[lulolias]

hello guys.

i posted on another forum about my virus. it is redirecting me to spam websites on all my browsers.
they told me to malwarebytes and superantyspyware in safe mode. i did that, but after my interent wouldnt work anymore. it is so depressing.
i have a netbook acer aspire one and i downloaded the network serves again from another computer>put them on a usb stick and onto my netbook. that didnt do anything.
then the dhcp client didnt start up...so i feixed that and now its working 100% fine...still interent wont work.
i have been trying to gte help for 6 days now...and i just get occasional answers and i am so desperate...i am a traveller in australia and supposed to leave in a few days but need my interent coz otheriwse i wont have any there for months. so thats why i m here...i thought maube u guys could help me. i have msn too if thats quicker..just et me know.
oh and after i transfered all that stuff via usb..my friends computer stopped working too and her internet isnt working at all...its a bit different tho, coz my computer still shiows all the wireless available arround me and the one i want to connect to..but it just says not connected on on. my friends computer cant find any wireless at all.
i m in abn internetcafe now since all the computers r broken lol...so maybe we can try to fix my netbook and then hers of possible.

http://s1125.photobu...l581/_AnnyWay_/
this shows the scan log

thanks in advance guys..i honetsly appreciate every bit of help

Edited by lulolias, 19 May 2011 - 08:05 PM.

[Advertisements]

What usually happens is the malware sets up a proxy on your computer. Then it forces IE or Firefox to send all traffic going to the internet to the proxy. Since it's a malware proxy it picks and chooses what goes to the internet and keeps you from going to certain anti-malware sites and perhaps sends copies of interesting traffic like passwords and credit cards to another address for harvesting. MBAM or your anti-malware software knows the proxy software is malware so removes it but doesn't realize that it's also a proxy so doesn't change the proxy settings on IE and FF. So now IE or Firefox still sends traffic to the proxy but there is no proxy so it doesn't go anywhere and you have lost connectivity to the internet.

To fix it:

In IE, Tools, Internet Options, Connections, LAN Settings, then uncheck all boxes and OK. Close IE and restart IE.

In FireFox, Tools, Options, Advanced, Settings, check No Proxy then OK. Close Firefox and restart Firefox.

In Chrome, Wrench, Options, Under the Hood, Change Proxy Settings, uncheck all boxes, OK.


Any better? If so follow the guidelines in the top post of the Malware Removal forum
http://www.geekstogo...uide-t2852.html
and post your logs. If not let me know and we will try a few other things.

If that doesn't help then:
Start, All Programs, Accessories, Command Prompt. (Vista or Win 7 => right click and Run As Administrator) Type with an Enter after each line in the code box:

ipconfig  /flushdns

netsh  winsock  reset  catalog

netsh  int  ip  reset  reset.log

(I use two spaces in the code box so you will be sure to see where 1 space goes.)

Reboot and test. If it still doesn't work:

1. Click "Start," click "Control Panel," click "Network and Internet Connections," and then click "Network Connections."
2. Right-click the network connection that you want to configure (the one you use to connect to the Internet), and then click Properties.
3. On the General tab (for a local area connection), or the Networking tab (for all other connections), click "Internet Protocol (TCP/IP)", and then click "Properties."

4. Click "Use the following DNS server addresses," and then type 8.8.8.8 in the Preferred DNS server and 4.2.2.1 in the Alternate DNS server boxes.

5. Click "OK"

Reboot and test. If it still doesn't work:

(Start) Right click on My Computer, select Manage then Device Manager. Find the Network Adapters and click on the + in front to open up the sub entries. Right click on each sun-entry under Network Adapters and Uninstall. (Doesn't hurt to write down the names in case you need to download the drivers from the PC Maker's website. Normally you don't but with malware you never know.) Reboot and test.

Ron

[RKinner]

What usually happens is the malware sets up a proxy on your computer. Then it forces IE or Firefox to send all traffic going to the internet to the proxy. Since it's a malware proxy it picks and chooses what goes to the internet and keeps you from going to certain anti-malware sites and perhaps sends copies of interesting traffic like passwords and credit cards to another address for harvesting. MBAM or your anti-malware software knows the proxy software is malware so removes it but doesn't realize that it's also a proxy so doesn't change the proxy settings on IE and FF. So now IE or Firefox still sends traffic to the proxy but there is no proxy so it doesn't go anywhere and you have lost connectivity to the internet.

To fix it:

In IE, Tools, Internet Options, Connections, LAN Settings, then uncheck all boxes and OK. Close IE and restart IE.

In FireFox, Tools, Options, Advanced, Settings, check No Proxy then OK. Close Firefox and restart Firefox.

In Chrome, Wrench, Options, Under the Hood, Change Proxy Settings, uncheck all boxes, OK.


Any better? If so follow the guidelines in the top post of the Malware Removal forum
http://www.geekstogo...uide-t2852.html
and post your logs. If not let me know and we will try a few other things.

If that doesn't help then:
Start, All Programs, Accessories, Command Prompt. (Vista or Win 7 => right click and Run As Administrator) Type with an Enter after each line in the code box:

ipconfig  /flushdns

netsh  winsock  reset  catalog

netsh  int  ip  reset  reset.log

(I use two spaces in the code box so you will be sure to see where 1 space goes.)

Reboot and test. If it still doesn't work:

1. Click "Start," click "Control Panel," click "Network and Internet Connections," and then click "Network Connections."
2. Right-click the network connection that you want to configure (the one you use to connect to the Internet), and then click Properties.
3. On the General tab (for a local area connection), or the Networking tab (for all other connections), click "Internet Protocol (TCP/IP)", and then click "Properties."

4. Click "Use the following DNS server addresses," and then type 8.8.8.8 in the Preferred DNS server and 4.2.2.1 in the Alternate DNS server boxes.

5. Click "OK"

Reboot and test. If it still doesn't work:

(Start) Right click on My Computer, select Manage then Device Manager. Find the Network Adapters and click on the + in front to open up the sub entries. Right click on each sun-entry under Network Adapters and Uninstall. (Doesn't hurt to write down the names in case you need to download the drivers from the PC Maker's website. Normally you don't but with malware you never know.) Reboot and test.

Ron

[lulolias]

thanks for ur reply ron i appreciate it:)

well my internet is working again..thanks mate:)

someone else just told me tho, that i have a virut infection:( do u think thats true? he said on the 1 and 12 picture of my log u can see that.
the only way to completly remove that is to reinstall the os, right?

the thing is....i have two computers here, a acer aspire one netbook and a sony vgc-js25g...the acer has a virut as far as i know so far..and i am pretty sure the sony has too since they have been using the same usb sticks and after running malwarebytes and antispy i found hepas on that one too...so just to be sure i want to clean it up too (it aslo takes 30min to even turn on)....
>>>so i have two infected computers, i have 2 infected usb sticks...i have no windows cds sadly....but i just bought a new usb stick and a external harddrive that r both clean.
>>>i now want to restore and reinstall the os on both...i want to back up my data with the new external harddrive which will be just phtos, documents and music..no sofware
>>>i have decided to install linux on my netbook since i am sick of viruses and i always wanted to try it anyways:)

now: i have no clue how to go about this....since i dont know how to back up my data because i am scared it will save a virus onto that as well and then after i restored everything it will just get infected again.
how do i go about that?
after that is done i have do put windows on the sony...i cant burn a windows cd tho since i dont have a clean computer to do so...how can i go about that.
then i want to put linux on my netbook...i just have to download it onto a usb stick to do that...but then again: will it also save the virus?? and i know it wont harm my linux in the future, but it can harm my otehr computer again since i am always transfering data.
after that is all done i want to put my data back onto the computers and please without viruses.

do u maybe have a step by step to do plan that would work out for me? i appreciate any help very much i am not stupid with computers, but this just goes far out of my knowledge...and i reallly wanna do it save...since i just bught a clean hard drive and everyhting and want to be all clean...

i know this is a lot of stuff...but i will appreciate ur help very much thanks mate

[RKinner]

If it is virut try the AVG Rescue CD on USB:

http://www.pendrivea...rus-rescue-usb/

If you can get it to boot from the USB it can tell you if it is virut or not. Of course it would help if you could create the USB on a clean computer.

Combofix will also tell you if it thinks you have virut:


ComboFix

You must first uninstall AVG if you have it on the computer before running Combofix then download and run the AVG removal tool.
http://download.avg....6_2011_1322.exe

:!: If you have a previous version of Combofix.exe, delete it and download a fresh copy. :!:

:!: It must be saved to your desktop, do not run it :!:

:!: IF you didn't have AVG then disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Save this file -- to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

XP: Double click on Combofix to start the program.
Vista or Win 7: Rightclick on Combofix and select Run As Administrator to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix. Allow it to install the Recovery Console then Continue. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.


A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.


Download OTL from
http://www.geekstogo...timers-list-it/
and Save it to your desktop.

Run OTL (Vista or Win 7 => right click and Run As Administrator)

select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.

Ron