Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 92789 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Virus diagnostic help, please (possible infection) [Solved]


  • This topic is locked This topic is locked
50 replies to this topic

#16 OCD

OCD

    SuperHelper

  • Malware Team
  • 5,574 posts

Posted 19 January 2015 - 11:24 PM

Hi ggee,

I appreciate the "hoops" you are having to jump through to get the scans completed.

Since we are having to use this method for the time being, let's be sure there is no malware present then we can focus on restoring the Internet completely. I will have to have collegue look over this thread and see if they might be able to offer some insight as to what the cause might be.

bullseye_zpse9eaf36e.gif Malwarebytes' Anti-Malware

Download Malwarebytes' Anti-Malware (save it to your desktop).
    • Windows XP : Double click on the icon to run it.
    • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
  • Select Scan tab.
    MBAMDashboard_zpsddef9b5f.gif
  • Select type of scan to perform:
    MBAMScanTab_zps2c5e74bd.gif
    • Threat Scan < --- Select this type of scan
    • Custom Scan
    • Hyper Scan
  • Next click the Scan button.
  • When the scan is complete, if no malicious items are found you can close the program.
  • If malicious items are found be sure that everything is checked, and click Quarantine .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
=========================

In your next post please provide the following:
  • MBAM log

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days








If you are satisfied with the help you have received, please consider making a donation.

    Advertisements

Register to Remove


#17 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 20 January 2015 - 09:59 AM

Hello,

 

The good thing is that I already have MalwareBytes installed. In fact, it was the last scan I did on my own before starting this whole thread. I will run it as soos as I get back home from work. But I doubt I will be able to update to the latest database definitions,  since I have internet access issues. The last date should be from this Saturday that just pasted.

 

I feel that there might be a firewall issue also at play (this is just my opinion). Its not like my network card is not being recognized. It just wont connect on reboots. All I am doing is unplugging the ethernet wire then plugging it back in. After a few seconds it connects to the internet on its own. But then why would I only have access to these three sites (especially google drive). Its as if all other sites are blocked. But again, that is just my opinion bases on simple logic. And as you know, computer issues almost always seem to defy simple logic. And also, how does this Error 651 effect things? I'm baffled?

 

I'll post the results as soon as I get home from work. Be on the lookout.


Edited by ggee, 20 January 2015 - 10:03 AM.


#18 OCD

OCD

    SuperHelper

  • Malware Team
  • 5,574 posts

Posted 20 January 2015 - 11:10 AM

Hi ggee,
 

I feel that there might be a firewall issue also at play


In post #8 I recommended that you shut off your security software and see if the problem persisted.

Did you try this step?
 

how does this Error 651 effect things?


All the information I have been able to obtain tells me that a Error 651 is a modem issue.

You can view some possible Comcast solutions here: http://customer.comc...roubleshooting/

I am not sure if you have taken all the steps outlined from the above link.


OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days








If you are satisfied with the help you have received, please consider making a donation.


#19 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 20 January 2015 - 01:40 PM

Hi,

 

Yes, everytime I run anyone of your instructed scans - I manually disable my antivirus software. After the scan completes and I submit the results, then I manually restart it. But I have tried accessing the internet with my antivirus off, and I have the same results. My firewall is the default Windows Defender. I have not tried disabling this yet, as I only thought about.a possible firewall issue umtil now (while at work). I will try it as soon as I get home.



#20 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 20 January 2015 - 07:39 PM

Hello,

 

I manually disabled my antivirus softwares and my Windows Firewall. Niether of these actions helped to resolve the internet issue.

I ran the Malware Bytes scan. As I suspected, I could not update the definitions because of the internet issue. But my last definition is date 1/18/15.

The scan ran successfully and no malicious files where found.

 

I will not try some of the steps from the Comcast link you provided. I will report back as soon as I complete it.

In the mean time, can you please request for one of your network/system volunteers to look at this as well.

 

Thanks


Edited by ggee, 20 January 2015 - 08:39 PM.


#21 OCD

OCD

    SuperHelper

  • Malware Team
  • 5,574 posts

Posted 20 January 2015 - 11:54 PM

Hi ggee,
 

In the mean time, can you please request for one of your network/system volunteers to look at this as well.


Other helpers have been offering suggestions on how to corret this problem. Unfortunately, none of their suggestion have resolved the issue.

bullseye_zpse9eaf36e.gif download DevDiag, and save it to your Desktop:
    • Windows XP : Double click on the icon to run it.
    • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
  • At the options screen, please type 2 and hit Enter.
  • The tool will take a few moments to scan. When finished, a report should pop-up, also available on your Desktop (DevDiag.txt).
  • Please do not copy/paste the report into your next reply. Instead, Attach it by clicking Add Reply, and scrolling down to the Attachments section.
=========================
  • Click Start > in the search box type "cmd" (without quotes)
  • Right click cmd and select "Run as Administrator"
  • Type the following command :
  • netsh winsock reset catalog
  • Hit Enter, then type the next command
  • netsh int ip reset reset.log hit
  • Hit Enter
  • Close the DOS window and reboot
  • Check connectivity
=========================

In your next post please provide the following:
 
DevDiag.txt
OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days








If you are satisfied with the help you have received, please consider making a donation.


#22 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 21 January 2015 - 01:08 AM

Hello,

 

I tried the Comcast link and some of its suggections. But these links implied that there is something wrong with the modem or wifi connection. I do not have a modem, instead I have a normal cable router which acts as my gateway (this is a standard cable company standard). My computer is connected via network connection (ethernet wire). This got me thinking about elliminating the router as a cause. So I went into my basement and pulled out two old Win XP computers that have been boxed up for 6 years. Niether of these has been turned on or connected in 6 years, or ever to my current router. I hooked each one up and booted them up. They both took a while to wake up from their long sleep. But once they where up and running, both automatically connected to the internet with no help from me. I was able to go to any web site I wanted with no problems (other then slow performance due to the age of the machines). This tells me my router's connection and set up is not the problem.

 

If all I have to do to my current computer is to unplug the ethernet, and then it connects - then that means my network card is also working and being recognized. The fact that I can only go to three web sites is a mystery (even when all my virus software and firewall is shut down). The same thing happens in firefox and in safe mode. I even took a look at the bios setup and all looks good.

 

This is something with the internet configuration on my computer (either a Windows 7 issue, a registry issue, or possibly a corrupted driver issue). But that would mean I would not be able to connect at all to anything. Why can I only connect to these three sites?

 

I will try these other scans and post my results. I would appreciate it if you actually get a senior member involved, who will actually directly participating in the post. This is causing major issues now.

 

Thanks in advance.



#23 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 21 January 2015 - 01:24 AM

Hello,

 

I completed the DivDiag scan. Please see attached log as you requested.

I performed the cmd prompted you instructed, and rebooted my computer. No change, the issue is still the same.

Attached Files



#24 OCD

OCD

    SuperHelper

  • Malware Team
  • 5,574 posts

Posted 21 January 2015 - 09:32 AM

Hi ggee,

Once again I apologize for the difficulty we are having resolving this issue. And I appreciate all the steps you have taken to eliminate possible causes.
 

I would appreciate it if you actually get a senior member involved, who will actually directly participating in the post.


Other senior members have been participating in helping resolve your issue, but generally they do not post to the topic.

Since the initial clean-up appears to have caused the issue we are presently encountering, lets use System Restore and roll back to before the first fix and see if it corrects the problem.

If that doesn't help then I will refer you to our Tech Team, who are more qualified to handle the connectivity issues you are having.

Please be patient as we are all volunteers, and do this on our own free time.

I appreciate your understanding.


OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days








If you are satisfied with the help you have received, please consider making a donation.


#25 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 21 January 2015 - 11:53 PM

Hello,

 

Before doing a system restore I decided to read all I could regarding Error 651. One of the things I ended up doing was simply uninstalling and reinstalling my network adapter driver, as well as releasing and resetting both my ip address and tcp/ip in the command prompt again. Anyways, during these steps I always needed to reboot at each step per instructions. I have noticed (but not put any mind into it up until now) that since we did that suspected AwdClean that removed system files - I have noticed my machine boots up pretty fast. Much faster then I can remember. I don't know why this made me take a look at the Task Manager, but I did. And I noticed a bunch of services that are stopped. By a bunch, I mean a lot - more then what shows on the screen shot. So I scrolled down the Task Manager and took a screen shot of the services that look like they relate to networking (see attached).

 

This must have something to do with "something"?!?!?! There must be services that are shut down that are affecting my internet connectivity and causing issues.

 

Can you, and the Tech Team take a look at this. In the mean time I will hold off from performing a system restore. I'm at my witts end, and about to throw in the towel - and just do a Window 7 Repair install (although I'm not sure I have a Win 7 disc - it most be misplaced somewhere).

 

BTW - I am now connecting my tablet to my computer via USB so that my computer can detect it. In this way I can download files using my table's wifi connection and save it to the sdcard. Then from my computer, I can navigate to my tablet's sdcard and copy the file to my desktop. So its baically acting as my wifi connected "hard-drive". It's quicker then transferring files via google drive.

 

Anyways..., Please let me know what your thoughts are - thanks

 

Task Manager.png


Edited by ggee, 22 January 2015 - 12:32 AM.

    Advertisements

Register to Remove


#26 OCD

OCD

    SuperHelper

  • Malware Team
  • 5,574 posts

Posted 22 January 2015 - 01:40 AM

Hi ggee,

At first I thought the number of "stopped" items listed in Task Manager did seem a bit odd. With that in mind I opened Task Manager on my machine, clicked on the "Status" column header to sort the entries. My computer has about a 50/50 split as to the Services being either stopped or running.

 

I have not referred you to the Tech Team as of yet, so I cannot say how soon they might reply to my earlier inquiry for assistance. My earlier request for assistance was a general request and have been answered by other malware experts and classroom teachers. But I have not received any input from the Tech Team. If you like I can make the referral, then you would need to start a new topic in their forum asking for assistance.

Check and see if there is any issue with your network adapters.

  • Open Device Manager by clicking the Start button, clicking Control Panel, clicking System,
  • Under System, clicking Device Manager.‌
  • Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
  • Expand the Network Adapter, check for any yellow exclamation points.
  • Right click on each entry and select Properties
  • On the General tab see the device status.
  • Next check the Driver tab, and update if necessary.
  • Select OK to exit.

Any change?

Please let me know how you would like to proceed.


OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days








If you are satisfied with the help you have received, please consider making a donation.


#27 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 22 January 2015 - 01:24 PM

Hello,

 

Please ask the tech team to take my case. At this point I believe you said my malware logs look clean. Can you confirm?

Also, can you please confirm if any of my initial logs, when starting the thread, showed malware traces?

Please refer my case to the Tech Team so that they can pick it up right away. And let me know how to connect with them so that they know its me.

 

BTW - I already did the same steps with my network card and device manager. There wwre no issues and no yellow exclamation point.

 

Thanks


Edited by ggee, 22 January 2015 - 01:27 PM.


#28 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 22 January 2015 - 08:41 PM

Hello,

 

I am about to try a System Restore, per your suggestion. But I just wanted to ask a dumb question first.

 

I took a look at the very first FRST log I did when starting this post (post #1). I then compared it to the second FRST log from post #3. This log was created after running the AdwCleaner. In this second FRST log I see lots of Key Deleted items from the registry, and error items as well. I also know I had, and see the Vosteran.com browser hijacker virus on the log as well. I know I had this infection because I saw this installed after my son downloaded Minecraft without my permission, which is what caused me to uninstall all of it and run my own scans (this was right before starting this thread). I had no issues with my computer after I did my own scans. I beleive my Malware Bytes removed it (but maybe not all of it, which is why I see it in the FRST logs). So I decided to come here just as a precaution and second opinion. Not that I want to place blame or anything, but my issues started here - after the scans I was instructed to do. Hey.., what can you do - sometimes these things happen (it's no ones fault - I'm just retracing my steps in hopes it helps to "light up a bulb" somehow).

 

Anyways, with those two things in mind (the FRST logs from post #3, and the Vosteran traces), and all the stopped services I see in my Task Manager - is this combination what might be the cause of my issue?

 

Also, I have had my antivirus softwares disabled through out all of this. I just decided to restart it, and right away my Spyware Doctor picked up HeurEngine (unknown threat). I googled it and it is know a known virus which changes registry items. I definately do not see this in any of the prior logs. So my computer must have picked it up between when we did the scans together and now. Which means it was either hiding very well and not seen, or my computer just picked it up via the internet. The same internet I cant access. Hmmmm.

 

So I am going to let my Spyware Doctor do a full scan and remove it (this should take about 30-40 minutes). I will restart my computer and recheck everything. Although I doubt it will resolve anything, since the registry and services already are "corrupted" for lack of a better word (in my opinion).

 

Also, have you referred my case to the Tech Team, so that I can begin working with them?

 

Thanks



#29 OCD

OCD

    SuperHelper

  • Malware Team
  • 5,574 posts

Posted 22 January 2015 - 10:39 PM

Hi ggee,

Again I apologize for not being able to have a solution for this issue.

 

To try and address your thoughts from your last post:

The items found in the second FRST log that show the deleted registry items appear normal. FRST only removes the items that are targeted, so based on the initial FRST scan we formulate a script to remove unwanted and malicious entries.

As far as you not having any connection issue prior to seeking help here would lead me to believe that System Restore might be able to get you back to that time. It might be worth a try since all our other attempts have proven futile.

I don't think all the stopped services are an indication or cause of this issue. As I stated my computer has a large number of stopped services as well. And checking in the Device Manager didn't reveal any issues showing.

I apologize for not being clearer about your anti-virus software. I meant for you to re-enable it after you had taken the steps outlined in that particular post.

Since you may have already used System Restore before I have been able to post this reply I cannot say for sure what the malware state of your machine is at this time.

Here is the process for requesting help from the Tech Team.

Tech Team Referral in the General Hardware Forum

Give a brief description of the problem along with a link to this thread so the Tech Team helper can see what we have done already.
http://forums.whatth...howtopic=129191
 


OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days








If you are satisfied with the help you have received, please consider making a donation.


#30 ggee

ggee

    Authentic Member

  • Authentic Member
  • PipPip
  • 78 posts

Posted 23 January 2015 - 09:41 PM

Hello,

 

1- I decided to open up my MS Outlook, and strangely it connected to the internet and new emails came flying into my inbox. I even sent test emails and they went through fine. Strange.

2- I let my Spyware Doctor finish the full scan. It found the HeurEngine (unknown threat) again. It turns out that is was associated with one of the antivirus donwloads you had me do. So this was a false positive (it was for the DivDiag download). I know sometime the tools casue false positves. But I let Spyware Doctor remove it anyway, just to follow through with it and I rebooted. No harm done.

3- In anticipation of doing the System Restore, last night I did a full back up of all my work files/documents/pictures (etc), just in case. This took all night.

4- As I mentioned before - in my opinion after we did the suspected AdwClean is when my computer was booting and running very fast afterwards - but that was also when the internet issues started (I never had crash issues though - before or after).

5- Today I did the Restore and it completed successfully. It rebooted my computer and everything seems to be working again with regards to the internet. It connected automatically without any manual input from me. I can open any website now (in both IE and Firefox). No crash issues either.

6- However, my machine is sluggish. More sluggish then when my son downloaded Minecraft to begin with. But everything is working. It takes longer for it to shut down and reboot, but there are no signs of instability and no crashes.

7- I have not run any scans or WTT tools since completing the System Restore. I wanted to report back to you first.

 

I was hesitantant to use System Restore, becasue I was concerned it would cause my computer to become unstable and start crashing (BSOD). And because the few time that I have had even worse virus issues, the retore never worked or resolved anything. But this time it did. I will manually create and additional System Restore point (without deleting the current points), just in case.

 

I would now like to diagnose my machine again for viruses. But lets hold off on using the remove or fix buttons on the tools, until we are 100% sure nothing will go wrong. I just want to make sure I do not have any viruses on my computer as of right now and safely resolve them if I do. Afterwards we can then work on the sluggishnes and performance part of it.

 

I will wait for your next steps. Thank you for all the help so far.


Edited by ggee, 23 January 2015 - 09:48 PM.

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users