[Render]

Please reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labelled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).

[Advertisements]

Thanks Render.

I had to reset, reboot and plug-in virgin details a few times as the network connection was unstable. The IP address shown on cmd.exe was different to the ip picked by comodo firewall on Lan. Strange. The previous problems such as (1) ability to ping an address on cmd.exe, (2) browse on blackberry (wireless connected to router/virgin). (3) frequent dropping of network connection on the tray, (4) very slow loading of pages on the browsers including www.google.com/co.uk, and (5) slow loading/login of real-time 64 bit applications remained the same. I finally, closed down everything, waited for a while and started all over again. This time, all left to default. Router is configured at default to pick dynamically assigned IP/DNS (which was the case 5 weeks before all problems started) addresses. Unfortunately, there is no change in any of the symptoms described above. May be, we need to leave it for a day and observe the situation. I would be enabling Wireless some time today. One thing that I find it strage is Vigor 2820Vn does not like LAN >> General Setup - manual setting of DNS server IP address and click force DNS manual settings. I wanted to use Open DNS, which I believe is excellent.

Regards,
Sundar

Edited by SSri09, 17 November 2011 - 07:45 AM.

[SSri09]

Thanks Render.

I had to reset, reboot and plug-in virgin details a few times as the network connection was unstable. The IP address shown on cmd.exe was different to the ip picked by comodo firewall on Lan. Strange. The previous problems such as (1) ability to ping an address on cmd.exe, (2) browse on blackberry (wireless connected to router/virgin). (3) frequent dropping of network connection on the tray, (4) very slow loading of pages on the browsers including www.google.com/co.uk, and (5) slow loading/login of real-time 64 bit applications remained the same. I finally, closed down everything, waited for a while and started all over again. This time, all left to default. Router is configured at default to pick dynamically assigned IP/DNS (which was the case 5 weeks before all problems started) addresses. Unfortunately, there is no change in any of the symptoms described above. May be, we need to leave it for a day and observe the situation. I would be enabling Wireless some time today. One thing that I find it strage is Vigor 2820Vn does not like LAN >> General Setup - manual setting of DNS server IP address and click force DNS manual settings. I wanted to use Open DNS, which I believe is excellent.

Regards,
Sundar

Edited by SSri09, 17 November 2011 - 07:45 AM.

[Render]

Please try to connect your computer directly to cable modem with UTP cable. See if that solve the problem.

[SSri09]

Thanks Render!

I ran into huge problems configuring the router once again. Suddenly all connections dropped. I was not even able to get in to the router home page. I turned off the public network and Lan cards are supposed to use home/work network. It was going all the time to public network. The IP address (vigor DHCP starts with a default *.*.1.10 with 255.255.255.0 subnet mask) on ipconfig/all was *1.10. The comodo firewall was showing a strange 169.*.184.198. At times the comodo would pick this as a LAN network address, while ipconfig /all would show a completely different address. I wonder whether the router has been hacked or corrupted completely.

I have already connected the virgin cable directly on the desktop with a default IPV4 settings, after uninstalling comodo and enabling windows firewall (not ideal as I think the third party ones are far better). There is no difference. Everything is slow, takes time and the network does drop on and off. I would observe for a few hours this afternoon and post again. As I write, the network connection has dropped a few times, has come right back up and is down again. The real time market data application has turned yellow, meaning a lost connection.

I wonder something nasty / regenerating stuff is hiding somewhere.

Is that those registry?

FYI, under hkcu/software/ms/win/current version/shell extension. it has two sub keys...(1) .../approved/ that has 1 default key (reg_sz)..value not set and 4 for ZA shell extension (IDrive online backup keys)...if we click that /approved, it shows the registries shown by GMER. Regedit shows an error preventing from opening. File not found. (2) a lot of cached keys.

Thanks,
SSri

[Render]

OK. As our tools can't find any malware (those registry entries are legit) I would recommend you to backup of your valuable data and then fresh OS reinstall.

[SSri09]

Thanks Render!

That's sad as reinstall is going to kill me! I have called Virgin Media with a request to swap the modem. Please keep the post active. I will post feedback after hearing from Virgin Media, who is getting an engineer out here probably tomorrow.

Please advise the following questions:

(1) Is it safe to import Firefox, chrome, IE profiles after reinstall? I have far too many bookmarks to regenerate on all of them.
(2) I am not very happy with windows firewall. Would you recommend Comodo or Online Armour?
(3) MSE is fine. But I feel others are better. I do not mind a paid one as it is pretty cheap by subscription. Which one Avira or Avast or AVG? I heard Avira pests with ads and ask toolbars
(4) I am considering a realtime protection. Is it MBAM realtime or Spyware Guard real time?

(5) I have a free version of key scrambler. I heard Zemana antilogger is excellent, although it is a paid version. Is it fine to have them running along with antivirus and a realtiime malware. Their website says it would run fine with these applications. http://zemana.com/An...bility.aspx#tab

Finally, the laptop is also experiencing similar issues with GMER showing different rootkit logs. could I post them now while awaiting a resolution of the desktop slowdown? Could you please help me with the laptop?

It is a pity that the internet problems remain unsorted. Many thanks for your help, which is greatly appreciated. You guys rock.

Best,
SSri

[Render]

I forgot to mention that I assume that with your network equipment is everything OK. So we will wait for your ISP's technician. I will answer your questions soon after my dinner.

[SSri09]

I changed the Ethernet cable to the second gigabit port. the result is same. The device manager shows that network cards are working okey. Most of the time the connection is fine to the PC as I could ping an address from cmd.exe. if the network card is the problem, the motherboard needs to be replaced! Blimey, that's going to cost me as the desktop is just outside the 3 year. The browsing and real time connection of market data is the issue. So, there is something between the net connection to the PC and the applications. I have called out an engineer from Virgin. Requested them to swap the modem. I hope they will swap.

thanks

[Render]

Here are the answers to your questions:

Is it safe to import Firefox, chrome, IE profiles after reinstall? I have far too many bookmarks to regenerate on all of them.

It is safe.

I am not very happy with windows firewall. Would you recommend Comodo or Online Armour?

I'm happy with Windows Firewall. I don't like neither of those third party firewalls. All my computers are behind the router which have enabled hardware firewall. Your Vigor router has it also.

MSE is fine. But I feel others are better. I do not mind a paid one as it is pretty cheap by subscription. Which one Avira or Avast or AVG? I heard Avira pests with ads and ask toolbars

I'm very happy with MSE. Paid version of Avira is ads free as I know and it is good product. I would also recommend Avast. I don't like AVG (but this my personal opinion). If I have to choose from payable AV's my favourite product would be Kaspersky.

I am considering a realtime protection. Is it MBAM realtime or Spyware Guard real time?

I prefer MBAM. Payable version has a real-time scan module.

I have a free version of key scrambler. I heard Zemana antilogger is excellent, although it is a paid version. Is it fine to have them running along with antivirus and a realtiime malware. Their website says it would run fine with these applications.

I have no experience with anti-keyloggers as I don't need them. But yes. You can use them along with the other security programs if you wish.

Finally, the laptop is also experiencing similar issues with GMER showing different rootkit logs. could I post them now while awaiting a resolution of the desktop slowdown? Could you please help me with the laptop?

No problem. Please post GMER log of that mentioned laptop.

[SSri09]

Thanks again Render for your great support and help.

MSE: Happy with that. It is nagging me with "not run AV for a while" despite running it daily. Several installs did not help. Kaspersky is good but pretty heavy on resources. Not sure paid version of Avira or Kaspersky is worth it. It is an individual choice really.

Windows Firewall: Works nicely with MSE. But I have to manually permission the applications (outgoing and incoming). I do not know the ports per application that need to be opened. If you have a configured firewall (windows), it will help as a guide. I did enable hardware firewall (default only. I did not manually configure for all incoming and outgoing in Vigor.

Desktop: I will post the details after the engineer's visit. I do not think the issue is with the Lan Card. Device manager shows it is working properly.

Laptop logs and Problems All problems outlined in the case of desktop apply to laptop as well, except that browsing is faster than desktop as it has an i7 950 with 12 GB triple channel memory. But by the previous laptop benchmark, it has slowed down with no internet access regularly. The wireless shows a steady connection though. When laptop suffers internet access issues, blackberry is seemlessly connected and can be browsed! Something fishy out there. TDS Killer did not pick any virus. Virus Removal Tool picked up similar backdoor trojan in ZoneAlarm Internet Security Setup.exe and Net Tools 5.0. I allowed them to be deleted as I do not use them.

I doubt if you would pick up any infections with these attached logs. I am producing GMER and aswMBR.txt logs. The OTL logs, Combo-Fix log, and MBR.dat are attached. Please advise if you want me to paste these txt files as posts.

Thanks for your help again.

SSri

GMER LOGS OF LAPTOP

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-15 16:10:17
Windows 6.1.7601 Service Pack 1
Running: gmer.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060359f9f
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060359f9f (not active ControlSet)

---- EOF - GMER 1.0.15 ----

aswMBR log of laptop - ran in normal mode

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-17 21:06:12
-----------------------------
21:06:12.945 OS Version: Windows x64 6.1.7601 Service Pack 1
21:06:12.945 Number of processors: 8 586 0x1A05
21:06:12.945 ComputerName: KOBALT UserName: User
21:06:14.364 Initialize success
21:12:48.019 AVAST engine defs: 11111702
21:14:09.502 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:14:09.502 Disk 0 Vendor: ST950056 SD23 Size: 476940MB BusType: 3
21:14:09.518 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2
21:14:09.518 Disk 1 Vendor: ST950056 SD23 Size: 476940MB BusType: 3
21:14:09.518 Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Ide\IAAStorageDevice-3
21:14:09.518 Disk 2 Vendor: ST950056 SD23 Size: 476940MB BusType: 3
21:14:09.533 Disk 2 MBR read successfully
21:14:09.533 Disk 2 MBR scan
21:14:09.533 Disk 2 Windows 7 default MBR code
21:14:09.533 Service scanning
21:14:10.126 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
21:14:10.157 Service pxkbf C:\Windows\System32\drivers\pxkbf.sys **LOCKED** 32
21:14:10.157 Service pxscan C:\Windows\System32\drivers\pxscan.sys **LOCKED** 32
21:14:10.750 Modules scanning
21:14:10.750 Disk 2 trace - called modules:
21:14:10.766 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:14:10.766 1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa800ae94060]
21:14:10.781 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-3[0xfffffa800ab88050]
21:14:11.624 AVAST engine scan C:\Windows
21:14:12.934 AVAST engine scan C:\Windows\system32
21:15:06.005 AVAST engine scan C:\Windows\system32\drivers
21:15:10.607 AVAST engine scan C:\Users\User
21:15:35.614 AVAST engine scan C:\ProgramData
21:15:50.185 Scan finished successfully
21:17:12.958 Disk 2 MBR has been saved successfully to "C:\Users\User\Desktop\GEEKSTG\MBR.dat"
21:17:12.958 The log file has been saved successfully to "C:\Users\User\Desktop\GEEKSTG\aswMBR.txt"

Attached Files

•  Combo-Fix.txt   18.61KB   104 downloads
•  OTL_171111.Txt   106.62KB   100 downloads
•  MBR.zip   1.04KB   84 downloads
•  Extras_171111.Txt   52.95KB   140 downloads

[Render]

These logs from your laptop looks perfectly clean. It looks like something is wrong with your internet line or devices (modem or router).

[SSri09]

Many Thanks Render.

Clean logs did not surprise me as I thought of it after your examination of the desktop logs. This is good; I am happy that I had been a sensible browser (hopefully) since the infection the same time last year. That was the first time I had my system infected in 10 years.

Now the good part!

The ISP engineer visited this PM; poor fella he had a pretty tough time. He swapped the model. Touch wood, the sloowww browser issue disappeared. It is behaving well and has not disconnected so far. I will post an update after testing the laptop and the desktop through the router and ascertaining the connections in the next couple of days.

Thank you so much for your kind help!!!

You guys Rock

Best,
SSri

[Render]

Your logs shows that your system is clean. If you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

Removing the tools we used:

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now copy/paste this: ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /Uninstall, it needs to be there.
  

  

• Please follow the prompts to uninstall Combofix.
• This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

NEXT...

OTL Clean-Up:

• Reopen on your desktop.
• Click on
• You will be prompted to reboot your system. Please do so.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.


There are a few things I recommend you to do once your computer is completely clean:

Updates for Windows - One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically.

How to turn on Automatic Updates for Windows:

• Windows XP
• Windows Vista
• Windows 7

Updates for other installed software

A common attack method for hacking attempts and malware installs is to exploit known vulnerabilities in programs that are commonly installed on a person's computer. These vulnerabilities could allow a remote user or malware developer to install malware, keyloggers, and backdoors on to your computer without your knowledge or permission.
Some of the programs that are commonly exploited include Adobe Shockwave, Adobe Reader, Sun Java, Adobe Flash, and even Windows itself. Therefore it is crucial that everyone remain vigilant as to when a security vulnerability is found in our installed programs and to update it when a security update is released. Unfortunately, no one has the time to stay on top of these updates, which can happen frequently.

I highly recommend you to install Secunia Personal Software Inspector (PSI) that can be used to scan your computer for known vulnerable programs, provide information on the vulnerability, and provide a location to an update for the vulnerable program. A tutorial on how to use Secunia Personal Software Inspector (PSI) can be found here: Keep Software Updated with Secunia PSI.

Web Browsers - Picking the right internet browser is very important. You need to find one that suits your needs but that is also safe. All browsers listed below are far more secure than Internet Explorer, immune to almost all known browser hijackers, and also have the best built-in pop up blockers.

• Mozilla Firefox
• Opera
• Chrome

Although, if you prefer staying with Internet Explorer I highly recommend you do this :

Make Internet Explorer more secure:

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the options Download signed and unsigned ActiveX controls to Prompt, and Initialize and Script ActiveX controls not marked as safe to Disable.
• Next click OK, then Apply button and then OK to exit the Internet Properties page.

Tips to protect yourself against malware and reduce the potential for re-infection:

• Simple and easy ways to keep your computer safe.
• Hardening Windows Security - Part 1 & Part 2.
• Your Guide To Staying Safe Online.
• Use Task Manager to close pop-up messages to safely exit malware attacks.
• How to Secure Your Web Browser.

Now after all these steps, your PC will be more secure. However it is important to note that you can still get infected if you are not careful. One of the best security programs you can have is common sense. As malware gets more sophisticated, you need to be more wary. If you do get caught though and the above steps can't help prevent it, we will be here to help you out.

Stay secure and thank you for choosing GeeksToGo.

[SSri09]

Thanks once again for your help! Uninstall completed. I will go through your recommendations during the week.

The internet is pretty fast but it did go down once today, which might be an outage or the router requiring a reboot (unless the router needs replacing! or a reinstall as a last resort to kill any left overs in the system, which I really doubt it). Hopefully, I do not have to go down these routes.

Thanks Render.

[Render]

You are welcome and let me know if you have any other questions.