This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] HijackThis Logs

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Krunkdog,

🖼Click to load external image (Posted Image) If your network icon appears on the Windows taskbar, then you can repair it by right-clicking on the icon and selecting Repair.

[external image: Posted Image]

If you have no task bar icon do this:

  • Click on the Start button.
  • Click on the Settings menu option.
  • Click on the Control Panel option.
  • When the Control Panel opens, double-click on the Network Connections icon. If your Control Panel is set to Category View, then double-click on Network and Internet Connections and then click on Network Connections at the bottom.
  • You will now see a list of available network connections. Locate the connection for your Wireless or Lan adapter and right-click on it.
  • click on the Repair menu option.

[external image: Posted Image]

Let the repair process perform its tasks and when it has finished, your Internet connection should be working again.

If that doesn't work - try the following:


  • Go to Start > Control Panel, and choose Network Connections.
  • Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
  • Click the Networking tab
  • Double-click on the Internet Protocol (TCP/IP) item.
  • Write down the settings in case you should need to change them back.
  • Select the radio button that says "Obtain DNS servers automatically".
  • Click OK twice to get out of the properties screen and restart your computer.
  • If not prompted to reboot go ahead and reboot manually.
In I.E.
  • Check internet options settings.
  • Tools > Internet Options > Connections
  • LAN settings
  • Choose "automatically detect settings"
  • uncheck both proxy settings boxes
In FireFox
  • Click on Advanced -> Network -> Setttings…
  • the No Proxy option should be selected
I tried repairing multiple times yesterday it always comes up with an error saying "Windows could not finish repairing the problem because the following action cannot be completed: Connecting to the wireless network." I went to the Internet protocol properties and the "obtain DNS server adress automatically" button was already clicked. The no proxy button was also already clicked in firefox. The Internet is working fine for other computers in the house I don't know what the problem is.
Krunkdog,

If the laptop is so equipped, can you try to connect it via Ethernet cable to the router? That might help us figure out where the problem is.

Please don't be insulted here, but is there any chance the wireless adapter was accidentally shut off? Some laptops have a switch or button that enables and disables the wireless adapter.

It also wouldn't hurt to check your network setting on the wireless adapter.

🖼Click to load external image (Posted Image) Click Start > Run or Windows Key + R and enter the following command:
devmgmt.msc

That will open the device manager - Find your wireless adapter under "Network Adapters" and see if it shows any trouble (a question mark or exclamation point).

If everything there seems in order, run this:

🖼Click to load external image (Posted Image) Follow these steps to use the reset command to reset TCP/IP manually:
  • To open a command prompt, click Start and then click Run. Copy and paste (or type) the following command in the Open box and then press ENTER:
    cmd
  • At the command prompt, copy and paste (or type) the following command and then press ENTER:
    netsh int ip reset c:\resetlog.txt
  • Reboot the computer.
Do you have access to another computer that you could use to get me the ComboFix log?
Probably shouldve mentioned this before but when I ran combofix an error popped up saying "windows cannot find '32788R22FWJFW\nircmd.cfxxe' but then combofix ran normally on it's own even after the error. Also when I went to the device manager there are 7 things listed under it and 5 have exclamation marks.
Krunkdog, In post 17 you said you have other computers in the house that are connected to the internet. Are you able to use any of them?
Krunkdog,

Great, that will be very helpful. I need you to download a tool to run on the infected machine to either a CD or USB drive, then get the logs back to the good computer:

If your are going to use a USB drive and the other computer you have access to runs Windows XP please run this tool first on the good computer. If your going to use a CD or if the other computer runs Vista or Windows 7 machine, please move on to the next step:

🖼Click to load external image (Posted Image) Download Flash_Disinfector.exe from HERE and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Next, please download this tool to either a CD or USB drive, then run it on the infected computer:

🖼Click to load external image (Posted Image) We need to check out your devices. Please download DevDiag, from one of the following links and save it to your Desktop:

WTT Download Page (recommended)
Direct Download
  • If you are using Vista or Windows 7, please right-click DevDiag.exe and select Run As Administrator. Otherwise, simply double-click the program to run it.
  • At the options screen, please type 1 and hit Enter.
  • The tool will take a few moments to scan. When finished, a report should pop-up, also available on your Desktop (DevDiag.txt).
  • Please do not copy/paste the report into your next reply. Instead, Attach it by clicking Add Reply, and scrolling down to the Attachments section.
🖼Click to load external image (Posted Image) On the infected PC, click Start > Run or press the Windows Key + R and copy/paste the following command into the Run box and click OK:
c:\ComboFix.txt

That should open the ComboFix log. Please copy both the ComboFix log and DevDiag log to CD or USB and post them from the good PC.
Krunkdog,

Please run this on the infected PC:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above DirLook::

DirLook::
c:\Qoobox\Quarantine\Registry_backups

FileLook::
c:\qoobox\quarantine\c\windows\system32\drivers\ndisrd.sys.vir

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:
  • ComboFix log
Krunkdog,

Sorry, I should have explained; what we are doing right now is trying to get you reconnected. ComboFix may have removed a good file, but I need to have you check for me:

🖼Click to load external image (Posted Image) Use Windows Explorer (Press the Windows Key + E) to navigate to the following file:
c:\qoobox\quarantine\c\windows\system32\drivers\ndisrd.sys.vir

Copy it to either CD or USB and take it to the computer you are accessing the internet with

Please go to one of the below sites to scan the file:
virscan.org
Virus Total

click on Browse, and upload the following file from the infected PC for analysis:

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI