AV Security 2012

Viruses and worms
21

OK just do the stop thing with Avast - do notlet it quarantine/delete or sandbox anything

Could you confirm the the file you are dragging is called CFScript

If it still fails then just re-run combofix and it should get it this time … Do you have internet back now

22

Now internet on my laptop is crawling slowly… No internet on desktop. I believe my ip address was stripped.
Attached is my log. Can I just restore to an earlier date?

23

Yes you can try a restore

I believe my ip address was stripped
What do you mean by this ?
24

When I go to internet explorer and run a diagnostics, the log says there is no IP address and that I should reboor the modem. Whenever I do this, I have no luck. I was on the phone with the service provider and they could not get it to run either. We even typed in a number in the bar and that would not pull up any service. This is when I found the virus and they said SOL, your problem, not ours.
I will try a restore to a day earlier in the month and then see what happens.

25

The only days offerec by my computer for restore points are yesterday and the day i got the virus, which sounds kinda tricky to me. Would you restore to the day you got the virus???

26

OK I see what you mean now - so lets investigate

Could you type the following in the run box please and let me know what the output is

CMD /K SC QC DHCP

It should be this

[SC] GetServiceConfig SUCCESS

SERVICE_NAME: dhcp
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP : TDI
TAG : 0
DISPLAY_NAME : DHCP Client
DEPENDENCIES : Tcpip
: Afd
: NetBT
SERVICE_START_NAME : LocalSystem

THEN

Open Services…
Start > Run > Type: services.msc > Click OK
Scroll down to and double click DNS Client
Set to Automatic under Startup type
Click the Apply button
Click the Start button
When it starts click OK

Repeat for DHCP Client.
And repeat for Remote Procedure Call (RPC).

When done, close Services.

Try the connection again

OK run OTL and run the following script as I need to check the dependency files

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
afd.*
tcpip.*
netbt.*
/md5stop
C:\Windows\assembly\tmp\U /s
CREATERESTOREPOINT

27

First step displayed exactly as you said it should.

The DNS was in the started mode already so I could not click start.

DHCP and i received the following error message:
Could not start the DHCP client service on the local computer.

Error 1075: The dependency service does not exist or has been marked for deletion.

I stopped here and did not run OTL again. Is that okay?

Thanks again!

28

Could you now run OTL as I need to determine if the files are present and the registry keys are intact

So a slight change to the script could you copy the following into the custom scans and fixes box and then press Run Scan

/md5start
afd.*
tcpip.*
netbt.*
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s

29

Here is the otl log

30

Hi I am afraid you did not copy the script properly so if you could download the attached scan.txt to your desktop
Start OTL
Double click the blank custom scan and fixes box
On the prompt that comes up press OK
Locate and select the scan.txt that you downloaded and press run scan

31

Sorry,
Here is the latest

32

OK the registry entry for netbt did not look right

Could you go Start > Run
Type in Regedit and press OK
When regedit opens navigate to the following key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT

Could you post a screen shot of the area as below

33

Essexboy,
Screenshot is below:

34

Do you have access to another XP computer ?

If so then go to that key in regedit
Right click the key
Select export
In the dialogue save it to the desktop as .reg file
Copy the reg file to your computer
Right click and select merge
Reboot and then try the net

35

Can you hear all that singing!!! I am on my desktop. Luckily, my neighbor had XP. I assume that I need to remove all the combofix, etc. Just uninstall???

THANKS MIGHTILY!!!

36

Yep once you are happy I will remove my rubbish so that you can get back to having fun…

Any further problems before I do that

37

Looks like I am good to go. Only thing is the internet seems to be moving kinda slowly, I had a toggle key thing on my bottom bar. Ran Avast and they found a trojan and removed or quarantined and it disappeared. Was that spyware?

Do I just go to control panel and remove all the programs?

Thanks again

38
Ran Avast and they found a trojan and removed or quarantined and it disappeared. Was that spyware?
what does the log say ? was it moved to chest ? what is the name ? where was it located
Do I just go to control panel and remove all the programs?
nope........but you should wait for essexboy first...he will tell if and how to
39

Could you let me know what Avast removed please - within the virus chest it should give you the file name and location.

I will remove the tools cleanly at the end as none are in add/remove

40

It was a win32 cybot trj and was moved to a chest
location was C:.…\A00012733.exe
Action was successful