no internet after virus removal

Discussion in 'Windows - Virus and spyware problems' started by odell1980, Nov 28, 2008.

  1. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    I did not see the answer to my problem in any of the posts on the previous couple of pages. I recently ran into some issues with my internet. After a few hours on the phone with Microsoft. I was assured that all viruses and spyware had been removed from my system. Then I noticed that my browser would no longer connect to the internet. I have a strong signal. I am even able to ping an IP. I had a tech come out from Road Runner and he said that everything seemed to be working fine but he didn't know what the problem was. I have repaired the network connection, flushed the dns and renewed it. I have released the IP and renewed it. The tech went a little further renewing the winsock and something like the ntshe(not really sure what those are, but it didn't work any way. Also, I do not have any firewalls or antivirus software on my computer. (I was going to install it, but I have no internet to download it.) I also tried to run the Hijackthis.exe file, but it does not seem to work in safe mode. I would greatly appreciate it if someone could help me.
     
  2. cdavfrew

    cdavfrew Regular member

    Joined:
    May 19, 2008
    Messages:
    1,183
    Likes Received:
    0
    Trophy Points:
    46
    Hi odell1980

    Please run HijackThis in normal mode. Follow these instructions:

    Rename HijackThis(.exe) to scanner(.exe).

    Next, run scanner(.exe). A window will pop up.

    • Click on the button which says Main Menu, then Do a system scan and save a logfile.
    • Please wait for the scan to be completed.
    • After the scan has completed, a text window will pop up. Please post the contents of this window here.

    This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved.

    NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer.

    Best Regards :D
     
  3. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    Thanks, here is the Hijack this log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:26:57 AM, on 12/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\msiexec.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WinZip\WINZIP32.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [NIS] "C:\Documents and Settings\Ben\Local Settings\Temp\IXP000.TMP\NIS2009_16.0.0.125_OEM90.exe" /RELAUNCH /RUNONCE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    O22 - SharedTaskScheduler: lke3iemrl490kgfgdsfd - {C5AF42A3-94F3-42BD-F434-3604832C897D} - (no file)
    O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll (file missing)
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

    --
    End of file - 3027 bytes
     
  4. cdavfrew

    cdavfrew Regular member

    Joined:
    May 19, 2008
    Messages:
    1,183
    Likes Received:
    0
    Trophy Points:
    46
    Hey odell1980

    Hmm... that's odd. I was expecting something else from your HijackThis log.

    Please run HijackThis.

    • Click on the button which says Main Menu, then Do a system scan only.
    • Please wait for the scan to be completed.
    • After the scan has completed, check the following entries.

    Code:
    O22 - SharedTaskScheduler: lke3iemrl490kgfgdsfd - {C5AF42A3-94F3-42BD-F434-3604832C897D} - (no file) 
    O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\jsne87fidgf.dll (file missing)
    Click on the button Fix checked

    NOTE:: Close all browsers before fixing anything.


    You may want to try this tool to fix your internet problem: Advanced SystemCare Free.

    Best Regards :D
     
  5. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    Deleting those two files and the software did not fix my problem.
    Here is a new Hijack This log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:50:59 PM, on 12/1/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

    --
    End of file - 2527 bytes
     
  6. cdavfrew

    cdavfrew Regular member

    Joined:
    May 19, 2008
    Messages:
    1,183
    Likes Received:
    0
    Trophy Points:
    46
    Hi odell1980

    So it's not a winsock problem, dns problem, ISP problem..... can I assume that it's a browser problem?

    Can you try a different browser other than Internet Explorer? How about Firefox or TheWorld?

    Firefox is the popular choice, but it is indeed a little heavy on disk space. TheWorld browser is perhaps the best browser to use for testing; it is small and takes up little space. It can be found here: http://www.ioage.com/en/index.htm

    If you are asked to import your settings from Internet Explorer, say No!

    Best Regards :D
     
  7. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    Actually, none of my browsers will open including firefox, ie6, or msn explorer. However, they all work just fine in safe mode.
     
  8. cdavfrew

    cdavfrew Regular member

    Joined:
    May 19, 2008
    Messages:
    1,183
    Likes Received:
    0
    Trophy Points:
    46
    Hey odell1980

    Hmm... that's odd. Let's do a little more analysis.

    Now, please download ComboFix.
    With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Save it to your Desktop.

    Please disable all security programs, such as antiviruses, antispywares, and firewalls.

    • Run Combo-Fix.exe and follow the prompts.
    • Accept the End-User License Agreement.
    • Allow the Recovery Console to be installed.
    • When you see the window below, click on Yes.
    [​IMG]
    • When the Recovery Console has been installed, click on Yes to start the scan.
    [​IMG]

    **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
    • Wait for the scan to be fully completed.
    • If it requires a reboot, please do so.
    • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)

    Do not click on the ComoboFix window, as it may cause it to stall.

    Best Regards :D
     
  9. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    I am unable to download that file.
     
  10. cdavfrew

    cdavfrew Regular member

    Joined:
    May 19, 2008
    Messages:
    1,183
    Likes Received:
    0
    Trophy Points:
    46
    Hey odell1980

    I meant in safe mode. Can you download it in safe mode with networking?

    Best Regards :D
     
  11. EricCarr

    EricCarr Regular member

    Joined:
    Apr 11, 2005
    Messages:
    119
    Likes Received:
    0
    Trophy Points:
    26
    Check the browsers for a proxy setting. I had some malware that set all my browsers to a proxy setting.
     
  12. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    It will not let me download anything of the sort in safe mode. If it is not a anti-virus then I can. Also, I am not sure what a proxy setting is or how to check it.
     
  13. odell1980

    odell1980 Member

    Joined:
    Dec 23, 2006
    Messages:
    46
    Likes Received:
    0
    Trophy Points:
    16
    Hey guys,
    Thanks for all of the help you have given me. Unfortunately I gave up on trying to fix this problem and reformatted my HDD. I really appreciated your assistance.

    Thanks,
    odell1980
     

Share This Page