[Event3horizon]

I'm trying to help my friend running Vista and an HP PC.

He caught a virus/worm from limewire and i can't remember the exact name but it was from a file named mp3[1].exe and soon after he downloaded it his trend micro antivirus popped up saying that it detected a virus but when he tried to quarantine it, the program simply says its unable to do that. We then ran a full scan with trend micro and it didn't detect anything!

We then decided to do a file search for the name of the file he downloaded and the executable with the virus and found it and deleted it. We thought the issue was gone.

Now, after a week, the trojan has seemed to manifest itself in the form of corrupting my internet access. Its amazing. IE 7 nor Firefox connect to a site and simply say "connecting to ... " and never connects. Whats most weird is, the ONLY website i can connect to is google.com in both browsers and everything google. Here is what t/s we have done:

1) ran full trend micro and spysweeper scans and nogo
2) safe mode w/networking nogo
3) was able to ping www.yahoo.com in command prompt with no problem
4) inputting for example yahoo's IP address directly into the browser and still nogo (not DNS) issue
5) Unable to receive POP mail from POP mail server through windows mail
6) ran sfc /scannow and no issues detected
7) reset ie 7 web settings nogo
8) checked hosts file for any suspicious information and nothing found

So I am simply stumped here. Our goal of course is not to do an OSRI, which will probably work. So i know its not my internet connection based on the troubleshooting we have done. We have to start thinking like hackers to solve this i dont have that knowledge. What files/things does one have to change internally in Vista in order to kill the web access??

I appreciate all relies in advance. Any ideas, thank you.

[Event3horizon]

i guess yall are stumped too eh?

[managed]

I would post a HijackThis log in the Malware section here :- http://forums.techguy.org/54-malware...jackthis-logs/

[Event3horizon]

Originally Posted by managed

I would post a HijackThis log in the Malware section here :- http://forums.techguy.org/54-malware...jackthis-logs/

Ok i was thinking about hijackthis but theres no way to directly get it on the computer, obviously the browsers are shot.

I can try FTP through the command prompt or i can tell my friend to try to transfer it from another computer. Thanks for the info.

[managed]

You could burn the HijackThis EXE download onto a CD and install from that.

[Rich-M]

Try this:
http://www.mydigitallife.info/2007/0...og-corruption/