Internet Explorer 6 problem after Malaware/Spyware !

[maxmix]

Hi Guys/Gals (Nice site BTW)

Hopefully one of you Guru's can help me here without the need of a reformat.....

Bid long winded here but i'll give you the full story.... This all relates to my shop PC....
At home just now, so hopefully you can give me some ideas to try in the morning on my Non connecting PC

It's 1am here in Scotland so i'll need to check back for any ideas to try tomorrow in a couple of hours before bed lol

Yep.... Long winded

On Friday I went to look for a cover at www.cdcovers.cc for an old Arcade Emulator I have....

Only on the site a few mins and my Avast4 kicked in about some dodgy .dll file being tampered with.... Happened about 5 times with different System32\*.dll's Quickly looked them up and it was a Spyware attack....

So basically it was Spyware that caused my problem.....

My BT Voyager ADSL Modem default changed to my old Dial up modem with a dodgy tel num....

(Not plugged in so it could not get on to any premium numbers etc) But HDD was whirring and whirring (Like a defrag) Mega files or registery entries were being changed at a guess.....

A few restarts later, Avast finally sorted out the .dll's but now my USB ADSL modem connects ok...

But IE6 will not open any pages.... Tried Firefox also.... Checked DNS, all OK....

Phones my ISP tried various CMD ping tests and manual DNS IP entries, all were OK....

Reinstalled IE6 fully (I have it on CD) still the same.... Reinstalled XP Pro over its self..... Still the same....

3 days on (Tried a winsock repairer) all to no avail....

Please help

maxmix

There must be a registry entry or files that are causing this.... I am all backed up, but dont have all my drivers and SW handy to reformat, so this needs to be a last resort, MY ISP came to the end of their tests after 30 mins, they say I am connecting and data is OK etc, and reinstalled modem drivers at the same time...

[TheEmperor]

Get HijackThis and run it and post the log on here. There's a good chance you still have some malware on the system.

[maxmix]

Hi Emp

This ? If so I'll put it on my flash drive and try to post the log tomorrow....

I've seen people use this SW, always looked a bit complicated lol

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

maxmix

PS Do you think we will get my connection back without a reformat ?

[patio]

Start Here...

[maxmix]

Thanks Patio.... I have done most of what is said over the last 3 days in the post you directed me to, with similar SW, removed all Spyware etc and installed (I have SP3 for XP Pro) It went on when I tried the Windows installation.... I have XP Pro with SP3 (Hopefully no damage has been done)

But I am downloading everything now to my trusty 16GB Flash Drive and will follow your instructions tomorrow on the suspect PC....

Thanks for now, gives me new hope.... (I normally back customers PC's up and reformat at this stage lol) But not possible ATM with my 3 x 400GB Hdd's..... Too much to go through etc....

maxmix

BTW Your 1st link needs updating.... I sorted it straight away by removing the ''' (It's the 1st download in Step A) Just to help others etc.....

[maxmix]

Also, I'll try and post back what results when I can through the day tomorrow....

I've hooked my little Asus EEE Laptop up so I can access my email server through the day....

Just not feasable to work with for too long....

Only problem I see is.... In your guides about running updates to latest versions etc....

I cant connect remember lol

I'll try my best with what I have downloaded now and your instructions.....

Thanks for your help....

3:15am now Bed time.....

If you can think of anything else I could try tomorrow, I'll check tomorrow to see if there are any additions here

maxmix

[Broni]

In your case, don't worry about updates too much...

[patio]

Not sure what link you say needs updating as i just ran thru them all but thanx for the heads up...

[maxmix]

Thanks.... On Asus EEE ATM Spyware galore found on main PC....

Will report and post logs ASAP, Lo of files to be scanned etc....

Check and edit http://filehippo.com/software/antivirus/"

Remove your last inverted's

L8r

maxmix

[patio]

Check and edit http://filehippo.com/software/antivirus/"

Remove your last inverted's Wink

HuH ? ?

[maxmix]

Yes someone has edited now

Right.... down to business..... Over night to finish all the scanning etc....

All jobs done..... Still wont connect......

Here are the logs as requested..... Phew.....

maxmix

[file cleanup - saving space - attachment deleted by admin]

[maxmix]

DrWeb

xxyayay.dll;d:\windows\system32;Trojan.Virtumod.240;Deleted.;

and Hijack this attahed also....

maxmix

[file cleanup - saving space - attachment deleted by admin]

[Broni]

I only checked SAS log, and you had a lot of bad stuff there, so we must clean your computer, first.
I'll take a look at your HJT log, now.

[Broni]

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)  to your desktop.

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Post new HJT log, as well

[maxmix]

Thank you Broni.... Will D/L Anti Mala now, put on Flash Drive and run on computer tomorrow again....

I'll run Hijack after this and post back tomorrow afternoon.... 2am again lol Bed

NN

maxmix