1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Removed a virus and now no internet

Discussion in 'Virus & Other Malware Removal' started by anon1m0us, Dec 11, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9
    I removed a virus and now my internet is dead. If I do an IPCONFIG, nothing shows up, not even a 0.0.0.0.

    I cannot logoff the machine. It hangs.
    I cannot run Combofix, even when renaming it. It hangs. And I do not touch the mouse or the likes.

    I checked, and I do not have any regkey for Netbs.

    Help
     
  2. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    That would be NetBT. ;)

    Go to Start - Run and copy and paste the following:

    regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT"

    You won't see anything happen and it will only take a second. You will find the report it creates at C:\look.txt. Please open it in Notepad and then copy and paste the report here.
     
  3. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    Also, what programs did you run to try to remove the virus?

    Can you post any of the logs so I can see what was removed?
     
  4. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9
    Nope, nothing gets created. Like I said, that regkey does not exist.
     
  5. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9
    Here are the logs.

    I used Spybot, Superantispyware, avg, and everything else I can get my hands on.
     

    Attached Files:

  6. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    I'm sorry, I wanted to export the entire "services" key as I need to gather some information from another service in order to rebuild the NetBT key. So please export this one. It will be very large so please zip the file and upload it as an attachment.

    regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services"
     
  7. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9


    Here ya go. I had to zip it since it was large.
     

    Attached Files:

  8. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    Save the following to a USB device and transfer it to the infected computer. Then double-click the FixExe.reg file and allow it to merge into the registry.

    http://download.bleepingcomputer.com/reg/antivirus-vista-2010/FixExe.reg

    Then remove ComboFix that you already have by dragging it to the recycle bin.

    Download the tools needed to a flash drive or other removable media, and transfer them to the infected computer.

    ***************************************************

    Download ComboFix again from one of these locations:

    Link 1
    Link 2


    --------------------------------------------------------------------

    With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


    Go to Microsoft's website => http://support.microsoft.com/kb/310994

    Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

    Note: If you have SP3, use the SP2 package.


    ---------------------------------------------------------------------

    Transfer all files you just downloaded, to the desktop of the infected computer.

    --------------------------------------------------------------------


    Disable your anti-Virus and anti-spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.


    [​IMG]

    • Drag the setup package onto ComboFix.exe and drop it.
    • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.


      [​IMG]
    • At the next prompt, click 'Yes' to run the full ComboFix scan.
    • When the tool is finished, it will produce a report for you.
    Please post the C:\ComboFix.txt in your next reply.
     
  9. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9
    Combofix seems to be hanging.
     
  10. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    Download and run the following tool to help allow other programs to run. (Courtesy of BleepingComputer.com)
    There are 4 different versions. If one of them won't run then download and try to run the other one. Do not reboot after running this program.

    Vista and Win7 users need to right click and choose Run as Admin
    You only need to get one of them to run, not all of them.
    1. rkill.exe
    2. rkill.com
    3. rkill.scr
    4. rkill.pif


    Do NOT reboot the machine after running RKill. Try running ComboFix again please.
     
  11. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9
    Rkill.exe ran and found a virus. It was removed.

    I ran combofix and it found some additional things, and now it is hanging at "Preparing Log Report"--Do not run any programs until combofix has finished. This screen has been on for two hours. Seems like it is hanging again.

    thanks.
     
  12. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    Without closing ComboFix, try calling up the TaskManager (Ctrl-Alt-Del) and end task on any processes that start with "cf"xxx.exe. Then see if it will complete. If not, report back what processes are running Task Manager please.
     
  13. anon1m0us

    anon1m0us Thread Starter

    Joined:
    Jul 10, 2002
    Messages:
    9
    I can not bring up task manager. Mouse works, but nothing responds.
     
  14. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    Leave it for a bit longer please.
     
  15. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    115,774
    First Name:
    Karen
    OK, please try to close the blue DOS window.

    Then see if you can retrieve the combofix.txt log in the C:\ComboFix folder and post that here please.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1030819

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice