My system was infected with Sysnetwk.exe & mylucky123 [Solved]

Hello,
A couple of days ago, my machine was infected with some sysnetwk.exe and mylucky123 browser hijack virus. 
I followed a post and was able to successfully remove it with the tools mentioned.

The tools were:
RKill
AdwCleaner

HItmanPro

Zemana AntiMalware.

Although, my machine is fine now, I'm not able to access the Internet through Firefox or Internet Explorer.
I can only access through Google Chrome. I've checked all the necessary proxy related settings and everything is as it were. If anyone could help me with this It'd be much appreciated.

Thanks in advance. 
 

Hello jasonx and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

RKreport.txt
Frst.txt
Addition.txt

Thanks

Satchfan

Looks like that found the problem.

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

• close all programs
• double-click RogueKiller.exe - Windows 7/10: right-click the program and select Run as Administrator'
• after it has completed it's prescan, click on Scan
• when the scan is finished press the Delete button and post the log it produces.

Please then run it again and send the new log

Satchfan

Please be patient as there are no instant fixes.

Please then run it again and send the new log

Before continuing I'd like to see a new RogueKiller log.

Thanks

Apologies for the delay but I'm away from home for a few days so replies may be a bit sporadic.

That log looks fine.

Let's now remove all the remnants of those files that were dealt with. To do that I’ll need a new look with FRST.

First, uninstall and re-install it but this time please don’t rename it and save it directly to your desktop otherwise future fixes won’t work:

Download & run Delfix

• download Delfix from here to remove many of the tools we've used during the cleaning process.
• ensure ‘Remove disinfection tools’ is checked.
• click the Run button.

Download FRST again from here and don’t forget to save it on the desktop.

Thanks

Apologies again. I have just arrived back home and will check your logs and send the next instructions as soon as I can.

Satchfan

P2P - I see you have P2P software, ( BitTorrent and uTorrent), installed on your machine.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

Your computer is very infected and it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. Those who write malware use P2P file-sharing as a major vehicle to spread their wares.

Please see this topic for more information:

P2P File Sharing Risks.

I would strongly recommend that you uninstall them now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep them, please don’t use them until we have finished up here.

===================================================

Run CKScanner

There are signs of illegal software on your system so I would like another scan before we continue.

Download CKScanner by askey127 from here & save it to your Desktop.

• double-click CKScanner.exe then click Search For Files
• when the cursor hourglass disappears, click Save List To File
• a message box will verify the file saved
• double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply.

Satchfan

I've uninstalled uTorrent.

Here's the log

I've uninstalled uTorrent.

Wise move. These P2P sites really are unsafe – now more than ever.


There seems to be an inconsistency in the results of that log but we’ll see how the next one looks.

You need to uninstall all cracked/pirated software and make sure that these files no longer exist, (ie, when you have uninstalled the programs):

c:\users\jason\desktop\tuneup utilities 2014 14.0.1000.296 final incl. keygen-rept\install notes (please read).txt
c:\users\jason\desktop\tuneup utilities 2014 14.0.1000.296 final incl. keygen-rept\torrent downloaded from extratorrent.cc.txt
c:\users\jason\desktop\tuneup utilities 2014 14.0.1000.296 final incl. keygen-rept\torrent downloaded from kickass.to.txt
c:\users\jason\desktop\tuneup utilities 2014 14.0.1000.296 final incl. keygen-rept\torrent downloaded from thepiratebay.se.txt
c:\users\jason\desktop\tuneup utilities 2014 14.0.1000.296 final incl. keygen-rept\tuneuputilities2014_en-us.exe
c:\users\jason\desktop\tuneup utilities 2014 14.0.1000.296 final incl. keygen-rept\keygen-rept\keygen.exe
c:\users\jason\documents\acunetix_web_vulnerability_scanner_9.x_consultant_edition_keygen_hmily[lcg].zip
c:\users\jason\documents\phone new\download\whatsappplusv5.07dcrack-1.apk
c:\users\jason\documents\phone new\download\whatsappplusv5.07dcrack.apk
c:\users\jason\downloads\[kickass.ytsre.net]tuneup.utilities.2014.14.0.1000.296.final.incl.keygen.rept.atom.torrent
c:\users\jason\downloads\adobe photoshop cs5 extended\crack\adbe_crack - 32bit.rar
c:\users\jason\downloads\adobe photoshop cs5 extended\crack\adbe_crack - 64bit.rar
c:\users\jason\downloads\adobe photoshop cs5 extended\crack\apcs5 - crack read me.txt
c:\users\jason\downloads\hello\wndrsredrphnecrack-crackmania.rar
c:\users\jason\downloads\hello\[kat.cr]nfs.carbon.crack.english.ktm.exc.f.250.pc.torrent

When you’ve done that, please run CKScanner again and send the new log.

Thanks

Satchfan

I've deleted/uninstalled everything you asked me to. 

Here's the new log