No Internet Access Infected With XP Antivirus 2012

Hello InfoGeek

Let's see if we can restore your internet…

First, go to Start > Run…

• Type in dllcache and click "OK"
• Copy ipsec.sys from this location and paste it in the C:/Windows/system32/drivers folder
• Reboot your machine

Next,

Please re-run Farbar Service Scanner
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Next,

• Go to Start > Run
• Copy and paste the following command into the run box and click "OK":
  

  regedit /e "%userprofile%\desktop\output.txt" "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IPSec"

• A new file called output.txt should appear on your Desktop, please post the contents with your next response.

Is your internet back now?

Hello InfoGeek Do you still need help with this?

Hello Sunyata, I do'not have my internet back i follow your instructions and nothing. Here is the FSS log. Thank for your help so far. 📎FSS_01_22_2012.txt

Here is allso the output log that you requested. 📎output_01_22_2012.txt

Hello InfoGeek

Let's try this…

• Please open Notepad
• copy the text in the following code box and paste it into Notepad
  
  

  Windows Registry Editor Version 5.00
  
  ;——————————
  ; IPSec reg entry fix
  ;——————————
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec]
  "Tag"=dword:00000006
  "DisplayName"="IPSEC driver"
  "Description"="IPSEC driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\Security]
  "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
    00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
    00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
    05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
    20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
    00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
    00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

• Save it as internetFix.reg
• Right-click on internetFix.reg and choose "Merge"
• Click "Yes" in the dialog that follows
• Reboot your computer

Next,

Please re-run Farbar Service Scanner
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Is your internet back now?

Hello Sunyata, My internet is not back yet. When i merge the I ipsec reg entry fix, this is what windows xp said. Can'not import C:/ Documents and settings\sam\ Desktop\internetFix.reg. The specified file is not a registry script. You can only import binary registry files from within the registry editor. So i did'not run a FSS Scan becuse the internet fig.reg did'not work. I already ran the regfix from bleeping computer. I and able to scan with superantispyware portable, and malwarebytes anti-malware buy with malwarebytes i can'not update. Both anti-malwares did not remove the fake xp antivirus 2012 that is on my compter. Thank You so far for your help sunyata.

Hello InfoGeek

Please unzip the uploaded file below, right-click, and choose "merge".
Then see if your machine does not connect to the internet

Hello Sunyata, Thank You so much it work, i have my internet back. I Just try to install malwarebytes anti-malware but it would not install. Here is the FSS log 📎FSS_01_23_2012.txt I'am now on my computer. Again Thank You. I'am waiting for the next steps to do. InfoGeek.

Hello InfoGeek

i have my internet back

Good news!

Let's see if we can clear off some of this infection…

Download RogueKiller to your desktop

• Quit all running programs
• For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
• When prompted, type 2 and validate
• The RKreport.txt shall be generated next to the executable.
• If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next Reply

Next,

NOTE: When you download Combofix, rename it to regedit.exe while saving to to your descktop.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Please download ComboFix from one of the following locations:

• LINK 1
• LINK 2

**IMPORTANT! Save ComboFix to your Desktop. Read the following thoroughly

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link :How to Disable your Security Programs
  
• Double click on 'ComboFix.exe' & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message box:

[external image: Posted Image]

Click on 'Yes', to continue scanning for malware.

When finished, it will produce a log for you.
Please include the contents of C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please let me know.
5. ComboFix disconnects your machine from the internet. The connection is automatically restored before ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply please post the log created by ComboFix.

Hello Sunyata, I just ran a scan with rogue killer here are the results. 📎RKreport_1_.txt. I try to run a scan with combofix i follow your instructions save it as regedit.exe and everything workout find was able to download the microsoft windows recovery console, but when it try to scan for malware it was block. flashing cursor did'not move it didn't scan my conputer. Sent it didn't scan there is no log to post.

Hello InfoGeek

I'm wondering if you are not waiting long enough for ComboFix to begin a scan. Sometimes it will seem like ComboFix will hang when it has a lot of cleaning to do.
We will run ComboFix again and this time, please wait maybe five times as long as you think it should take for ComboFix to scan.

But first please run aswMBR…

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
  

  Vista and Windows 7 users right click the icon and choose "Run as administrator".

• When asked if you want to download Avast's virus definitions please select Yes.
• Click the Scan button to start scan.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]

Next,

Please re-run ComboFix

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link :How to Disable your Security Programs
• Double click on 'ComboFix.exe' & follow the prompts.
• Allow it to scan your machine for malware.

When finished, it will produce a log for you.
Please include the contents of C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please let me know.
5. ComboFix disconnects your machine from the internet. The connection is automatically restored before ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply please post the log created by ComboFix.

Hello Sunyata, I just ran a scan with aswMBR here is the log. 📎aswMBR.txt Will begin to try to run a scan with combofix.

Hello Sunyata, I have no antiVirus and antiSpyware applications running. When i try to run a scan form combofix it just hang there and did nothing this zeroaccess rootkit protection is blocking the scan. I ran the scan for over 3 hours and nothing. I need a another tool or a way to work around this malware, such as a boot cd or something. Thank you so far for your help.

Hello InfoGeek

I need a another tool or a way to work around this malware, such as a boot cd or something.

A boot CD it is then!

We also need a USB flashdrive that has some space on it. We will not be changing any of the data on the usb device just using it for a file.

You will also need to use FireFox to download a file as Internet Explorer seems to mangle the download.

If you have an problems with these steps please let me know. These may look complicated but it's fairly straight forward and for the most part automated.


Download GETxPUD.exe to the desktop of your clean computer

• Run GETxPUD.exe by double clicking it.
• A new folder will appear on the desktop.
• Open the GETxPUD folder and click on the get&burn.bat
• The program will download xpud_0.9.2.iso, and when finished, it will open BurnCDCC which will be ready to burn the image.
• Click on Start and follow the prompts to burn the image to a CD

Using FireFox, please download and save dumpit to your usb device.

You may want to print out this part as you will not be able to view these instructions.

• Leave the usb device attached to the computer
• Boot the infected computer with the CD you just burned
  • with the CD in the computer, restart the computer
• The computer must be set to boot from the CD,depending on your computer you can either do this by pressing F12 and selecting the CD as the first boot option or it can be set in the BIOS
• Once you have the computer set to boot from the CD allow it to boot
• A Welcome to xPUD screen will appear
• Click on File
• Expand mnt
• sda1,2…usually corresponds to your HDD
• sdb1 is likely your USB
• Click on the folder that represents your USB drive (sdb1 ?)
  (you will be able to tell if it the right one as the screen will populate with your files)
• Locate the file you downloaded and saved earlier, dumpit
• double click it to run it
• a black window will open, follow the instructions to close the window when it's finished
• a file called MBR.zip should now be placed in the right hand panel
• Click the Home icon at top
• Remove the CD and click Power off
• Click restart

Once the computer has rebooted open the usb device and attach the MBR.zip file to your next reply.

Hello Sunyata Here is the MBR.zip file information, that i took with GETxPUD.exe. 📎mbr.zip