Trojans Disrupting Internet Access

mohit_k · Jul 6, 2006

Hi,

My PC was hit by a bunch of trojans a few days back. AdAware warned of Adware.Look2Me, but couldn't clean a few DLLs. AntiVir antivirus also found Trojan.Downloader.Small.Buy.1, but couldn't remove it. Eventually, I started seeing the bogus SpySherriff warning as my IE home page, and my dial-up internet connection started acting up.
I've downloaded HijackThis, and after googling around a little bit, identified a few entries that could be fixed. However, there is still a DLL (O20 section) which doesn't seem to get fixed. Moreover, everytime I dial-up and connect to the internet, I get as far as "Authenticated" before my Win2K OS crashes with a blue screen and the error DRIVER_IRQL_NOT_LESS_OR_EQUAL.
The latest HijackThis log is appended. Could someone please suggest what might be the problem and how I can fix this? I had absolutely no problems (or at least none that I was aware of) until a few days back, when I downloaded a couple of data files from the internet.
Thanks in advance

MK

Edit by chaslang: Inline log removed. READ ME not run!

chaslang · Jul 6, 2006

Welcome to Majorgeeks!

Please DO NOT post any logs inline with messages and do not post HijackThis logs without have followed the READ & RUN ME sticky thread procedures.

You need to run this: Look2Me VX2 Removal Then attach the requested Look2Me-Destroyer log.

Then tell me how things are working.

mohit_k · Jul 11, 2006

Hi chaslang,
Thanks very much for your help with this. I had indeed missed the "Read And Run Me" thread, and went through it subsequently.
I'm attaching the Look2Me-Destroyer log, as well as an updated HijackThis log. AdAware seems to indicate that things are okay now. However, I still can't connect to the net.
Since Win2K still crashed every time I connected, I went through the Device Manager. I found an "Unknown Device" with a conflict under the audio devices section and uninstalled it (disabling it didn't help). I am now able to connect to the internet without Win2K crashing, but the connection doesn't work. My Outlook Express and IE keep coming up with "host not found" and "page could not be displayed" errors. My ISP helpdesk walked me through the various settings, and everything seems to be in order.
Any idea what might be wrong? Any help will be greatly appreciated!
Thanks again

Mohit

chaslang · Jul 11, 2006

There are no malware issues in your HJT log but that does not mean you are clean. That is the reason for having all those steps in the READ ME which you have not run. Even if you cannot get online to run the online scanners, there are a bunch of other things you should be running. HJT alone is not going to help you.

You should be running the below:

- Windows Defender or CounterSpy if Windows Defender will not work
- Spybot (I don't see it installed at least not how the READ ME requests)
- did you run Ad-Aware SE what about all other steps accept the online scans

Your problem may not be malware. Did you check the below:
- use another browser like Mozilla FireFox
- is your NIC card (or analog modem - I don't know how you connect) working okay.
- did you delete your NIC card, reboot and then reload the drivers
- did you try running a tool like XP TCP/IP Repair

Log in or Sign up

Trojans Disrupting Internet Access

mohit_k Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

mohit_k Private E-2

Attached Files:

Look2Me-Destroyer.txt

hijackthis.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member