Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Virus & Other Malware Removal Virus & Other Malware Removal
Search Search
Search for:
Tech Support Guy > > >

Internet won't work after removing viruses

(In Progress)
(!)

roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
25-Dec-2011, 12:26 PM #1
Unhappy Internet won't work after removing viruses
Hello, just a few days ago, i had some issues with some viruses that infected computer. During that time, i was able to connect to the Internet (although slow due to the viruses) and was able to download SuperAntiSpyware to remove these viruses. But after SAS apparently removed these viruses and rebooted my computer, these viruses seemingly managed to return somehow. After a couple more tries to remove them, i was finally successful. But, when i logged back on and tried to use the Internet, both IE and FireFox were unusable. The error "Server not found" is what i see each time i try to connect to the Internet. The odd part is: i'm connected to the Internet and my other wireless devices receive wifi except my computer. My worry is that the anticirus may have deleted something important along with the virus, that allowed me Internet connection. Mind you i can not use any Internet whatsoever. So downloading any program to help me, might be practically impossible. I've already read other threads concerning this issue and none have helped. I've checked that the settings on my Internet are on no proxy. If anyone can help me it would be much appreciated. Thanks.
Elvandil's Avatar
Computer Specs
Moderator with 51,993 posts.
 
Join Date: Aug 2003
Location: Vermont
Experience: "Been through the mill."
25-Dec-2011, 12:37 PM #2
Since you have IE, I assume you are running some version of Windows. They vary somewhat is how they implement networking.
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
25-Dec-2011, 12:46 PM #3
Well it's hard to tell since i can't use my Internet at all on my computer. So far i've tried number of methods to resolve this issue, but i haven't had any luck so far.
Cookiegal's Avatar
Administrator & Malware Removal Specialist with 96,881 posts.
 
Join Date: Aug 2003
25-Dec-2011, 04:37 PM #4
The programs likely removed a driver and/or registry keys needed to connect and I doubt the machine is clean yet.

You will need to transfer some small tools/programs to the infected computer via USB flash drive.

Please download Farbar Service Scanner and transfer it to the desktop of the computer with the issue.
  • Make sure only the following option is checked:
    • Internet Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run (which should be on the desktop.)
  • Please copy and paste the log to your reply.
__________________
Microsoft MVP - Consumer Security
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
25-Dec-2011, 09:22 PM #5
Quote:
Originally Posted by Cookiegal View Post
The programs likely removed a driver and/or registry keys needed to connect and I doubt the machine is clean yet.

You will need to transfer some small tools/programs to the infected computer via USB flash drive.

Please download Farbar Service Scanner and transfer it to the desktop of the computer with the issue.
  • Make sure only the following option is checked:
    • Internet Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run (which should be on the desktop.)
  • Please copy and paste the log to your reply.
Alright, sorry if i'm a tad bit late with posting the log, i just have to make an arrangement with a friend to use her computer. I'll post that log ASAP.
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
27-Dec-2011, 12:53 PM #6
Quote:
Originally Posted by Cookiegal View Post
The programs likely removed a driver and/or registry keys needed to connect and I doubt the machine is clean yet.

You will need to transfer some small tools/programs to the infected computer via USB flash drive.

Please download Farbar Service Scanner and transfer it to the desktop of the computer with the issue.
  • Make sure only the following option is checked:
    • Internet Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run (which should be on the desktop.)
  • Please copy and paste the log to your reply.
Alright, i've got the USB and everything. How do i transfer the program to my USB? Sorry for being such a newbie at this, haha.
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
27-Dec-2011, 01:24 PM #7
Quote:
Originally Posted by Cookiegal View Post
The programs likely removed a driver and/or registry keys needed to connect and I doubt the machine is clean yet.

You will need to transfer some small tools/programs to the infected computer via USB flash drive.

Please download Farbar Service Scanner and transfer it to the desktop of the computer with the issue.
  • Make sure only the following option is checked:
    • Internet Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run (which should be on the desktop.)
  • Please copy and paste the log to your reply.
As ordered:
Farbar Service Scanner
Ran by christopher hichez (administrator) on 27-12-2011 at 12:16:36
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

Tcpip Service is not running. Checking service configuration:
The start type of Tcpip service is OK.
The ImagePath of Tcpip service is OK.

IpSec Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open IpSec registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open IpSec registry key. The service key does not exist.
Checking LEGACY_IpSec: Attention! Unable to open LEGACY_IpSec\0000 registry key. The key does not exist.


Connection Status:
==============
Localhost is blocked.
There is no connection to network.
Attempt to access Google IP returned error: Other errors
Attempt to access Yahoo IP returend error: Other errors


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
Attention! C:\WINDOWS\system32\Drivers\ipsec.sys is missing.
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(6) NetBT(5) PSched(7) Tcpip(3)
0x0700000004000000010000000200000003000000050000000600000007000000

**** End of log ****
Cookiegal's Avatar
Administrator & Malware Removal Specialist with 96,881 posts.
 
Join Date: Aug 2003
27-Dec-2011, 02:31 PM #8
We need to replace a file that's missing from the drivers folder with one from another location and also repair the registry so please do the following:

Please run Farbar Service Scanner again.

Type the following in the edit box after Search

ipsec.sys

Click the Search Files button and post the log (FSS.txt) it makes to your reply.
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
27-Dec-2011, 03:23 PM #9
Quote:
Originally Posted by Cookiegal View Post
We need to replace a file that's missing from the drivers folder with one from another location and also repair the registry so please do the following:

Please run Farbar Service Scanner again.

Type the following in the edit box after Search

ipsec.sys

Click the Search Files button and post the log (FSS.txt) it makes to your reply.
Here ya go:
Farbar Service Scanner
Ran by christopher hichez (administrator) on 27-12-2011 at 14:06:45
Microsoft Windows XP Service Pack 3 (X86)

************************************************
================== Search: "ipsec.sys" ===================

C:\WINDOWS\system32\dllcache\ipsec.sys
[2009-01-12 14:41] - [2008-04-13 14:19] - 0075264 ____A (Microsoft Corporation) 23C74D75E36E7158768DD63D92789A91

C:\WINDOWS\ServicePackFiles\i386\ipsec.sys
[2009-01-12 14:41] - [2008-04-13 14:19] - 0075264 ____N (Microsoft Corporation) 23C74D75E36E7158768DD63D92789A91

C:\WINDOWS\$NtServicePackUninstall$\ipsec.sys
[2009-01-17 11:24] - [2004-08-10 06:00] - 0074752 ____C (Microsoft Corporation) 64537AA5C003A6AFEEE1DF819062D0D1

C:\i386\ipsec.sys
[2009-01-13 03:34] - [2004-08-10 06:00] - 0074752 ____A (Microsoft Corporation) 64537AA5C003A6AFEEE1DF819062D0D1

====== End Of Search ======
Cookiegal's Avatar
Administrator & Malware Removal Specialist with 96,881 posts.
 
Join Date: Aug 2003
27-Dec-2011, 04:30 PM #10
Download the tools needed to a flash drive or other removable media, and transfer them to the infected computer.

***************************************************

Download ComboFix from one of these locations:

Link 1
Link 2


--------------------------------------------------------------------

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package.


---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------


Disable your anti-Virus and anti-spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.



  • Drag the setup package onto ComboFix.exe and drop it.
  • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.



  • At the next prompt, click 'Yes' to run the full ComboFix scan.
  • When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt in your next reply.
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
27-Dec-2011, 07:13 PM #11
Quote:
Originally Posted by Cookiegal View Post
Download the tools needed to a flash drive or other removable media, and transfer them to the infected computer.

***************************************************

Download ComboFix from one of these locations:

Link 1
Link 2


--------------------------------------------------------------------

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package.


---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------


Disable your anti-Virus and anti-spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.



  • Drag the setup package onto ComboFix.exe and drop it.
  • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.



  • At the next prompt, click 'Yes' to run the full ComboFix scan.
  • When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt in your next reply.

Quick question: I have service pack 3.. should i just go ahead and download service pack 2 or 1?
Cookiegal's Avatar
Administrator & Malware Removal Specialist with 96,881 posts.
 
Join Date: Aug 2003
27-Dec-2011, 07:16 PM #12
Service Pack 2.
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
27-Dec-2011, 07:28 PM #13
Okay so here's the issue: I don't know which one to download, because i can't determine whether my OS is home edition or professional. I've booted my computer up to see which edition i have, but i don't think it has any specific edition. Which one do you think i should download?
Cookiegal's Avatar
Administrator & Malware Removal Specialist with 96,881 posts.
 
Join Date: Aug 2003
27-Dec-2011, 07:39 PM #14
Right-click My Computer and select properties. What does it say there under System?
roxerz's Avatar
roxerz roxerz is offline
Computer Specs
Member with 41 posts.
THREAD STARTER
 
Join Date: Dec 2011
Experience: Beginner
27-Dec-2011, 07:44 PM #15
I have the Media Center Edition.
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


Tags
antivirus, internet, virus

(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑