Still having problems after running READ ME instructions

I ran all the programs in the READ ME file (Windows XP, 32 bit) and I don't see any immediate signs of malware anymore, but now I am not able to connect to the internet and my Firewall is disabled and I cannot enable it.

I ran all the programs in the READ ME file, starting with SAS. After I ran that and was prompted to reboot, I was not able to connect to the internet ("SERVER NOT FOUND. Firefox cannot find the server at www......com"). Before that, I had no problems connecting. I hoped it would resolve itself after running the rest of the programs. I ran the others, except for RootRepeal. I (mistakenly) downloaded a version of that which I was not able to open (RAR) and since I cannot connect to the internet, I cannot download the ZIP version to retry it.

I was able to transfer the log files from the other scans to a disk and borrow a friend's computer to post to this thread.

Maybe you'll see this in the ComboFix log (all of those are Greek to me!) but when I ran that one, a window came up that said "Congratulations! You are infected with a Rootkit (something-or-other) which is a difficult infection."

I tried to do the "Manual Restoring Internet Connection" found in the ComboFix tutorial from BleepingComputer, but when I click "Repair" from the Local Area Connection icon in "Network Connections" in the Control Panel, I get a message that says, "Windows could not finish repairing the problem because the following action cannot be completed: Failed to query TCP/IP setting of the connection. Cannot proceed."

I was able to connect before starting this whole process. How did these settings get changed and how do I get them back?

THANKS SO MUCH!

 

Thanks so much for the quick reply. I'm so glad you guys are here to help!

Here is what I have done:

I removed Registry Mechanic, Rebate Nation and Viewpoint Media Player as you suggested.

I ran MGtools\analyse.exe and then created the Notepad txt file and started ComboFix with it as you instructed. Log is attached.

ComboFix ran and then rebooted my computer.

I did not have any problems opening any programs as you said could happen.

I copied the ipsec.sys file to the drivers folder, rebooted, and the file stayed put.

I then ran MGtools\GetLogs.bat. Zip log is attached.

Everything ran pretty smoothly. No additional error messages.

But... after that, I was still not able to turn on the Firewall. I rebooted again, but still no luck. When I tried to start it manually, I received the following message: "Windows Firewall settings cannot be displayed because the associated service is not running. Do you want to start the Windows Firewall/Internet Connection Sharing (ICS) service?"

When I clicked YES, it made an attempt and then gave me:

"Windows cannot start the Windows Firewall/Internet Connection Sharing (ICS) service"

Also, I still cannot connect to the internet.

In addition, when I tried to enable my AV again, I received this new pop-up message! --> Error communicating with kernel.

So, No AV. No Internet. No Firewall.

Thanks again for your help! It is greatly appreciated!!

 

Update: A short while ago I posted the extra steps you instructed to take and attached the additional logs, but I didn't see that post appear yet. Hmmm. Well, if you get that message, what I posted earlier still stands, except now I *am* able to open the AV program at least (not getting the "Error communicating with kernel" anymore). However, the AV is not functioning properly. I get this message within the program after opening it:

Analysis of application protocols will not function.
An error occurred while starting services. Analysis of application protocols (POP3, HTTP) will not function.

As always, Thanks for your help!!

 

Thanks for checking into this further. I really appreciate it and look forward to your next reply.

Kind regards,
Dawn

 

Again, thanks so much for taking the time to look into this and all the extra effort!!

Right now, my problem is getting the file on the infected computer. Admittedly, my computer is very old, and I have been having trouble with any USB port to recognize anything I plug into them for awhile now (not just since the malware incident). And my CD/DVD drives have not worked for awhile. So now I need to get lucky and have my computer recognize one of the USB ports so I can extract the file to it. I have been lucky in the past (that's how I was able to post the logs to this thread); but it happens randomly and it's being stubborn now. I will report back when (and if) I am successful in extracting the file.

Thank you!
Dawn

 

OK! Was able to perform the next set of instructions.

I did receive a success message after the .reg file merged with the registry.

I rebooted. Still couldn't connect to the internet.

I ran the other file. It rebooted on its own... and I still am not able to connect to the internet.

The log you requested is attached.

I also have another question regarding malware and my particular strain:
If I backup documents and photos (no programs) from the infected computer onto an external hard drive, is there a danger of something bad getting transferred if I transfer those files onto another computer?

Thanks,
Dawn

 

The nettcpip.inf file is not in the location you listed. I did a search for it, and it's actually in C:\WINDOWS\ServicePackFiles\i386. Does this make a difference? I can still modify the file as you said and then instead of doing this action when I get to it [In the Copy manufacturer's files from text box, type C:\WINDOWS\inf] would I change the location to the folder my file is in? Or should I copy the .inf file to C:\WINDOWS\inf and just follow your instructions?

 

Try this:


Go to Start ==> Run (or Windows key+R)
Type the following bolded text in the run box and click OK: notepad c:\windows\inf\nettcpip.inf

 

Perfect! Thanks for the tip! I will proceed...

 

Once I got to this point (after rebooting) and did the following:

When I did the final step and selected Internet Protocol (TCP/IP) and clicked OK, I got a window that said: "NETWORK CONNECTIONS: Could not add the requested component. The error is: Access is denied."

I am the only user on this computer. There aren't any restrictions on the use.

I rebooted anyway (still no internet) and ran the GetLogsbat.file which I'll send in a minute.

Thanks again,
Dawn

 

Here is the MGlog.zip file for the last set of instructions.

Thanks. Dawn.

 

http://img707.imageshack.us/img707/6703/generalxpicon.gif Download SystemLook from one of the links below and save it to your desktop.
Download Mirror #1
Download Mirror #2

If you have a 64-bit system, please download the 64 bit version from here:
SystemLook (64-bit)

• Double-click SystemLook.exe to run it.
• Copy and Paste the content of the following code box into the main text-field:

Code:

:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan and a file entitled SystemLook.txt will be created on your desktop.
• Attach that file to your next message. (How to attach)

 

Thanks for the further instructions. Here is the SystemLook text file. Thanks.

 

http://img51.imageshack.us/img51/9017/regedit.gif Copy the bold text below to Notepad. Save it as devicepath.reg to your desktop. Be sure the "Save as" type is set to "All files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

http://img684.imageshack.us/img684/3557/tdsskiller.gif I want you to read and follow these instructions: TDSSKiller - How to run

http://img205.imageshack.us/img205/1894/otl.gif Please download OTL by OldTimer.

• Save it to your desktop.
• Double click on the OTL icon on your desktop. (Vista/7 right-click and select Run as Administrator)
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  netsvcs
  /md5start
  afd.sys
  atapi.sys
  csrss.exe
  dhcpcsvc.dll
  explorer.exe
  ipsec.sys
  netbt.sys
  regedit.exe
  services.exe
  svchost.exe
  tcpip.sys
  userinit.exe
  winlogon.exe
  /md5stop
  %systemdrive%\*.*
  %systemdrive%\MGtools\*.*
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.sys /90
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  hklm\system\currentcontrolset\services\dhcp
  hklm\system\currentcontrolset\services\afd
  hklm\system\currentcontrolset\services\netbt
  hklm\system\currentcontrolset\services\tcpip
  hklm\system\currentcontrolset\services\ipsec
  

• Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.
• Two reports will be created:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
• Attach both OTL.txt and Extras.txt to your next message. (How to attach)