
    C:\Documents and Settings\user\Local Settings\temp

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Oct 5, 2010
    #2
  3. heavenseden

    heavenseden Private E-2

    Did as you requested and have attached the logs. Nothing has changed fake firewall still not allowing me access to the internet. In tells me for my protection my computer will not be able to access the internet. I am past discussed.
     

    Attached Files:

    heavenseden, Oct 9, 2010
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You neglected to answer my question about running without protection.

    Are you sure that you are not getting a message from the Windows Firewall? Based on your logs, you are not getting a properly IP address assigned to your PC from your router. Thus you cannot access the internet because of this. You logs show the below which is not what you should have. The first two settings are correct but the IP address is definitely not valid and the Subnet would likely need to be set to 255.255.255.0 for a home network.
    Code:
            Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        Autoconfiguration IP Address. . . : 169.254.13.164
        Subnet Mask . . . . . . . . . . . : 255.255.0.0
    What happens if you assign a static IP in the range allow by your router.

    You may have deleted files on your own that are necessary to configure your network. Have you tried using System Restore to go back to a point before these problems began?

    Also another thing to check is your Earthlink software as it could be the cause of your problems. Remaining issues do not appear to be from any malware that remains on your PC. Your logs are clean but your Windows OS may be damaged especially since I see stuff like below in your system32 folder that should not be there. I don't know who/what did this but this is not valid. I think your safest thing to do may be to reinstall especially if System Restore does not work. The stability of your Windows installation is questionable at best.
    Code:
    "C:\WINDOWS\system32\"
ntuser.dat    Jul 23 2010      241664  "NTUSER.DAT"
ntuser_1.dat  Jul 23 2010      241664  "NTUSER_1.DAT"
ntuser_2.dat  Jul 23 2010     2682880  "NTUSER_2.DAT"
re810a~1      Sep 14 2010        5103  "RestoreUI[2]"
restor~1      Aug 13 2010           8  "RestorePointSize"
restor~2      Aug 14 2010           8  "RestorePointSize_1"
restor~3      Aug 23 2010           8  "RestorePointSize_2"
restor~4      Aug 24 2010           8  "RestorePointSize_3"
rs30ab~1      Sep 14 2010        2491  "rstrui[2]_3"
rstrui~1      Sep 14 2010        2491  "rstrui[1]"
rstrui~2      Sep 14 2010        2491  "rstrui[2]"
rstrui~3      Sep 14 2010        2491  "rstrui[2]_1"
rstrui~4      Sep 14 2010        2491  "rstrui[2]_2"
sam           Jul 23 2010       24576  "SAM"
sapicp~1.man  Sep 27 2010         749  "sapi.cpl.manifest"
schannel.dll  Jun 30 2010      149504  "schannel.dll"
security      Jul 23 2010       57344  "SECURITY"
sh00cd~1.lnk  Oct  4 2010         566  "Shortcut (2) to wups.dll.lnk"
sh03c6~1.lnk  Oct  4 2010         583  "Shortcut (2) to wucltui.dll.lnk"
sh060f~1.lnk  Oct  4 2010         590  "Shortcut to wshnetbs.dll.lnk"
sh0904~1.lnk  Oct  4 2010         590  "Shortcut to wuaueng1.dll.lnk"
sh09f7~1.lnk  Oct  4 2010         583  "Shortcut (2) to wuaueng.dll.lnk"
sh0bfe~1.lnk  Oct  4 2010         583  "Shortcut (2) to wuaucpl.cpl.lnk"
sh0f20~1.lnk  Oct  4 2010         595  "Shortcut to wuapi.dll.mui.lnk"
sh0f78~1.lnk  Oct  4 2010         590  "Shortcut to wtsapi32.dll.lnk"
sh11ce~1.lnk  Oct  4 2010         583  "Shortcut to wsnmp32.dll.lnk"
sh12be~1.lnk  Oct  4 2010         583  "Shortcut (2) to xpssvcs.dll.lnk"
sh1321~1.lnk  Oct  4 2010         578  "Shortcut to wzcdlg.dll.lnk"
sh1400~1.lnk  Oct  4 2010         583  "Shortcut to xactsrv.dll.lnk"
sh1867~1.lnk  Oct  4 2010         583  "Shortcut to xvidvfw.dll.lnk"
sh1a97~1.lnk  Oct  4 2010         605  "Shortcut to wuaucpl.cpl.mui.lnk"
sh1be0~1.lnk  Oct  4 2010         583  "Shortcut (2) to wuauclt.exe.lnk"
sh1c88~1.lnk  Oct  4 2010         605  "Shortcut to wucltui.dll.mui.lnk"
sh1daf~1.lnk  Oct  4 2010         578  "Shortcut to wzcsvc.dll.lnk"
sh2401~1.lnk  Oct  4 2010         578  "Shortcut (2) to wscsvc.dll.lnk"
sh244f~1.lnk  Oct  4 2010         578  "Shortcut (2) to wzcsvc.dll.lnk"
sh2ab2~1.lnk  Oct  4 2010         578  "Shortcut (2) to wzcdlg.dll.lnk"
sh2dac~1.lnk  Oct  4 2010         590  "Shortcut (2) to xmlprovi.dll.lnk"
sh3866~1.lnk  Oct  4 2010         630  "Shortcut (2) to wuaucpl.cpl.manifest.lnk"
sh3d5f~1.lnk  Oct  4 2010         583  "Shortcut to WudfSvc.dll.lnk"
sh4415~1.lnk  Oct  4 2010         610  "Shortcut (2) to WudfPlatform.dll.lnk"
sh4504~1.lnk  Oct  4 2010         625  "Shortcut (2) to WUDFCoinstaller.dll.lnk"
sh46ee~1.lnk  Oct  4 2010         583  "Shortcut to wupdmgr.exe.lnk"
sh4b93~1.lnk  Oct  4 2010         590  "Shortcut to wuauserv.dll.lnk"
sh50ff~1.lnk  Oct  4 2010         583  "Shortcut to xmllite.dll.lnk"
sh5380~1.lnk  Oct  4 2010         571  "Shortcut to wuapi.dll.lnk"
sh55b3~1.lnk  Oct  4 2010         590  "Shortcut to xvidcore.dll.lnk"
sh56c1~1.lnk  Oct  4 2010         583  "Shortcut (2) to xolehlp.dll.lnk"
sh5705~1.lnk  Oct  4 2010         571  "Shortcut to wuweb.dll.lnk"
sh610f~1.lnk  Oct  4 2010         610  "Shortcut to WudfPlatform.dll.lnk"
sh6158~1.lnk  Oct  4 2010         590  "Shortcut to xpob2res.dll.lnk"
sh61dd~1.lnk  Oct  4 2010         583  "Shortcut (2) to xmlprov.dll.lnk"
sh62d1~1.lnk  Oct  4 2010         590  "Shortcut to xpsp2res.dll.lnk"
sh62f7~1.lnk  Oct  4 2010         583  "Shortcut to wstpager.ax.lnk"
sh63d1~1.lnk  Oct  4 2010         590  "Shortcut to xpsp4res.dll.lnk"
sh63f4~1.lnk  Oct  4 2010         590  "Shortcut to WudfHost.exe.lnk"
sh66cb~1.lnk  Oct  4 2010         583  "Shortcut (2) to xenroll.dll.lnk"
sh6963~1.lnk  Oct  4 2010         578  "Shortcut to wship6.dll.lnk"
sh6a0e~1.lnk  Oct  4 2010         583  "Shortcut (2) to wsock32.dll.lnk"
sh6a11~1.lnk  Oct  4 2010         571  "Shortcut (2) to wuapi.dll.lnk"
sh6c2d~1.lnk  Oct  4 2010         590  "Shortcut to xpsshhdr.dll.lnk"
sh6e9e~1.lnk  Oct  4 2010         571  "Shortcut (2) to wuweb.dll.lnk"
sh7003~1.lnk  Oct  4 2010         578  "Shortcut (2) to wship6.dll.lnk"
sh7018~1.lnk  Oct  4 2010         590  "Shortcut (2) to wuauclt1.exe.lnk"
sh71e3~1.lnk  Oct  4 2010         590  "Shortcut (2) to wstdecod.dll.lnk"
sh77f1~1.lnk  Oct  4 2010         583  "Shortcut to wucltui.dll.lnk"
sh7c0a~1.lnk  Oct  4 2010         605  "Shortcut (2) to wuaueng.dll.mui.lnk"
sh7d2f~1.lnk  Oct  4 2010         583  "Shortcut to wuaueng.dll.lnk"
sh7d98~1.lnk  Oct  4 2010         590  "Shortcut (2) to xpsp1res.dll.lnk"
sh7e98~1.lnk  Oct  4 2010         590  "Shortcut (2) to xpsp3res.dll.lnk"
sh89d6~1.lnk  Oct  4 2010         583  "Shortcut (2) to wzcsapi.dll.lnk"
sh8a42~1.lnk  Oct  4 2010         590  "Shortcut (2) to wtsapi32.dll.lnk"
sh8b57~1.lnk  Oct  4 2010         630  "Shortcut to wuaucpl.cpl.manifest.lnk"
sh8f2e~1.lnk  Oct  4 2010         583  "Shortcut to wuaucpl.cpl.lnk"
sh91d9~1.lnk  Oct  4 2010         590  "Shortcut (2) to wshnetbs.dll.lnk"
sh91e5~1.lnk  Oct  4 2010         590  "Shortcut to xmlprovi.dll.lnk"
sh9330~1.lnk  Oct  4 2010         583  "Shortcut (2) to xvidvfw.dll.lnk"
sh94da~1.lnk  Oct  4 2010         590  "Shortcut (2) to wuaueng1.dll.lnk"
sh96e9~1.lnk  Oct  4 2010         583  "Shortcut to xpssvcs.dll.lnk"
sh9864~1.lnk  Oct  4 2010         578  "Shortcut to wshcon.dll.lnk"
sh99d7~1.lnk  Oct  4 2010         605  "Shortcut to wuaueng.dll.mui.lnk"
sh9b08~1.lnk  Oct  4 2010         566  "Shortcut to xjis.nls.lnk"
sh9b42~1.lnk  Oct  4 2010         583  "Shortcut (2) to zipfldr.dll.lnk"
sh9cfc~1.lnk  Oct  4 2010         625  "Shortcut to WUDFCoinstaller.dll.lnk"
sh9de2~1.lnk  Oct  4 2010         578  "Shortcut to wshbth.dll.lnk"
sh9f18~1.lnk  Oct  4 2010         583  "Shortcut to wuauclt.exe.lnk"
sha177~1.lnk  Oct  4 2010         578  "Shortcut to wshext.dll.lnk"
sha402~1.lnk  Oct  4 2010         578  "Shortcut (2) to wshatm.dll.lnk"
sha48c~1.lnk  Oct  4 2010         578  "Shortcut (2) to wshbth.dll.lnk"
shac6b~1.lnk  Oct  4 2010         578  "Shortcut to wshisn.dll.lnk"
shac88~1.lnk  Oct  4 2010         583  "Shortcut (2) to wsnmp32.dll.lnk"
shade4~1.lnk  Oct  4 2010         598  "Shortcut (2) to wstrenderer.ax.lnk"
shafc8~1.lnk  Oct  4 2010         583  "Shortcut (2) to xactsrv.dll.lnk"
shafff~1.lnk  Oct  4 2010         578  "Shortcut (2) to wshcon.dll.lnk"
shb00c~1.lnk  Oct  4 2010         571  "Shortcut to xcopy.exe.lnk"
shb30b~1.lnk  Oct  4 2010         578  "Shortcut (2) to wshisn.dll.lnk"
shb3fe~1.lnk  Oct  4 2010         559  "Shortcut to xvid.ax.lnk"
shb79f~1.lnk  Oct  4 2010         571  "Shortcut (2) to xcopy.exe.lnk"
shb807~1.lnk  Oct  4 2010         578  "Shortcut (2) to wshext.dll.lnk"
shb939~1.lnk  Oct  4 2010         566  "Shortcut (2) to xjis.nls.lnk"
shc0d3~1.lnk  Oct  4 2010         571  "Shortcut to wshom.ocx.lnk"
shc20f~1.lnk  Oct  4 2010         571  "Shortcut to WshRm.dll.lnk"
shc212~1.lnk  Oct  4 2010         571  "Shortcut (2) to WUDFx.dll.lnk"
shc793~1.lnk  Oct  4 2010         590  "Shortcut (2) to wsecedit.dll.lnk"
shc8a9~1.lnk  Oct  4 2010         583  "Shortcut (2) to WudfSvc.dll.lnk"
shcbfc~1.lnk  Oct  4 2010         571  "Shortcut to WUDFx.dll.lnk"
shd122~1.lnk  Oct  4 2010         559  "Shortcut (2) to xvid.ax.lnk"
shd1b7~1.lnk  Oct  4 2010         583  "Shortcut (2) to wupdmgr.exe.lnk"
shd3d1~1.lnk  Oct  4 2010         571  "Shortcut to wups2.dll.lnk"
shd45c~1.lnk  Oct  4 2010         595  "Shortcut (2) to wuapi.dll.mui.lnk"
shd501~1.lnk  Oct  4 2010         583  "Shortcut to xmlprov.dll.lnk"
shd66b~1.lnk  Oct  4 2010         590  "Shortcut (2) to wuauserv.dll.lnk"
shd764~1.lnk  Oct  4 2010         571  "Shortcut (2) to wshom.ocx.lnk"
shd990~1.lnk  Oct  4 2010         571  "Shortcut (2) to WshRm.dll.lnk"
shda75~1.lnk  Oct  4 2010         583  "Shortcut to xolehlp.dll.lnk"
shdaf2~1.lnk  Oct  4 2010         583  "Shortcut to xenroll.dll.lnk"
shdeb3~1.lnk  Oct  4 2010         583  "Shortcut to wsock32.dll.lnk"
she08a~1.lnk  Oct  4 2010         590  "Shortcut (2) to xvidcore.dll.lnk"
she190~1.lnk  Oct  4 2010         566  "Shortcut to wups.dll.lnk"
she1d1~1.lnk  Oct  4 2010         590  "Shortcut to xpsp1res.dll.lnk"
she2d1~1.lnk  Oct  4 2010         590  "Shortcut to xpsp3res.dll.lnk"
she445~1.lnk  Oct  4 2010         590  "Shortcut to wuauclt1.exe.lnk"
she780~1.lnk  Oct  4 2010         598  "Shortcut to wstrenderer.ax.lnk"
she7ff~1.lnk  Oct  4 2010         590  "Shortcut (2) to xpsshhdr.dll.lnk"
shea60~1.lnk  Oct  4 2010         571  "Shortcut (2) to wups2.dll.lnk"
sheb38~1.lnk  Oct  4 2010         583  "Shortcut (2) to xmllite.dll.lnk"
shec10~1.lnk  Oct  4 2010         590  "Shortcut (2) to xpob2res.dll.lnk"
shedbe~1.lnk  Oct  4 2010         583  "Shortcut (2) to wstpager.ax.lnk"
shell32.dll   Jul 27 2010     8462336  "shell32.dll"
shf519~1.lnk  Oct  4 2010         590  "Shortcut to wstdecod.dll.lnk"
shfcc3~1.lnk  Oct  4 2010         605  "Shortcut (2) to wuaucpl.cpl.mui.lnk"
shfd02~1.lnk  Oct  4 2010         583  "Shortcut to wzcsapi.dll.lnk"
shfd98~1.lnk  Oct  4 2010         590  "Shortcut (2) to xpsp2res.dll.lnk"
shfe3d~1.lnk  Oct  4 2010         590  "Shortcut (2) to WudfHost.exe.lnk"
shfe98~1.lnk  Oct  4 2010         590  "Shortcut (2) to xpsp4res.dll.lnk"
shfeb9~1.lnk  Oct  4 2010         605  "Shortcut (2) to wucltui.dll.mui.lnk"
shortc~1.lnk  Oct  4 2010         578  "Shortcut to wshatm.dll.lnk"
shortc~2.lnk  Oct  4 2010         590  "Shortcut to wsecedit.dll.lnk"
shortc~3.lnk  Oct  4 2010         578  "Shortcut to wscsvc.dll.lnk"
shortc~4.lnk  Oct  4 2010         583  "Shortcut to zipfldr.dll.lnk"
system        Jul 23 2010     6160384  "system"
system~1.dll  Aug 13 2010      129536  "System.Web.Routing.ni.dll"
user-l~1.sol  Sep 10 2010         139  "USER-LIFE-TIME.sol"
usrclass.dat  Jul 23 2010        8192  "UsrClass.dat"
usrcla~1.dat  Jul 23 2010      307200  "UsrClass_1.dat"
_r0ca5~1      Aug 21 2010        8192  "_REGISTRY_USER_USRCLASS_S-1-5-20_1"
_r0fbe~1      Aug 13 2010      241664  "_REGISTRY_USER_NTUSER_S-1-5-20"
_r1ca5~1      Aug 22 2010        8192  "_REGISTRY_USER_USRCLASS_S-1-5-20_2"
_r3427~1      Aug 21 2010      307200  "_REGISTRY_USER_USRCLASS_S-1-5-21-1547161642-1708537768-839522115-1003_1"
_r3437~1      Aug 22 2010      307200  "_REGISTRY_USER_USRCLASS_S-1-5-21-1547161642-1708537768-839522115-1003_2"
_r42a4~1      Aug 21 2010       57344  "_REGISTRY_MACHINE_SECURITY_1"
_r52a4~1      Aug 22 2010       57344  "_REGISTRY_MACHINE_SECURITY_2"
_r54ad~1      Aug 21 2010        8192  "_REGISTRY_USER_USRCLASS_S-1-5-19_1"
_r7228~1      Aug 13 2010      307200  "_REGISTRY_USER_USRCLASS_S-1-5-21-1547161642-1708537768-839522115-1003"
_r7e5d~1      Aug 13 2010       57344  "_REGISTRY_MACHINE_SECURITY"
_r8d6e~1      Aug 13 2010       24576  "_REGISTRY_MACHINE_SAM_1"
_r8d7e~1      Aug 22 2010       24576  "_REGISTRY_MACHINE_SAM_2"
_r925d~1      Aug 21 2010      241664  "_REGISTRY_USER_NTUSER_S-1-5-20_1"
_rda45~1      Aug 21 2010      241664  "_REGISTRY_USER_NTUSER_S-1-5-19_1"
_rda4d~1      Aug 21 2010      274432  "_REGISTRY_USER_NTUSER_S-1-5-18_1"
_regis~1      Aug 12 2010       24576  "_REGISTRY_MACHINE_SAM"
_regis~1.de~  Aug 13 2010      274432  "_REGISTRY_USER_.DEFAULT"
_regis~2      Aug 13 2010      274432  "_REGISTRY_USER_NTUSER_S-1-5-18"
_regis~2.de~  Aug 21 2010      274432  "_REGISTRY_USER__1.DEFAULT"
_regis~3      Aug 13 2010      241664  "_REGISTRY_USER_NTUSER_S-1-5-19"
_regis~3.de~  Aug 22 2010      274432  "_REGISTRY_USER__2.DEFAULT"
_regis~4      Aug 13 2010        8192  "_REGISTRY_USER_USRCLASS_S-1-5-19"
_rf17f~1      Aug 13 2010        8192  "_REGISTRY_USER_USRCLASS_S-1-5-20"
_rf9d8~1      Aug 13 2010     2748416  "_REGISTRY_USER_NTUSER_S-1-5-21-1547161642-1708537768-839522115-1003"
_rff77~1      Aug 21 2010     2748416  "_REGISTRY_USER_NTUSER_S-1-5-21-1547161642-1708537768-839522115-1003_1"
_rff87~1      Aug 22 2010     2748416  "_REGISTRY_USER_NTUSER_S-1-5-21-1547161642-1708537768-839522115-1003_2"
     
    Last edited: Oct 10, 2010
    chaslang, Oct 10, 2010
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds