Problems after FBI Hijack

Hi Robybel. I ran otl with the fix as you asked and the computer rebooted but no logs were created. I checked the C drive as well and nothing there. As for Internet explorer, it is still not letting me open IE so I cannot run it for updates. I thought the second combofix would do it, but if you recall on the first combofix we had to manually insert the script into the appropriate file. Let me know what's next. Thanks.

Hi hecrodfnp

I checked the C drive as well and nothing there

Try to search in this directory:

C:\Documents and Settings\administrator.AFC.000\My Documents\Downloads

NEXT

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure "Include All Files" option remains checked.
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Hi Robybel. I downloaded the scanner and the log I got is below, but don't know if that's what you exactly need because there was no place to select "include all files". Initially on the FarBar website it was a zip file but my computer gives me a warning about being "unable to download the installer." As for the missing OTL text, it is saved nowhere-not even in C MyDocuments/Downloads which is where OTL.exe is at. I really believe that the initial infection produced these problems with poor downloads capability, loss of IE, etc. Let me know Thanks Farbar Service Scanner Version: 27-06-2013 Ran by [removed] (administrator) on 28-06-2013 at 16:18:55 Running from "C:\Documents and Settings\administrator.AFC.000\Desktop" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3) 0x0700000004000000010000000200000003000000050000000600000007000000 IpSec Tag value is correct. **** End of log ****

Hi hecrodfnp

Very very sorry for delay, I miss your latest post.
please forgive me

====================

Ok hecrodfnp

Try this:


Download TFC to your desktop

• Close any open windows.
• Double click the TFC icon to run the program
• TFC will close all open programs itself in order to run,
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish it's job
• Once its finished it should automatically reboot your machine,
• if it doesn't, manually reboot to ensure a complete clean

Next

Complete Internet Repair

• Please download comintrep.exe and save it to your desktop
• Double click the icon and select Run
• Click Extract
• Double click the Complete Internet Repair folder on your desktop
• Double click the CIntRep.exe icon
• Place a checkmark next to the following entries:
  
  • Reset Internet Protocol (TCP/IP)
  • Repair Winsock (Reset Catalog)
  • Renew Internet Connections
  • Flush DNS Resolver Cache
  • Repair Internet Explorer 6.0.2900
  • Clear Windows Update History
  • Repair Windows / Automatic Updates
  • Repair SSL / HTTPS / Cryptography
  • Reset Windows Firewall Configuration
  • Restore the default hosts file
  • Repair Workgroup Computers view
• Click Go!
• Ignore any error messages for now
• Click OK to reboot your computer
• Check your internet access

Please let me know if this worked

Hi hecrodfnp Still need help?

Hi Robybel! No worries on the delay as I know you are very busy. I've been out of town until now. Let me run the fixes this evening. Thanks.

Hi Robybel. Did the TFC clean and was going to download the Internet repair but am confused as to which one on their website: Complete Internet Repair 1.3.2.1322 (32Bit) ? or the (64bit)? Let me know. Thanks

Hi hecrodfnp:)

Complete Internet Repair 1.3.2.1322 (32Bit) ?

Feel free to ask everything.

Hi Robybel. The internet repair did not bring back Internet Explorer– Remember that ComboFix did not initially repair the "denied Internet" issue as it was still showing up on the last CF log. Let me know. Thanks.

Hi hecrodfnp Please post for me the Internet repair log. Thanks

Hi Robybel. Here is the log I found–let me know. ./ (o o) ————————————–oOOo-(_)-oOOo————————————– ./ (o o) ————————————–oOOo-(_)-oOOo————————————– [10/07/2013 14:20:10] Resetting all TCP/IP Interfaces, Please wait….. —————————————————————————————– [10/07/2013 14:20:12] TCP/IP Stack reset successful. [10/07/2013 14:20:12] TCP/IP Reset log located @ [C:\Documents and Settings\administrator.AFC.000\Desktop\CIntRep-1321322\CIntRep-1321322\Logging\CIRReset.log] [10/07/2013 14:20:13] TCP/IP interfaces reset successful. [10/07/2013 14:20:14] The TCP/IP v6 protocol might not be installed. [10/07/2013 14:20:14] Click on 'Commands' then 'Install IP6 protocol' to install TCP/IP v6. [10/07/2013 14:20:14] You may need to restart your computer for the settings to take effect. [10/07/2013 14:20:14] Finished resetting the Internet Protocol (TCP/IP). —————————————————————————————– [10/07/2013 14:20:14] Attempting to reset Winsock catalog, Please wait….. —————————————————————————————– [10/07/2013 14:20:17] Successfully reset the Winsock Catalog. [10/07/2013 14:20:17] Finished repairing Winsock —————————————————————————————– [10/07/2013 14:20:17] Releasing TCP/IP connections, Please wait….. —————————————————————————————– [10/07/2013 14:20:17] Successfully released TCP/IP connections. —————————————————————————————– [10/07/2013 14:20:17] Renewing TCP/IP connections, Please wait….. —————————————————————————————– [10/07/2013 14:20:17] Successfully renewed TCP/IP adapters. —————————————————————————————– [10/07/2013 14:20:17] Configuring the Windows Event Log Service, Please wait….. —————————————————————————————– [10/07/2013 14:20:18] Windows Event Log Service Configured. [10/07/2013 14:20:18] Starting the Windows Event Log Service….. [10/07/2013 14:20:18] Windows Event Log Service Started Successfully. —————————————————————————————– [10/07/2013 14:20:18] Flushing DNS Resolver Cache, Please wait….. —————————————————————————————– [10/07/2013 14:20:18] Successfully flushed DNS Resolver Cache. [10/07/2013 14:20:18] Refreshing all DHCP leases and re-registering DNS names, Please wait….. [10/07/2013 14:20:19] Registration of the DNS resource records has been initiated. [10/07/2013 14:20:19] Note: Any errors will be reported in the 'Event Viewer' in about 15 minutes. [10/07/2013 14:20:19] Note: Click on 'File' and then 'Event Viewer…' to open the Event Viewer. —————————————————————————————– [10/07/2013 14:20:19] Repairing Internet Explorer 6.0.2900, Please wait….. —————————————————————————————– [10/07/2013 14:20:19] RegSvr32.exe: 'actxprxy.dll' registration succeeded. [10/07/2013 14:20:19] RegSvr32.exe: 'asctrls.ocx' registration succeeded. [10/07/2013 14:20:19] RegSvr32.exe: 'browseui.dll' registration succeeded. [10/07/2013 14:20:19] RegSvr32.exe: 'cdfview.dll' registration succeeded. [10/07/2013 14:20:19] RegSvr32.exe: 'comcat.dll' registration succeeded. [10/07/2013 14:20:20] RegSvr32.exe: 'comctl32.dll' registration succeeded. [10/07/2013 14:20:20] RegSvr32.exe: 'corpol.dll' registration succeeded. [10/07/2013 14:20:20] RegSvr32.exe: 'cryptdlg.dll' registration succeeded. [10/07/2013 14:20:20] RegSvr32.exe: '"C:\Program Files\Internet Explorer\custsat.dll"' Specified module not found [10/07/2013 14:20:20] RegSvr32.exe: 'digest.dll' registration succeeded. [10/07/2013 14:20:20] RegSvr32.exe: 'dispex.dll' registration succeeded. [10/07/2013 14:20:20] RegSvr32.exe: 'dxtmsft.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: 'dxtrans.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: 'extmgr.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: '"C:\Program Files\Internet Explorer\hmmapi.dll"' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: 'hlink.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: 'ieaksie.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: 'ieapfltr.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: 'iedkcs32.dll' registration succeeded. [10/07/2013 14:20:21] RegSvr32.exe: '"C:\Program Files\Internet Explorer\iedvtool.dll"' Specified module not found [10/07/2013 14:20:21] RegSvr32.exe: 'iedvtool.dll' Specified module not found [10/07/2013 14:20:22] RegSvr32.exe: 'ieframe.dll' registration succeeded. [10/07/2013 14:20:22] RegSvr32.exe: 'iepeers.dll' registration succeeded. [10/07/2013 14:20:22] RegSvr32.exe: '"C:\Program Files\Internet Explorer\ieproxy.dll"' registration succeeded. [10/07/2013 14:20:22] RegSvr32.exe: 'ieproxy.dll' Specified module not found [10/07/2013 14:20:22] RegSvr32.exe: 'iesetup.dll' registration succeeded. [10/07/2013 14:20:22] RegSvr32.exe: 'imgutil.dll' registration succeeded. [10/07/2013 14:20:22] RegSvr32.exe: 'inetcpl.cpl' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:20:23] RegSvr32.exe: 'inetcpl.cpl' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'initpki.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'inseng.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'jscript.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'licmgr10.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'mlang.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'mobsync.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'msapsspc.dll' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:21:07] RegSvr32.exe: 'mscoree.dll' registration succeeded. [10/07/2013 14:21:07] RegSvr32.exe: 'mscorier.dll' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:21:08] RegSvr32.exe: 'mscories.dll' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:21:08] RegSvr32.exe: 'msdbg2.dll' registration succeeded. [10/07/2013 14:21:08] RegSvr32.exe: 'mshta.exe' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:21:08] RegSvr32.exe: 'mshtml.dll' registration succeeded. [10/07/2013 14:21:09] RegSvr32.exe: 'mshtmled.dll' registration succeeded. [10/07/2013 14:21:09] RegSvr32.exe: 'msident.dll' registration succeeded. [10/07/2013 14:21:09] RegSvr32.exe: 'msieftp.dll' registration succeeded. [10/07/2013 14:21:09] RegSvr32.exe: 'msnsspc.dll' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:21:09] RegSvr32.exe: 'msr2c.dll' registration succeeded. [10/07/2013 14:21:09] RegSvr32.exe: 'msrating.dll' registration succeeded. [10/07/2013 14:21:09] RegSvr32.exe: 'mstime.dll' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: 'msxml.dll' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: 'ole32.dll' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: 'oleacc.dll' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: 'occache.dll' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: 'oleaut32.dll' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: '"C:\Program Files\Internet Explorer\pdm.dll"' registration succeeded. [10/07/2013 14:21:10] RegSvr32.exe: 'plugin.ocx' Specified module not found [10/07/2013 14:21:11] RegSvr32.exe: 'pngfilt.dll' registration succeeded. [10/07/2013 14:21:11] RegSvr32.exe: 'proctexe.ocx' registration succeeded. [10/07/2013 14:21:11] RegSvr32.exe: 'scrobj.dll' Error number: 0x80070005 [10/07/2013 14:21:11] RegSvr32.exe: 'sendmail.dll' registration succeeded. [10/07/2013 14:21:11] RegSvr32.exe: 'setupwbv.dll' Specified module not found [10/07/2013 14:21:11] RegSvr32.exe: 'shdocvw.dll' registration succeeded. [10/07/2013 14:21:11] RegSvr32.exe: 'tdc.ocx' registration succeeded. [10/07/2013 14:21:11] RegSvr32.exe: 'url.dll' Module loaded but entry-point DllRegisterServer was not found. [10/07/2013 14:21:12] RegSvr32.exe: 'urlmon.dll' registration succeeded. [10/07/2013 14:21:12] RegSvr32.exe: 'urlmon.dll,NI,HKLM' Specified module not found [10/07/2013 14:21:12] RegSvr32.exe: 'vbscript.dll' registration succeeded. [10/07/2013 14:21:12] RegSvr32.exe: '"C:\Program Files\microsoft shared\vgx\vgx.dll"' Specified module not found [10/07/2013 14:21:12] RegSvr32.exe: 'webcheck.dll' registration succeeded. [10/07/2013 14:21:12] Fixing 'New tabs page cannot display content because it cannot access the controls'. [10/07/2013 14:21:12] This is a result of a bug in shdocvw.dll. [10/07/2013 14:21:12] Registering Outlook Express files….. [10/07/2013 14:21:12] RegSvr32.exe: '"C:\Program Files\Outlook Express\msoe.dll"' registration succeeded. [10/07/2013 14:21:12] RegSvr32.exe: '"C:\Program Files\Outlook Express\oeimport.dll"' registration succeeded. [10/07/2013 14:21:12] RegSvr32.exe: '"C:\Program Files\Outlook Express\oemiglib.dll"' registration succeeded. [10/07/2013 14:21:13] RegSvr32.exe: '"C:\Program Files\Outlook Express\wabfind.dll"' registration succeeded. [10/07/2013 14:21:13] RegSvr32.exe: '"C:\Program Files\Outlook Express\wabimp.dll"' registration succeeded. [10/07/2013 14:21:13] Finished repairing Internet Explorer 6.0.2900 —————————————————————————————– [10/07/2013 14:21:13] Repairing Windows Update / Automatic Updates, Please wait….. —————————————————————————————– [10/07/2013 14:21:13] Stopping the BITS Service….. [10/07/2013 14:21:13] BITS Stopped Successfully. [10/07/2013 14:21:13] Stopping the Automatic Updates (wuauserv) Service….. [10/07/2013 14:21:13] Automatic Updates (wuauserv) Service Stopped Successfully. [10/07/2013 14:21:13] Clearing File Stores (Update History)….. [10/07/2013 14:21:13] Clearing [C:\WINDOWS\SoftwareDistribution\Download]….. [10/07/2013 14:21:14] [C:\WINDOWS\SoftwareDistribution\Download] Cleared. [10/07/2013 14:21:14] Clearing [C:\WINDOWS\SoftwareDistribution\DataStore]….. [10/07/2013 14:21:15] [C:\WINDOWS\SoftwareDistribution\DataStore] Cleared. [10/07/2013 14:21:15] Clearing [C:\WINDOWS\system32\CatRoot2]….. [10/07/2013 14:21:15] [C:\WINDOWS\system32\CatRoot2] Cleared. [10/07/2013 14:21:15] Setting BITS Security Descriptor….. [10/07/2013 14:21:15] BITS Security Descriptor Set. [10/07/2013 14:21:15] Setting Automatic Updates (wuauserv) Service Security Descriptor….. [10/07/2013 14:21:16] Automatic Updates (wuauserv) Security Descriptor Set. [10/07/2013 14:21:16] Configuring the Automatic Updates (wuauserv) Service….. [10/07/2013 14:21:16] Automatic Updates (wuauserv) Service Configured. [10/07/2013 14:21:16] Configuring BITS….. [10/07/2013 14:21:16] BITS Configured. [10/07/2013 14:21:16] Registering WUAU DLLs….. [10/07/2013 14:21:16] RegSvr32.exe: 'actxprxy.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'atl.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'browseui.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'corpol.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'cryptdlg.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'dispex.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'dssenh.dll' registration succeeded. [10/07/2013 14:21:16] RegSvr32.exe: 'gpkcsp.dll' registration succeeded. [10/07/2013 14:21:27] RegSvr32.exe: 'initpki.dll' registration succeeded. [10/07/2013 14:21:27] RegSvr32.exe: 'jscript.dll' registration succeeded. [10/07/2013 14:21:27] RegSvr32.exe: 'mshtml.dll' registration succeeded. [10/07/2013 14:21:27] RegSvr32.exe: 'msscript.ocx' registration succeeded. [10/07/2013 14:21:28] RegSvr32.exe: 'msxml.dll' registration succeeded. [10/07/2013 14:21:28] RegSvr32.exe: 'msxml2.dll' registration succeeded. [10/07/2013 14:21:29] RegSvr32.exe: 'msxml3.dll' registration succeeded. [10/07/2013 14:21:29] RegSvr32.exe: 'msxml4.dll' registration succeeded. [10/07/2013 14:21:29] RegSvr32.exe: 'msxml6.dll' registration succeeded. [10/07/2013 14:21:29] RegSvr32.exe: 'muweb.dll' registration succeeded. [10/07/2013 14:21:29] RegSvr32.exe: 'ole.dll' Specified module not found [10/07/2013 14:21:30] RegSvr32.exe: 'ole32.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'oleaut.dll' Specified module not found [10/07/2013 14:21:30] RegSvr32.exe: 'oleaut32.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'qmgr.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'qmgrprxy.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'gpkcsp.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'rsaenh.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'sccbase.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'scrobj.dll' registration succeeded. [10/07/2013 14:21:30] RegSvr32.exe: 'scrrun.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'shdocvw.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'shell.dll' Specified module not found [10/07/2013 14:21:31] RegSvr32.exe: 'shell32.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'slbcsp.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'softpub.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'urlmon.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'vbscript.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'winhttp.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'wintrust.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'wshext.dll' registration succeeded. [10/07/2013 14:21:31] RegSvr32.exe: 'wuapi.dll' registration succeeded. [10/07/2013 14:21:32] RegSvr32.exe: 'wuaueng.dll' Error number: 0x80070005 [10/07/2013 14:21:32] RegSvr32.exe: 'wuaueng1.dll' registration succeeded. [10/07/2013 14:21:32] RegSvr32.exe: 'wucltui.dll' registration succeeded. [10/07/2013 14:21:32] RegSvr32.exe: 'wucltux.dll' Specified module not found [10/07/2013 14:21:32] RegSvr32.exe: 'wups.dll' registration succeeded. [10/07/2013 14:21:32] RegSvr32.exe: 'wups2.dll' registration succeeded. [10/07/2013 14:21:32] RegSvr32.exe: 'wuweb.dll' registration succeeded. [10/07/2013 14:21:32] RegSvr32.exe: 'wuwebv.dll' Specified module not found [10/07/2013 14:21:32] WUAU DLLs Reregistered. [10/07/2013 14:21:32] Setting proxy to direct access….. [10/07/2013 14:21:32] Proxy set to direct access. [10/07/2013 14:21:32] Restarting the Automatic Updates (wuauserv) Service….. [10/07/2013 14:21:32] Automatic Updates (wuauserv) Service Restarted. [10/07/2013 14:21:32] Restarting the BITS Service….. [10/07/2013 14:21:32] BITS Service Restarted. [10/07/2013 14:21:33] Initiating Windows Updates detection right away….. [10/07/2013 14:21:36] Finished repairing Windows Update / Automatic Updates. —————————————————————————————– [10/07/2013 14:21:36] Repairing SSL / HTTPS / Cryptography service, Please wait….. —————————————————————————————– [10/07/2013 14:21:36] Configuring the Cryptographic Service….. [10/07/2013 14:21:37] Cryptographic Service Configured. [10/07/2013 14:21:37] Stopping the Cryptographic Service….. [10/07/2013 14:21:37] Cryptographic service Stopped Successfully. [10/07/2013 14:21:37] Clearing [C:\WINDOWS\system32\CatRoot]….. [10/07/2013 14:21:38] [C:\WINDOWS\system32\CatRoot] cleared. [10/07/2013 14:21:38] Re-registering SSL / HTTPS / Cryptography DLLs….. [10/07/2013 14:21:38] RegSvr32.exe: 'cryptdlg.dll' registration succeeded. [10/07/2013 14:21:38] RegSvr32.exe: 'cryptext.dll' registration succeeded. [10/07/2013 14:21:38] RegSvr32.exe: 'cryptui.dll' registration succeeded. [10/07/2013 14:21:38] RegSvr32.exe: 'dssenh.dll' registration succeeded. [10/07/2013 14:21:38] RegSvr32.exe: 'gpkcsp.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'initpki.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'licdll.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'mssign32.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'mssip32.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'regwizc.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'rsaenh.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'scardssp.dll' registration succeeded. [10/07/2013 14:21:55] RegSvr32.exe: 'sccbase.dll' registration succeeded. [10/07/2013 14:21:56] RegSvr32.exe: 'scecli.dll' registration succeeded. [10/07/2013 14:21:56] RegSvr32.exe: 'slbcsp.dll' registration succeeded. [10/07/2013 14:21:56] RegSvr32.exe: 'softpub.dll' registration succeeded. [10/07/2013 14:21:56] RegSvr32.exe: 'winhttp.dll' registration succeeded. [10/07/2013 14:21:56] RegSvr32.exe: 'wintrust.dll' registration succeeded. [10/07/2013 14:21:56] SSL / HTTPS / Cryptography DLLs re-registered. [10/07/2013 14:21:56] Restarting the Cryptographic Service….. [10/07/2013 14:21:56] Cryptographic Service restarted. [10/07/2013 14:21:56] Finished repairing SSL / HTTPS / Cryptography service. —————————————————————————————– [10/07/2013 14:21:56] Resetting the Windows Firewall configuraton, Please wait….. —————————————————————————————– [10/07/2013 14:21:57] Windows Firewall configuration reset successful. [10/07/2013 14:21:57] Finished resetting the Windows Firewall configuraton. —————————————————————————————– [10/07/2013 14:21:57] Restoring the default Windows HOSTS file, Please wait….. —————————————————————————————– [10/07/2013 14:21:57] Writing data to the HOSTS file….. [10/07/2013 14:21:57] HOSTS file created successfully. —————————————————————————————– [10/07/2013 14:21:57] Repairing Workgroup Computers view, Please wait….. —————————————————————————————– [10/07/2013 14:21:58] Finished repairing Workgroup Computers view. —————————————————————————————– [10/07/2013 14:21:58] You will need to reboot your computer before the settings will take effect. —————————————————————————————– [10/07/2013 14:22:07] Your computer is restarting now….. —————————————————————————————–

Hi hecrodfnp


Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

RegLock::
[HKEY_USERS\S-1-5-21-3272544874-3166413241-1926064316-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,93,64,c1,80,32,6a,45,9f,d5,9a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,93,64,c1,80,32,6a,45,9f,d5,9a,\

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

NEXT


How to restore Internet Explorer in Windows XP, Vista or 7:

• Exit all programs, including Internet Explorer.
  
• If you use Windows XP, click Start, and then click Run. Type the following command in the Open box, and then press Enter: inetcpl.cpl
  
• If you use Windows 7 or Windows Vista, click Start
  
• Type the following command in the Search box, and then press Enter: inetcpl.cpl
  
• The Internet Options dialog box appears.
  
• Click the Advanced tab.
  Under Reset Internet Explorer settings, click Reset. Then click Reset again.
  Click to select the Delete personal settings check box if you also want to remove browsing history, search providers, Accelerators, home pages, Tracking Protection, and ActiveX Filtering data.
  
• When Internet Explorer finishes resetting the settings, click Close in the Reset Internet Explorer Settings dialog box.

Start Internet Explorer again.

Hi Robybel. The last time we tried to fix the Internet with ComboFix, the fix did not automatically happen. Is there a way to manually insert the text into a file if it doesn't work again? Let me know. I'll post you later on the results of this fix. Thanks.

Hi hecrodfnp

Try this:


Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text below into the Notepad.

RegLock::
[HKEY_USERS\S-1-5-21-3272544874-3166413241-1926064316-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,93,64,c1,80,32,6a,45,9f,d5,9a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,93,64,c1,80,32,6a,45,9f,d5,9a,\


In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Hi hecrodfnp Still with me?