Dell Dimension 2400 running Windows XP Home SP2 and using TrendMicro Security suite was contaminated by this nasty PAV trojan: AZSY. Attempted fix by running your recommended MAlwareBytes removal tool. Link to OSList is broken or program has been removed. Pop-ups stopped, things seem stable except I cannot connect to the internet with IE or Firefox. Cannot ping anything. Was something in the registry damaged or removed? Before running MalwareBytes, was able to connect to Internet without pop-ups by disabling the PAV in System Config Utility. Thanks.
Go to Start > Control Panel, and choose Network Connections.
Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
Click the Networking tab
Double-click on the Internet Protocol (TCP/IP) item.
Write down the settings in case you should need to change them back.
Select the radio button that says "Obtain DNS servers automatically".
Click OK twice to get out of the properties screen and restart your computer.
If not prompted to reboot go ahead and reboot manually.
In I.E.
Check internet options settings.
Tools > Internet Options > Connections
LAN settings
Choose "automatically detect settings"
uncheck both proxy settings boxes
In FireFox
Click on Advanced -> Network -> Setttings…
the No Proxy option should be selected
If that doesn't work:
Can you perform a system restore back to the earliest date available, which may or maynot restore your connection, It will also restore the infection, but then we can go about cleaning it here.
If there are no restore points to return it to, do you have access to another computer.
If so - download the following programs -
transfer them to the infected machine via USB or other removable media and run them.
I will try my best to clean your computer and restore your connection
~CB
STEP #1
Please download DDS and save it to your desktop.
Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.
————————————————— Please include the contents of the following in your next reply:
DDS.txt Attach.txt.
STEP #2
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Not sure if from your description whether your connection has been fully restored or not?
there does not seem to be any infection remaining on your system.
If you are able to connect.
Please do the following on line scan:
Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner
1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Several of the files flagged by Kaspersky are already in quarantine, so cannot harm the computre.
Kaspersky also identifies infected emails. Unfortunately it cannot identify which particular email it is, so you will have to use your best judgment to identify which ones are infected. i would delete any from anyone you don't know and any with attachments, unless you totally trust the source. Unless something is particularly important, i would delete it as a precaution. Then empty the trash.
NEXT
Please download JavaRa to your desktop and unzip it to its own folder.
Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
Scroll down to the Java SE Runtime Environment (JRE) option.
Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 14)
Please describe how your computer is running now and if there are any outstanding issues.
CatByte,
Thanks so much for your help. Internet connectivity issue was a setting problem with Trend Micro. All is corrected now and "SURF'S UP"!
Thanks again. You are awesome!
we should clean up our tools and I will give you my closing recommendations:
Now to remove the tools that we have used in fixing your machine:
Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.
NEXT
System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
We need to set a new system restore point:
Click Start > Run > copy and paste the following into the run box:
%SystemRoot%\System32\restore\rstrui.exe
Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.
Now remove all previous Restore Points:
Click Start > Run > copy and paste the following into the run box:
cleanmgr
At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.
NEXT
Below I have included a number of recommendations for how to protect your computer against malware infections.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE
For Firefox, I highly recommend this add-on to keep your PC even more secure.
NoScript - for blocking ads and other potential website attacks
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: Think Prevention. PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
Thank you for your patience, and performing all of the procedures requested.
Please respond one last time so we can consider the thread resolved and close it, thank-you.
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}