it was fun while it lasted

EvilGrins · Post by **EvilGrins** » Mon Sep 12, 2011 1:11 pm

I went most of the past decade without having a home internet connection. Due to a rather odd problem, it seems I'm there again...

...I'm at a public library right now.

Due a mild concern I might have a virus, given my usual anti·virals were being prevented from working, somebody suggested I try an online virus scanner. It scans your computer directly from the website. However whatever was preventing me from scanning my system directly apparently blocked that as well and, what's more, something happened in the process.

My system still registers an internet connection but none of my browsers, or even ut99 looking for online games, can connect to the internet anymore. Nothing I have that used to be able to access online is able to see it at all. I haven't a clue what's going on with this but I'm essentially cut off.

As to the person that recommended the site, I'm not mad. Heard about him for awhile so I know he's good people and it's unlikely he did this to me deliberately. Although, I now view pandas with a bit more skepticism than I ever did before.

Still making skins, still got stuff to say. I'll pop on when I can and share what I've got but for the most part, I am down for the count. Public libraries in my neck of the woods only allow 2 hours of internet a day so I'll be around a lot less in a lot of ways.

Wish me luck!

Hook · Post by **Hook** » Mon Sep 12, 2011 2:48 pm

I am thinking that Hermskii will be able to help you here.
He has before with a good number of people having problems - especially like yours!

Sir Mandrake · Post by **Sir Mandrake** » Mon Sep 12, 2011 4:22 pm

Evil,
There wasn't / isn't anything wrong with the online scan at pandasecurity.com Ive used it myself evaluating it and it does a good job. Theres ALWAYS a risk trying to fix these infections. Your problem isnt really all that serious. If your computer boots and runs but has no internet is simply a matter of repairing the TCP/IP settings or network configurations. Ive seen bogus Proxy configurations set up on an infected PC and clearing it out allowed it to communicate again. Another common way trojans and viruses block your attempt to visit websites... (Especially virus scanning and security websites) is they load your Hosts file with a bunch of exceptions.... if you try to visit mcafee.com it redirects you to another site or simply 192.0.0.1 . My suggestion is to finish what gopo recommended and run Combofix. You can download it onto a usb stick at the library. Boot your pc in safe-mode. Run Combofix. If you use AVG remove it completely first. Then boot your PC normally and run combofix again. After combofix does its job, you can run any other type of scan you like to clean up and find residual files left behind. Combofix's job is the KILL the process thats running and prevent it from loading again. Run malwarebyte, superantispyware or whatever you like to clean up.

Any questions just holler

David · Post by **David** » Mon Sep 12, 2011 5:27 pm

Just to add a bit..

I know sometimes if you already have something/malware (we will call it "TOM") on your computer when you install malwarebytes or something simular, and you scan your computer the malwarebytes might not be able to locate "TOM". There is a program called R Kill.

bleepingcomputer.com wrote:RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then import a Registry file that removes incorrect file associations and fixes policies that stop us from using certain tools. When finished it will display a log file that shows the processes that were terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.

Below are a list of RKill download links using different filenames. We offer RKill under different filenames because some malware will not allow processes to run unless they have a certain filename. Therefore when attempting to run RKill, if a malware terminates it please try a different filename offered below.

http://www.bleepingcomputer.com/downloa ... irus/rkill
I found it to be a good tool just in case.

rkill.rar

*POTS* · Post by ***POTS*** » Mon Sep 12, 2011 9:32 pm

This page is about the Antivirus Live 2010 rogue, but it contains useful information about how to fix the Internet-connection-not-working issue:

http://www.bleepingcomputer.com/virus-r ... virus-live

As regards the Panda Online Scanner, it saved me once on my old laptop where I couldn't run a proper AV program.

EvilGrins · Post by **EvilGrins** » Tue Sep 13, 2011 1:23 pm

Hook wrote:I am thinking that Hermskii will be able to help you here.
He has before with a good number of people having problems - especially like yours!

I'd like to think so but previous times he helped me he could login to my computer remotely. I can't even get online now so he can't do that anymore.

EvilGrins · Post by **EvilGrins** » Tue Sep 13, 2011 1:26 pm

Can somebody send me a fresh link to Combofix? For some reason I can't login to gopostal's forum anymore.

Hook · Post by **Hook** » Tue Sep 13, 2011 1:49 pm

Hermskii can do all that you need - wait for him to get back in here.
He has Combofix and all sorts of goodies!

And, he doesn't need to connect to your comp anyways.

Sir Mandrake · Post by **Sir Mandrake** » Tue Sep 13, 2011 2:31 pm

EvilGrins wrote:Can somebody send me a fresh link to Combofix? For some reason I can't login to gopostal's forum anymore.

Here is the official page on how to use Combofix. Its got the links in there to download it for the OS you have. Its updated quite frequently and the download links that page provides only live for 10min. Refresh the page to get a new link if needed.

http://www.bleepingcomputer.com/combofi ... e-combofix

EvilGrins · Post by **EvilGrins** » Tue Sep 13, 2011 2:47 pm

Sir Mandrake wrote:
EvilGrins wrote:Can somebody send me a fresh link to Combofix? For some reason I can't login to gopostal's forum anymore.
Here is the official page on how to use Combofix. Its got the links in there to download it for the OS you have. Its updated quite frequently and the download links that page provides only live for 10min. Refresh the page to get a new link if needed.

http://www.bleepingcomputer.com/combofi ... e-combofix

Eep!
"it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained."
Should i wait for Hermskii to help me out? Sounds dangerous. Like "screen growing teeth and biting me" dangerous.

Sir Mandrake · Post by **Sir Mandrake** » Tue Sep 13, 2011 3:58 pm

Hermskii, Myself... or whoever you like. I'm in the IT profession for a living and have used Combofix many times over... so you could say I'm on of the ones properly trained, but its whoever you are most comfortable with.

Combofix isn't that scary to run. You just might have questions about what to do next as it works, but Combofix does a pretty good job stepping you through its process and telling you whats going on. When its done, you'll get a report generated that you might want to send to herm or one of us to evaluate the severity of your infection. A badly infected machine might reboot a couple times before its done. This is probably due to it removing rootkits and other nasties.

Anyway if you are nervous about running combofix.. dont.. Get Herm on the phone with you and he can step you through the process.

Post by **Hermskii** » Tue Sep 13, 2011 9:17 pm

I've actually only had to use combo fix a couple of times. I usually get it resolved before then but I know a ferw tricks around things that Malwarebytes even misses. Combo fix is strongest thing I have ever seen though when it gets down to getting really nasty about cleaning up a machine.

Don't wait on me but maybe I'll call you and talk you through some stuff. I have to admit it makes me wonder what your clicking on. Most users just know when not to go any further on the internet.

Sir Mandrake · Post by **Sir Mandrake** » Tue Sep 13, 2011 9:29 pm

He's nervous about running it because of the cautionary warning it has on the website. Usually somone nervous or paranoid about running these tools on thier PC is the worse situtation they can put themselves in... more so than an actual Trojan lol..

When I start on a PC clean up, ComboFix is the first thing I run. "It kills the bug" i like to say and then I do clean up. Before I am finished I will probably have rebooted the PC half a doz times and if the trojan or infection hasnt come back by then.. I know its got a clean bill of health.

Post by **Hermskii** » Wed Sep 14, 2011 12:37 pm

Yeah, I recall that scasring me the first time I used it. I'm going to find his number and call him now.

EvilGrins · Post by **EvilGrins** » Thu Sep 15, 2011 12:22 pm

Wanna thank you guys, that really seemed to help.

Before I got started I did MalwareBytes Anti·Malware just to see how things were. It gave me this:

After that I ran Rkill (on each drive as I wasn't sure if it effected them all in one swoop) and then I figured what the heck and ran ComboFix too. After they got done with me (ran MalwareBytes again) I am now virus free.

Still need to restore internet connection though. Because of when I was trying to host my own games, I knew what my IP address was but I neglected to copy down all the other stuff.

Subnet mask...?

Default gateway...?

Preferred DNS server...?

Alternate DNS server...?

Figure I'll check with my landlord, as I'm using his wifi, and see if he'll let me copy his info down as I imagine, for the most part, it'll be the same as what I had.

House of Hermskii {HOH}

it was fun while it lasted

it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted

Re: it was fun while it lasted