Problem
Malware is blocking my internet connection. I'm not getting any pop-ups, anything extra in the taskbar, or getting redirected anywhere, the internet just doesn't work. When I boot up the pc, the internet works for a couple seconds, then stops, most applications also can't access the internet. Proxy's are disabled.
I used malwarebytes to remove the malware, but internet still doesn't work. Sometimes, after a couple restarts, the viruses show up in the malwarebytes scan again. Internet works fine in safe mode. The viruses that seem to be coming back are Work.KoobFace, Trojan.Downloader, Trojan.Scar, Worm.Pavelo, and Worm.Hiloti.
Current HijackThis Log
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:25:18 PM, on 1/26/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\GLI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\GLI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\GLI\Desktop\RED HAT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://zms.asksearch.com/?cfg=2-393-0-0&engine_id=2&provider_id=2&product_id=393&country=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:63333
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Event Log] C:\Documents and Settings\GLI\Application Data\EventLog.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\GLI\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1288900545906
O17 - HKLM\System\CCS\Services\Tcpip\..\{33A9CF48-A882-4D39-BCC2-B6FAECB791C3}: NameServer = 192.168.140.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{33A9CF48-A882-4D39-BCC2-B6FAECB791C3}: NameServer = 192.168.140.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{33A9CF48-A882-4D39-BCC2-B6FAECB791C3}: NameServer = 192.168.140.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 3367 bytes
Current Uninstall Program Log
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.1.0
Beyond Compare Version 2.2.7
Dell ResourceCD
EASEUS Partition Master 6.5.2 Home Edition
GLI Verify® 5.0
Hex Workshop v6
Intel(R) PRO Network Adapters and Drivers
Java(TM) 6 Update 23
Java(TM) SE Runtime Environment 6
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 2.0
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft WinUsb 1.0
OpenOffice.org 2.2
PdaNet for Android 2.45
SoundMAX
Update for Windows XP (KB898461)
WinRAR archiver
WModem Driver Installer
WModem_Installer
Malware is blocking my internet connection. I'm not getting any pop-ups, anything extra in the taskbar, or getting redirected anywhere, the internet just doesn't work. When I boot up the pc, the internet works for a couple seconds, then stops, most applications also can't access the internet. Proxy's are disabled.
I used malwarebytes to remove the malware, but internet still doesn't work. Sometimes, after a couple restarts, the viruses show up in the malwarebytes scan again. Internet works fine in safe mode. The viruses that seem to be coming back are Work.KoobFace, Trojan.Downloader, Trojan.Scar, Worm.Pavelo, and Worm.Hiloti.
Current HijackThis Log
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:25:18 PM, on 1/26/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\GLI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\GLI\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\GLI\Desktop\RED HAT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://zms.asksearch.com/?cfg=2-393-0-0&engine_id=2&provider_id=2&product_id=393&country=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:63333
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Event Log] C:\Documents and Settings\GLI\Application Data\EventLog.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\GLI\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1288900545906
O17 - HKLM\System\CCS\Services\Tcpip\..\{33A9CF48-A882-4D39-BCC2-B6FAECB791C3}: NameServer = 192.168.140.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{33A9CF48-A882-4D39-BCC2-B6FAECB791C3}: NameServer = 192.168.140.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{33A9CF48-A882-4D39-BCC2-B6FAECB791C3}: NameServer = 192.168.140.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 3367 bytes
Current Uninstall Program Log
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.1.0
Beyond Compare Version 2.2.7
Dell ResourceCD
EASEUS Partition Master 6.5.2 Home Edition
GLI Verify® 5.0
Hex Workshop v6
Intel(R) PRO Network Adapters and Drivers
Java(TM) 6 Update 23
Java(TM) SE Runtime Environment 6
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 2.0
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft WinUsb 1.0
OpenOffice.org 2.2
PdaNet for Android 2.45
SoundMAX
Update for Windows XP (KB898461)
WinRAR archiver
WModem Driver Installer
WModem_Installer
