Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

TrojanDownloader:win32/Unruy.H


  • Please log in to reply

#31
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
I disabled Net.Tcp Port Sharing Service and rebooted but no change. The log you requested is below. I will now uninstall/install Microsoft.Net Framework 3.0.
Thank you,
Steven




reset SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{58585FA8-98F2-498E-B608-2040DE90B2D2}\NameServerList
old REG_MULTI_SZ =
<empty>

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{58585FA8-98F2-498E-B608-2040DE90B2D2}\NetbiosOptions
deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableProxy
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{231F8E8E-67D4-4EBC-AB76-7E4C860417E1}\IpAutoconfigurationAddress
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{231F8E8E-67D4-4EBC-AB76-7E4C860417E1}\IpAutoconfigurationMask
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{231F8E8E-67D4-4EBC-AB76-7E4C860417E1}\IpAutoconfigurationSeed
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{58585FA8-98F2-498E-B608-2040DE90B2D2}\NameServer
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer
reset Linkage\UpperBind for {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&1638C5CE&0&000. bad value was:
REG_MULTI_SZ =
PSched

reset Linkage\UpperBind for ROOT\MS_NDISWANIP\0000. bad value was:
REG_MULTI_SZ =
PSched

<completed>

<completed>
  • 0

Advertisements


#32
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
I uninstalled Microsoft.Net Framework 3.0.
  • 0

#33
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,031 posts
  • MVP
You will need to reinstall it and the newer versions too.
  • 0

#34
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
I am going to need more help with this. I have no idea what to install.
Thank you,
Steve
  • 0

#35
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
OK, I think I download everything that was needed.(??)
  • 0

#36
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,031 posts
  • MVP
So any luck with getting Net.Tcp Port Sharing Service or AFD to start?
  • 0

#37
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
I'm not sure what you are asking. I did mention that I disabled Net.Tcp Port Sharing Service. AFD to start? I still need to go to command prompt to get online.
Thank you,
Steven
  • 0

#38
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,031 posts
  • MVP
Right click on My Computer and select Manage then Device Manager. View, Show hidden Devices. In the right pane find Network Adapters.

Click on the + in front of Network Adapters then right click on each adapter and Uninstall. Reboot. XP should rediscover and reinstall each adapter.
  • 0

#39
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
This didn't work out very well. For all, but one, I got the message--Failed to uninstall the device. The device may be required to boot up the computer. I was able to uninstall my nividia nforce ethernet and upon reboot it did reinstall.
Thank you,
Steven
  • 0

#40
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,031 posts
  • MVP
Which one said -Failed to uninstall the device. The device may be required to boot up the computer?
  • 0

Advertisements


#41
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
direct parallel
nvidia nforce network controller-packet scheduler miniport
wan miniport (ip)
wan miniport (ip)- packet scheduler miniport
wan miniport (ip) (l2tp)
wan miniport (ip)(pppoe)
wan miniport (ip)(pptp)
  • 0

#42
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,031 posts
  • MVP
Let's try resetting the registry permissions to the defaults.

Download SubInACL.exe

http://www.microsoft...&displaylang=en

By default it installs the tool in C:\Program Files\Windows Resource Kits\Tools\

Please allow it to do so.


Download and Save the attached file, reset2.zip, right click on it and Extract all and copy the reset2.cmd file to C:\Program Files\Windows Resource Kits\Tools\.
Start, Run, cmd, OK Type with an Enter after the line:

reset2.cmd


Reboot and see if
net start afd

says it is running.

If not then the only thing I know to do now is to reinstall tcpip. Usually this works fine but I did have one case where it deleted OK but would not reinstall and we had to reload XP. That's why I now call for a registry backup before trying it.

Do you have the file:

C:\WINDOWS\inf\nettcpip.inf

IF so. Back up your registry:

http://pcsupport.abo...backupxpreg.htm

Then see if you can follow the steps in the Hardcore method when nothing else is working section on

http://smokeys.wordp...p3-tcpip-stack/
  • 0

#43
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
Start, Run, cmd, OK Type with an Enter after the line:reset2.cmd--got the following error--'reset2.cmd' is not recognized as an internal or external command, operable program or batch file.
  • 0

#44
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,031 posts
  • MVP
Try
cd  "\Program Files\Windows Resource Kits\Tools"

then

reset2.cmd

  • 0

#45
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
I ran the program.
net start afd is running.
Thank you,
Steven
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP