[Irissh]

I recently used malwarebytes and avira to remove the xp 2012 virus from my system. It removed the threats and also my internet capabilities. I have a strong connection according to my isp. I don't have access to a second computer and with no internet I'm not able to download your recommended scanning software. I know you may not be able to help without the log posted, but i thought you may have some suggestions for me? Tia! Iris

[Advertisements]

Hi, Iris! Welcome to GeeksToGo! My name is BlackOxide and I will be assisting you with your Malware/Security problems. Please make sure you read all of the instructions and fixes thoroughly before continuing with them. If you have any queries or you are unsure about anything, just say and I'll help you out


This could be a tricky one as we don't currently have a way of using any third party tools, but I'll see what I can do

Are you currently posting from a Mobile Phone or Tablet?


Could you also let me know the following information please, which will help me:

• What is the make and model of the PC? e.g Dell Dimension 5150
• What version of Windows are you currently running? e.g Windows XP, Windows Vista, Windows 7
• Do you have any Windows Installation Discs or Recovery Discs?

[BlackOxide]

Hi, Iris! Welcome to GeeksToGo! My name is BlackOxide and I will be assisting you with your Malware/Security problems. Please make sure you read all of the instructions and fixes thoroughly before continuing with them. If you have any queries or you are unsure about anything, just say and I'll help you out


This could be a tricky one as we don't currently have a way of using any third party tools, but I'll see what I can do

Are you currently posting from a Mobile Phone or Tablet?


Could you also let me know the following information please, which will help me:

• What is the make and model of the PC? e.g Dell Dimension 5150
• What version of Windows are you currently running? e.g Windows XP, Windows Vista, Windows 7
• Do you have any Windows Installation Discs or Recovery Discs?

[Irissh]

Thank you for responding! I'm at a total loss here.
I am posting using my cell. It's currently my only mean of accessing the internet.
My computer is an HP pavillion 061
The model is PC111A-ABA a645c
I use Windows XP and still have the installation disc.

[BlackOxide]

Thanks for the info. I have a sneaky suspicion this problem with the internet has been caused by something Avira has removed. It would be very helpful if you could have a look in Avira's Quarantine and let me know which files it has removed.

You can view the quarantine by opening Avira and click Administration on the left hand side, then click Quarantine.
You should now see a list of all the items Avira has quarantined. Could you have a look in here and get back to me with the filenames of any infections which are present there please. If there are several and it will take you a while to type them out individually, just get back to me with the end part of the filename. Please don't restore any items unless I say. I'll give an example below...





Here there is just one file in quarantine which is "D:\Softs\MyProg\MyPro.exe". If there are several in yours and it will take too long to type on your phone, just let me know the end part of the filename, which in this example would be "MyPro.exe".

[Irissh]

Makes sense!
They are pretty lengthy. Here are the ends. If you need more, let me know.

A0361262.sys
A0362329.sys
Jar_cache5051847135965854678.tmp
Jar_cache2897454068285587881.tmp
Drivers\afd.sys
A0360262.sys
Drivers\afd.sys
Drivers\afd.sys

[BlackOxide]

Excellent, thanks for that. Avira has indeed removed something that it shouldn't have

We are going to need to put the afd.sys file back in it's original folder. I know we are putting a possibly infected file back on, but we will deal with it once we get the internet back up and running.

If you can open Avira again and go to the Quarantine as before. They should be sorted in Date Order, so just pick the latest afd.sys file and Right Click on it. Again, referring to the picture above, you should get a menu appear where you will then need to click Restore object. This should put the file back in it's folder. If Avira tries to Quarantine or remove it again, see if you can tell it to ignore it please, as we need that file in order to try and get the internet running again.

Once you have restored it, reboot the PC and let me know whether the internet has returned or not.

[Irissh]

No luck.

[BlackOxide]

Ok no worries. In the list of files you mentioned earlier:

A0361262.sys
A0362329.sys
Jar_cache5051847135965854678.tmp
Jar_cache2897454068285587881.tmp
Drivers\afd.sys
A0360262.sys
Drivers\afd.sys
Drivers\afd.sys

There are three afd.sys files. In the Quarantine area again, can you look at the Source column for each of them and tell me if they are all C:\Windows\System32\Drivers\afd.sys. If any of them aren't, can you tell me what the full filename is please.


Could you also reset TCP/IP for me please. To do this you will need to follow the steps in the "Use a manual method to reset TCP/IP" section of this page. Once this has been done, reboot and try the internet again

[Irissh]

K. Reset is done, but no internet. All 3 if the quarantined files are the c: file you mentioned.

[BlackOxide]

Okey dokey, this is being a bit stubborn isn't it. However just lately there does seem to be quite a few broken connections caused by malware, but unfortunately they can vary and there isn't a single fix which works for all.

Before going any further, just a quick question, do you have any important Documents, Pictures, Music etc backed up. It shouldn't happen, but if your machine decides it doesn't want to boot, it's best to have things backed up. Also, if all options fail then it may come down to reinstalling Windows which means data on the Hard Drive would be removed. We're not there yet, but I wanted to just check.

[Irissh]

Well, it took some time, but my files are all backed up. Thanks for the forwarning! I'd hate to lose all my photos and videos! What should I do next?

[Irissh]

You know, I think the reset may not have worked. My computer says "the following command was not found: netsh int ip c:\resetlog.txt " did I do that wrong?

[BlackOxide]

Well, it took some time, but my files are all backed up. Thanks for the forwarning! I'd hate to lose all my photos and videos!

Excellent. It's always worth having a backup just in case, as computers can be unpredictable at times

You know, I think the reset may not have worked. My computer says "the following command was not found: netsh int ip c:\resetlog.txt " did I do that wrong?

It looks like you missed out the reset when typing the command. It should be netsh int ip reset c:\resetlog.txt. Just try it again and hopefully it should work this time

If the command goes through ok and you reboot the PC and the internet is still not working, we will try a System Restore. Now again, this may put some of the infections back on, but we will deal with those later on if needed.


Basically System Restore will restore your PC back to an earlier point in time. You won't lose any personal data such as Documents, Pictures, Music etc. It mainly focuses on System settings and the registry. You will need to choose any date when you know you had internet access. Hopefully restoring it back to a time when you had internet, may just restore it for us. The steps below will guide you through running System Restore on XP...


System Restore
Click Start > All Programs > Accessories > System Tools > System Restore
Make sure Restore My Computer to an earlier time is selected, then click Next
Use the Calendar on the left to select a date before the problem appeared
Click on your chosen date, then click Next and then Next again to start the Restore
Your PC will reboot by itself to do the System Restore.

[Irissh]

D'oh! I can see where that missing "reset" might cause a problem. I tried again, but with no luck.
I tried the system reset and am only being allowed to pick todays and yesterdays dates. When I checked settings, it says the very minimal amount of disc usage is being allowed. Could that be the reason its not letting me choose an earlier date?

[BlackOxide]

Hmmm, we don't seem to be having much luck here do we. We'll keep trying though

When I checked settings, it says the very minimal amount of disc usage is being allowed. Could that be the reason its not letting me choose an earlier date?

Yep, that does sound like the reason why it can't be restored to an earlier time than those dates.


Couple of quick questions for you...

• Is the Windows installation disc you have, a Microsoft one (XP discs were usually holographic and orange colour), or is it a HP Reinstallation CD? Would you mind just reading out what it says on the disc, for example "Windows Reinstallation CD" "HP Recovery Media" etc.
• I know you did mention this at the start but I'll just clarify it with you. Am I correct in thinking you aren't able to use another PC or Laptop etc anywhere else that you could download any tools onto a CD or USB stick etc?

Thanks