Rootkit Zero Access

Welcome to Major Geeks!

Check what the correct DNS server settings are supposed to be. On this PC you have

Code:

        DNS Servers . . . . . . . . . . . : 172.16.3.254
                                            192.168.1.1

And the 172.16.3.254 does not seem to be valid. What addresses do you see on the PCs that are working?

If it is just your DNS setting, you can probably connect to websites by using their IP address rather than a URL. Like use 74.125.113.104 instead of www.google.com


If you don't know how to change your DNS settings, see the below:

http://www.mediacollege.com/computer/network/dns.html


Is anything from Symantec still installed? I see the below service but no software:
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


Your logs are basically clean otherwise.

 

Then it would still seem the your DNS server is the issue because it is not working properly as illustrated by your ability to use IP addresses and not URLs. Did you check out the lin I gave you for configuring DNS?

Also try steps 1 thru 4 of the below link:

Fixing Google Redirection/hijacking and other redirection problems

Okay then I will give you some steps to remove this.

Did you check out the lin I gave you for configuring DNS?


Also please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure "Include All Files" option remains checked.
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please attach this log to your next reply.

 

Some additional instructions to perform after completing what was in my previous message.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

After clicking Fix, exit HJT.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Crap!! I posted the wrong link. Sorry about that. What I want you to do is to set both IP and DNS to the Obtain automatically settings! See the below snapshot ( click on it to expand it ).

Set the above automatic settings and then continue.

 

But your PC is not infected based on your logs. It seems more like there is a problem with your PC getting DNS to work properly. When you bypassed the router did it work? I cannot tell from what you said in your last message.


Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure "Include All Files" option remains checked.
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please attach this log to your next reply.

​

 

Try removing the DNS settings that are Obtained automatically and provision ones from Google. See the below:

http://code.google.com/speed/public-dns/docs/using.html


Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs: ​

• C:\MGlogs.zip

 

I want to collect some more info about your DNScache service using a newer version of MGtools.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\MGlogs.zip

 

Let's see if we can change the NodeType with ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
If ComboFix does not cause your PC to reboot, then reboot it yourself before continuing with the below.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

I did not think it would have anything to do with the problem. Based on all your logs, your issue is not malware and I would have to recommend that you post in either the Networking Forum or the Software Forum to see it you can figure out where the problem is. It appears to be in your network settings. Are the below items highlighted in RED supposed to be there? Normally we don't see things here. Perhaps your ISP needs these for some reason.

Code:

Windows IP Configuration
 
        Host Name . . . . . . . . . . . . : Kenzie
        Primary Dns Suffix  . . . . . . . : 
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
       [COLOR=red][B] DNS Suffix Search List. . . . . . : windstream.net[/B][/COLOR]
 
Ethernet adapter Local Area Connection:
 
[B][COLOR=red]        Connection-specific DNS Suffix  . : windstream.net[/COLOR][/B]
        Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes

See this link >>> http://support.microsoft.com/kb/305553

The below is quoted from it:

 

You're welcome.

Given below but I'm going to leave out the normal instructions for toggling System Restore just in case you wish to try using it to see if it can fix your DNS issue. Just be aware that using System Restore could potentially also reinstall any infections present in the restore point which would mean you would have to remove them again.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

We are happy to hear you found a way to cure the problem. Thanks for letting us know.