virus - now computer won't connect to the internet help please

chardonnay_2

hi, my computer got a bad virus - managed to get rid of a lot of the trojans but now it's blocked me from getting online, hub strength is excellent but it won't connect as says the remote device or resource won't accept the connection.

please help

gavsto2005

This could be due to numerous issues that viruses/spyware often leave behind. Often you are actually connected but it has placed some errorneous settings in different places.

If you are using internet explorer, goto Tools > Internet Options then goto the connections tab and click on the Lan Settings button. Ensure Use a proxy server for your lan is UNTICKED. Restart internet explorer and see if that resolves the issue.

If it doesn't, Click Start and Go to run - if you have no run option hold down the windows key and press R. In the box that appears type in ncpa.cpl and press enter.

If you are on a wireless connection, right click on that and go to properties. If you are on a wired connection right click Local Area Connection and go to properties. Find Internet Protocol (TCP/IP) in the list, single left click it so it is highlighted and click properties. Ensure that there is a blob in Obtain DNS Server address automatically.

Let me know if this works.

millwalll

Boot the computer into safe mode download a program called malwarebytes do a full scan in safe mode. Once it has done start the computer up again see if you can connect to net update malwarebytes do another full scan then if u got virus software update that and do full scan

chardonnay_2

thanks, the first tip worked

millwalll

Hi Chardonnay,

Glad the first thing worked but would recommend doing my suggestion too as if the malware is still on computer you may find it take over your proxy settings again.

aliEnRIK

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM QUICK SCAN then click SCAN
Remove everything thats found (needs to be ticked)
Post the COMPLETE log here AFTER youve deleted everything it finds
If anything was found then do the exact same but run a FULL scan


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)
If you get a message that you cant write to the hosts file then Press the SHIFT key, and whilst holding it RIGHT CLICK and select RUN AS (admin)

chardonnay_2

alwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4335
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
21/07/2010 18:10:28
mbam-log-2010-07-21 (18-10-28).txt
Scan type: Quick scan
Objects scanned: 141340
Time elapsed: 14 minute(s), 1 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\AVSolution (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit (Worm.KoobFace) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\urxspamj (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwebizevaxiku (Trojan.Agent.U) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\070700setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\CLAIRE\AppData\Roaming\sdra64.exe (Worm.KoobFace) -> Delete on reboot.
C:\Windows\system32\Drivers\ofkorr.sys (Trojan.Bubnix) -> Quarantined and deleted successfully.
C:\Users\CLAIRE\AppData\Local\Temp\xoasncemwr.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\CLAIRE\AppData\Local\Temp\ejeny.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\CLAIRE\AppData\Local\Temp\pshul.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\Users\CLAIRE\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\CLAIRE\AppData\Local\epuqomic.dll (Trojan.Agent.U) -> Delete on reboot.

The_Grandmaster

Please restart computer and run hijack this log as instructed by alienRIK.

aliEnRIK

aliEnRIK wrote: »

If anything was found then do the exact same but run a FULL scan

as above please

chardonnay_2

currently doing the full scan on malwarebytes, but now the computer won't connect to the internet anymore - it's not the same problem as last time.

aliEnRIK

After the scan, reboot and hopefully itll work