Done removal process, logs attached, please help!

[akechi]

Hi there, few days ago my computer caught something bad, it messed up my Internet Explorer so it randomly pop up and load up some Chinese websites, sometimes the process iexplorer.exe will just run in the back ground and takes up a lot of resources.

I noticed there is a pv0007.exe file in my C:\, autorun.inf, auto.exe, etc...

So I did the malware removal process and here are my logs.

I did the rootkit scan as well, but it found nothing.

And after the removal there's another problem, I can't connect to the internet My wireless card is working, I can see the network, but I just can't connect to the internet, the MSN troubleshoot suggests that there might be something wrong with my ports...

That's it for now, thanks in advance!

 

[momok]

Hi akechi and welcome to techspot. =)

Well done with the steps given. For your broken internet access, please download the Winsock Fix from HERE and run it.

You may wish to copy and paste these instructions on notepad for easier reference later.

Download the attached "Combofix-Do.txt" (from my attachment) and save it to the same folder as Combofix.

Boot into safe mode under your normal user name. See how HERE

Next turn on "Show all files and folders, including hidden and system". See how HERE

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

587B8ABC

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.128126.cn/t
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: D-Link AirPlus G Configuration Utility.lnk = ?

O17 - HKLM\System\CCS\Services\Tcpip\..\{6DFE43A5-DF74-449E-99E8-B420271A1EF7}: NameServer = 203.0.178.191
O17 - HKLM\System\CS1\Services\Tcpip\..\{6DFE43A5-DF74-449E-99E8-B420271A1EF7}: NameServer = 203.0.178.191
O17 - HKLM\System\CS2\Services\Tcpip\..\{6DFE43A5-DF74-449E-99E8-B420271A1EF7}: NameServer = 203.0.178.191
(only fix the O17 entries if you do not recognise them to be from your domain or ISP)

O23 - Service: 587B8ABC - Unknown owner - C:\WINDOWS\system32\52F79F94.EXE (file missing)

Close HJT.

Your log is quite badly infected, so I'll just check with you these following folders. If you did not create them, please delete the entire folder and its contents.

C:\Program Files\bkon
C:\Program Files\NGONVOD19371
C:\DOCUME~1\Kenneth\APPLIC~1\Cuckoo

Drag the Combofix-Do.txt that you downloaded earlier over on to Combofix.exe and release.

This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job. Attach the resultant log in your reply.

Reboot into normal mode and rehide your protected OS files.

Thereafter, please post fresh HJT and ComboFix logs from normal mode as attachments into this thread.


Regards,
Your friendly momok =)

This thread is for the use of akechi only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.