Internet problems after spyware removal

I recently had Vitumonde and Trojan.Vundo. I fixed Vundo using your vundofix progam but when trying to fix the Virtumonde something has gone wrong. I followed your "READ THIS FIRST" post and followed upto the AVG scan (*6A i think it is) ( i was unable to run CounterSpy ). When i rebooted into safemode with network support (to run the online scans) i was unable to connect to the net to run the online scans. I thought maybe it was because i was in safemode and booted into standard mode. Alas i was still unable to use the internet. I have used command prompt to ping my router and modem and the connections to them seem to be fine. Is there something i am missing or do i need to reinstall something? I have the scan reports on the computer that cannot access the internet but i will try and get copys of them onto disk and post them if they are needed.

Thanks in advance...

Tim

 

Thanks for your time if you have already started looking into this. but i got home tonight the internal Gemlins decided to reactivate internet after 2 days snoozing.

 

So, is all well now?
abri

 

I think so. Internet is running now and i have completed steps 1-6C. should i also do a hijackthis scan?

Comp still seems to be running at about 1/4 of its pre-problem potential.

 

here are results from GetRunKey and ShowNew.

 

yes, please run it in its correct location as per the instructions in step 7 in the READ & RUN ME FIRST

 

OK. Ran HijackThis as "analyse". Attached is the report.

 

Welcome to Major Geeks!

This will take several posts. Please be patient!

1) You missed this step! Please go to
Uninstall Malware via Add/Remove Programs and look for any programs which have not yet been removed. I see the below programs are still on the computer! There may be others!

Viewpoint Media Player (Remove Only)
Search Assist
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6


Once you've check the list against your add/remove programs, please REBOOT!

2) Then install

Java Runtime Environment vs. 6.2.


3) After you run the above, run ComboFix below..

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply and

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


4) Please download ATF Cleanerr by Atribune. This program does not require an installation.

The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser

* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the

prompt.

If you use Opera browser

* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
o NOTE: If you would like to keep your saved passwords, please click No at the

prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

5)
After you have completed ALL of the above, please attach fresh logs for the following:

• HijackThis
  
• ShowNew (newfiles.txt)
  
• GetRunKey (runkeys.txt)
  
• ComboFix

 

OK Checked all "Add/Remove" programs against your list and the ones you pointed out were the only ones on it.

When i finished running ComboFix i got a popup in reference to nircmd.cfexe

This application has failed to start because ConnAPI.DLL was not found. Re-installing the application may fix this problem.

Is this surposed to happen?


Also i deleted the java program things you pointed out and installed the new one. Now it keeps telling me that there are updates to run. Should i run these?

Everything else went smoothly. Logs are attached. Renamed them adding the date (dd/mm/yyyy) after the name.

 

And the new Analyse File.

 

Hi Nimlot!


1) Please go toUninstall Malware via Add/Remove Programs
and look for any programs which have not yet been removed. I see the below programs are still on the computer! There may be others!

2) Once you've done the above, REBOOT


3) Then install Java Runtime Environment vs. 6.2.


4) After you run the above, run ComboFix below..

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply and

Note: Do not mouseclick combofix's window while it is running. That may cause it to stall.


5) After you have completed ALL of the above, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• ComboFix Log

Let me know how things are going.
abri

 

Do i need to do them again? I followed the same things on that list last night.

Viewpoint Media Player (Remove Only)
Search Assist
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6

I have already deleted these via the add/remove programs application in control panel. Is this the right place to do that?

I can run the scans again when i get home tonight if they are needed.

Cheers for all this help, Much appreciated.

 

sorry, you're fine ... get back to you in a bit
abri

 

Hi Nimlot!


1) First, if you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger


2) Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

3) Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

4) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Next Reset Web Settings & Default Security Settings

5) For IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

For IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


6) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


7) After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

abri

 

Everything went smoothly once i realised that wordpad and notepad are different

The Avenger said it couldnt find all the files but i guess that it will say that in the log also.

Computer seems to be running well again. Updated Antivirus to Norton 360 and also updated IE to v.7

 

Many thanks again.

Hopefully all problems are gone.

Fingers crossed the logs show that they are.


-- Nimlot

 

Hi Nimlot,
I wondered if your computer clock/calendar is set correctly, because you have files (mainly but not only, Symantec, also Java) showing as having been created on Aug.30, 2007). Did you install both of those on the same day?
abri

 

Hi Tim!

Looks good! If you're using the full Symantec Security Suite, then it would be a good idea to uninstall McAfee Spam Killer. Other than that, your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

Safe surfing!
abri

 

Computer time/date/clock was incorrect - all fixed now

Startup is very slow but i think that is my end.

All Malware etc problems seem to have gone. Final Steps have been run and all seems well.

Many Thanks again for all your time and help. It was greatly appreciated.

-- Tim

 

You're welcome! You might try disconnecting from the internet and disabling Symantec loading at start-up (if you can) and see if that changes your start-up time. Symantec is good, but it's a resource hog. Also, you might get some more tips on start-up slows over in the Software Forum. Good luck!

abri