Acquiring Network Address...

[SuperDave]

Download HostsXpert

•Unzip HostXpert to your Desktop

•Open up the HostXpert program.

•Make sure that the "Make Hosts Writable?" button in the upper right corner is enabled.

•Click Create Back Up

•Then click on Restore Microsoft's Host Files

•Close the HostXpert program.

[Mattardz]

Those instructions were a little shaky (maybe there was an update?) but I followed along anyway and it completed, but still no results.

[SuperDave]

Go Start>Run (Start search in Vista), type in:
cmd
Click OK (in Vista and 7, while holding CTRL, and SHIFT, press Enter).

In Command Prompt window, type in following commands, and hit Enter after each one:
ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew
net stop "dns client"
net start "dns client"


Restart computer.

[Mattardz]

/flushdns worked properly
/registerdns failed because "The RPC server is unavailable."
/release states that they have already been released, so I don't know if that did anything or what that means
/renew states an error occurred "The RPC server is unavailable."
Net stop and net start both worked properly.

Rebooted, no results.

[SuperDave]

I'm going to consult a colleague about this problem.

[Mattardz]

Okay, do what you need to do. I greatly appreciate your continued efforts.

[SuperDave]

Please download Farbar Service Scanner and run it on the computer with the issue.

• Press "Scan".
  
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

[Mattardz]

Farbar Service Scanner
Ran by Matt (administrator) on 21-12-2011 at 13:56:22
Microsoft Windows XP Professional Service Pack 3 (X86)
********************************************************

Internet Services:
=================
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

Nsi Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open Nsi registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open Nsi registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open Nsi registry key. The service key does not exist.

afd Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to retrieve start type of afd. The value does not exist.
Checking ImagePath: Attention! Unable to retrieve ImagePath of afd. The value does not exist.


Connection Status:
=================
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Yahoo IP returend error: Yahoo IP is unreachable


File Check:
==========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

**** End of log ****

[SuperDave]

Following steps involve registry editing. Please create new restore point before proceeding!!!

How to:
XP - Create new Restore Point
Vista and Seven - Create a new Restore Point

Download XP.zip file from here: XP.zip
Unzip the file.
You'll find six files inside.
Right click on afd.reg file, click "Merge".
Allow registry merge.
Restart computer and see if internet works.

If not ask please post fresh Farbar Service Scanner log.

[Mattardz]

I'm elated to tell you that making those changes did the trick. I am sending this message to you from my previously infected machine.

I'm not sure if you are going to have me run more scans or not, but either way I was wondering what your advice is on which firewall/AV/anti-malware/spyware programs to have on my computer. After I had the problems last time, I went a little protection crazy and downloaded a bunch of programs. They don't all necessarily run at the same time and haven't caused me problems, per say, but they bog down my start up time pretty heavily. Not to mention they didn't stop my computer from getting infected.

The cumulative list of protection programs I have on my computer are as follows.
Malwarebytes Anti-Malware
SpywareBlaster
SpywareGuard
HijackThis
SUPERAntiSpyware
Spybot - Search & Destroy
ZoneAlarm
Avira

I wouldn't be against getting rid of any or all of these and swapping them out for long term alternatives. I'll take whatever your suggestions are. Thanks

[SuperDave]

That is good news. Now that you're back on-line could you please check that file at Jotti's (Reply #9) and post the results. I would still like to know if it's dangerous or not.

Malwarebytes Anti-Malware

Not a full-time scanner unless you have the paid version and you can configure it to not load at startup.

SpywareBlaster
SpywareGuard
SUPERAntiSpyware
Spybot - Search & Destroy

These are full-time scanners.

HijackThis

You can get rid of this one. It's no longer useful.

ZoneAlarm

This is your firewall.

Avira

This is your anti-virus program. It's a good one but I prefer MicroSoft Security Essentials.

[Mattardz]

http://virusscan.jotti.org/en/scanresult/ec1f422ff0fa69c31dc2cc1d021d92e5da4993b1/e3ed183dabdb0fd319810bc2f2c25f752740e5fb

[SuperDave]

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

[nasroo7]

I'm going to consult a colleague about this problem.

SuperDave you are so humble! I really have a lot of respect for you, and because you helped me on many problems! (Thank's for the other experts also! )