virus wont let me connect to the internet or open spyware/virus protection.

Question

adub 0 Junior Poster in Training

15 Years Ago

I would first like to appologize for not being able to complete everything in the read me first thread. I am on my phone right now so that makes this whole process much more difficult. I would also like to appologize for any bad spelling, grammar and punctuation mistakes....I am normally bad at those and even worst than normal when on my phone. Now on to the problems.

My computer has windows xp. It worked fine for me a few days ago but my wife got on it and must have clicked on somthing she shouldn't have. Now the virus won't let me connect to the internet or open any virus/spyware protection/scaning software that I have tried. I went to a friends house earlier today and downloaded malwarebytes to my flash drive. I saved it under a diffrent name because I had read somthing about that on this site already. It installed fine but still won't open weither I try to open it from the desk top or in the c: drive. If anyone has any info on fixing this I would appriciate it.

windows-virus

5 Contributors
128 Replies
2K Views
2 Months Discussion Span
Latest Post 14 Years Ago Latest Post by PhilliePhan

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 1 · 2009-09-10T11:00:55+00:00

If anyone has any info on fixing this I would appriciate it.

See if you can boot the ill machine to Safe Mode with Networking and access the forum that way. Let us know.

I'll probably be gone until Thursday night, but another volunteer ought to be able to help you.

Best Luck
PP :)

adub 0 Junior Poster in Training · Answer 2 · 2009-09-10T11:32:20+00:00

I tried to connect in safe mode with networking last night and I didnt have any luck. I tried it again now to make sure and it still wouldnt connect. I also figured I would try to run malwarebytes again and it went further than before (it just popped up an error 372 msg). But malwarebytes was still no help.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 3 · 2009-09-10T12:29:01+00:00

I tried to connect in safe mode with networking last night and I didnt have any luck. I tried it again now to make sure and it still wouldnt connect.

Ok - That's going to make things a bit more difficult.

I'd like you to download all of these tools and put them on cd/flash drive and have them ready for use Thursday evening EST, if possible......

1) http://ad13.geekstogo.com/Win32kDiag.exe

2) http://swandog46.geekstogo.com/avenger.zip

3) http://download.bleepingcomputer.com/sUBs/ComboFix.exe
When you download Combofix and it asks you to "Save File As," rename combofix to Bunnyfix.exe and then save it to the desktop or wherever as bunnyfix.exe before you transfer it to cd/flash drive

4) FindIt.zip

5) http://rootrepeal.googlepages.com/RootRepeal.zip

6) Keep your MBA-M handy, too

I'll probably be back Thursday evening/night and will try to guide you through a fix then. Post back when you have those six tools.

Cheers :)
PP

adub 0 Junior Poster in Training · Answer 4 · 2009-09-11T02:26:46+00:00

I have them all except for #5 on your list. When I tried to downlaod it this popped up "The bandwidth or page view limit for this site has been exceeded and the page cannot be viewed at this time. Once the site is below the limit, it will once again begin serving as normal. "

I will try to get it again in an hour or so then I'll message back. Thanks for the help.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 5 · 2009-09-11T02:53:24+00:00

I have them all except for #5 on your list.

Drat! - I should've posted a few mirrors.

If you get a chance, try this link:
http://ad13.geekstogo.com/RootRepeal.exe

I'll be back tonight when I have more time, but the first thing we need to try is this:

Transfer Combofix to the desktop and try to get it to run as bunnyfix.exe.

If it runs . . . post me the log :)

PP

adub 0 Junior Poster in Training · Answer 6 · 2009-09-11T03:10:18+00:00

Ok that linked works so now i have them all. I will try to put bunnyfix.exe on the desk top but yesterday it wouldnt allow me to drag and drop anything or cut and past anything to the desk top. Will it not let me run the program from my flash drive? (im guessing not or you probably wouldnt have specified a location)

adub 0 Junior Poster in Training · Answer 7 · 2009-09-11T03:17:57+00:00

Yea I just tried to cut and past it/copy and past it and drag and drop it but none of that would get it on the desk top. I also right clicked and tried to send it to the desktop and mydocuments and that didnt work either. Is there a way to move things to the desk top that I dont know about?

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 8 · 2009-09-11T03:26:42+00:00

Can you get a command prompt?
Either Start > Run > Cmd
or
Start > Run > Command.com

-- I have to run - be back in a few hours.

Also - I should've suggested this before - see if you can run winsock.fix to try to re-establish internet connection - if it will run.

http://majorgeeks.com/WinSock_XP_Fix_d4372.html

PP :)

adub 0 Junior Poster in Training · Answer 9 · 2009-09-11T04:15:42+00:00

Yes I can get the command prompt (although I dont know anything about it)..is it supposed to help me move the bunnyfix.exe file to my desktop?

Also I ran winsock on the computer. It fixed things then restarted the computer but the computer still wont access the internet.

See you on in a few hours. Thanks again.

caperjack 875 I hate 20 Questions Team Colleague · Answer 10 · 2009-09-11T06:05:46+00:00

a suggestion for malwarebytes ,go to C:\Program Files\Malwarebytes' Anti-Malware,and change mbam.exe to biteme.exe and try running it from there

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 11 · 2009-09-11T06:58:39+00:00

See you on in a few hours. Thanks again.

Happy to try to help :)

What is the path to your external drive? If I were to assume F:\ then we would do this:

Open a command prompt and type:
XCOPY F:\bunnyfix.exe “%userprofile%\desktop” ENTER

See if that works to put combofix on the desktop. If the path is different, you'll need to type the correct path. Note to leave a space after XCOPY and after .exe & don't forget the quotes...

Let me know if this works.

PP :)

adub 0 Junior Poster in Training · Answer 12 · 2009-09-11T07:18:12+00:00

It put bunnyfix.exe on the desk top but when i tried to open it a message popped up that said some of the installation files are currupt and that I needed to redownload it and try again.

Should I just download it again from the link in this thread or try somthing else?

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 13 · 2009-09-11T07:33:04+00:00

Should I just download it again from the link in this thread or try somthing else?

Yes - let's try that again. Getting combofix to run is the best and easiest way to proceed.
This time, try COPY instead of XCOPY and see if that changes anything.

BTW - It is very possible that your Flash drive is infected . . . The best procedure is to burn the tools onto a CD (something non-re-writable)

Let me know how it shakes out :)

-- Did you try Safe Mode With Networking AFTER running WinsockFix?

PP

EDIT: - Let me doublecheck - may need to use a switch with the copy commands....

adub 0 Junior Poster in Training · Answer 14 · 2009-09-11T07:35:06+00:00

I did not try the internet in safe mode networking. I will try that when I get back.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 15 · 2009-09-11T07:43:58+00:00

I did not try the internet in safe mode networking. I will try that when I get back.

I think XCOPY might have borked it. I should have added switches.

Try this:

XCOPY F:\bunnyfix.exe “%userprofile%\desktop” /v /s /h

Let me know:)

adub 0 Junior Poster in Training · Answer 16 · 2009-09-11T08:03:45+00:00

I tried it again with just copy I: and it worked...the scan is running now.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 17 · 2009-09-11T08:09:23+00:00

I tried it again with just copy I: and it worked...the scan is running now.

Great!

Keep me posted :)

PP

adub 0 Junior Poster in Training · Answer 18 · 2009-09-11T08:26:54+00:00

Ok it scanned then told me to write down somethings on paper...after I wrote it all down I clicked Ok and the computer restarted. Now it just has the desktop pulled up (no scans are running or anything).

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 19 · 2009-09-11T08:29:48+00:00

Ok it scanned then told me to write down somethings on paper...after I wrote it all down I clicked Ok and the computer restarted. Now it just has the desktop pulled up (no scans are running or anything).

What did it tell you to write?

Are things functioning better? Can you run MBA-M?

PP :)

adub 0 Junior Poster in Training · Answer 20 · 2009-09-11T08:39:04+00:00

I didnt want to do anything until you said because I didnt want to do anything out of order.

This is what it told me to write down:
C:\WINDOWS\system32\drivers\rotscxxyansxdt.sys
C:\WINDOWS\system32\rotscxjdykmrmi.dll
C:\WINDOWS\system32\rotscxrkrghrnt.dat
C:\WINDOWS\system32\rotscxhmsmwxtp.dll
C:\WINDOWS\system32\rotscxwkvnxicx.dat
C:\WINDOWS\system32\drivers\UACbocfkaftxs.sys
C:\WINDOWS\system32\UACnsdrcunxkq.dll
C:\WINDOWS\system32\UACoiaktqxumn.dll
C:\WINDOWS\system32\UACmoolndvkaw.dat
C:\WINDOWS\system32\UAClialnwnelk.db
C:\WINDOWS\system32\UACdahiwrtppf.dll
C:\WINDOWS\system32\UACyhlcmkotsa.dll

Thats it. I will go and run Malwarebytes now if it will let me.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 21 · 2009-09-11T08:41:39+00:00

This is what it told me to write down:

Those are components of the rootkit that is causing this hassle.

-- Is there a log at C:\ComboFix.txt ?

PP :)

adub 0 Junior Poster in Training · Answer 22 · 2009-09-11T08:52:38+00:00

When I tried to run Malwarebytes I got this message:
Run-time error '372':
Failed to load control 'vbalGrid' from vbalsgridb.ocx. Your version of vbalsgridb.ocx may be outdated. Make sure you are using the version of the control that was provided with your application.

adub 0 Junior Poster in Training · Answer 23 · 2009-09-11T08:56:38+00:00

I dont see this: C:\ComboFix.txt
I went into the C drive and didnt see it. I also went into program files and didnt see it.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 24 · 2009-09-11T09:05:55+00:00

I dont see this: C:\ComboFix.txt
I went into the C drive and didnt see it. I also went into program files and didnt see it.

This is quite a doozy!

-- What about in C:\Qoobox\ComboFix.txt ?

-- How did you transfer MBA-M to the compy?
You might need to reinstall MBA-M.

-- Maybe we can try running combofix again.

-- First, try a command prompt and type rstrui.exe and see if there are any vaible restore points....

PP :)

adub 0 Junior Poster in Training · Answer 25 · 2009-09-11T09:12:49+00:00

\Registry\Machine\System\CurrentControlSet\Services\vkquwexg

*******************

Script file located at: \??\C:\BunnyFix\ComboDel.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\QooBox
*******************

Beginning to process script file:

File move operation C:\WINDOWS\system32\drivers\rotscxxyansxdt.sys|C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\rotscxxyansxdt.sys.vir completed successfully.
File move operation C:\WINDOWS\system32\rotscxjdykmrmi.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\rotscxjdykmrmi.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\rotscxrkrghrnt.dat|C:\QooBox\Quarantine\C\WINDOWS\system32\rotscxrkrghrnt.dat.vir completed successfully.
File move operation C:\WINDOWS\system32\rotscxhmsmwxtp.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\rotscxhmsmwxtp.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\rotscxwkvnxicx.dat|C:\QooBox\Quarantine\C\WINDOWS\system32\rotscxwkvnxicx.dat.vir completed successfully.
File move operation C:\WINDOWS\system32\drivers\UACbocfkaftxs.sys|C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\UACbocfkaftxs.sys.vir completed successfully.
File move operation C:\WINDOWS\system32\UACnsdrcunxkq.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\UACnsdrcunxkq.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\UACoiaktqxumn.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\UACoiaktqxumn.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\UACmoolndvkaw.dat|C:\QooBox\Quarantine\C\WINDOWS\system32\UACmoolndvkaw.dat.vir completed successfully.
File move operation C:\WINDOWS\system32\UAClialnwnelk.db|C:\QooBox\Quarantine\C\WINDOWS\system32\UAClialnwnelk.db.vir completed successfully.
File move operation C:\WINDOWS\system32\UACdahiwrtppf.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\UACdahiwrtppf.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\UACyhlcmkotsa.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\UACyhlcmkotsa.dll.vir completed successfully.
Program C:\BunnyFix\C.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

adub 0 Junior Poster in Training · Answer 26 · 2009-09-11T09:17:37+00:00

"-- First, try a command prompt and type rstrui.exe and see if there are any vaible restore points...."

It is not recognized as an internal or external command. That was what popped up when I tried it.

adub 0 Junior Poster in Training · Answer 27 · 2009-09-11T09:20:18+00:00

Do you have a known working link for Malwarebytes like your other links. I tryed to reinstall it again and it said the same thing so I probably need to redownload it all together.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 28 · 2009-09-11T09:23:29+00:00

"-- First, try a command prompt and type rstrui.exe and see if there are any vaible restore points...."
It is not recognized as an internal or external command. That was what popped up when I tried it.

My fault - doing ten things at once here :)

I should've had you type this:
%systemroot%\system32\restore\rstrui.exe

But, let's wait and do this first:

Reboot.

If combofix doesn't start, run it again and let's see how that shakes out....

PP :)

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 29 · 2009-09-11T09:24:26+00:00

Do you have a known working link for Malwarebytes like your other links. I tryed to reinstall it again and it said the same thing so I probably need to redownload it all together.

Let's wait on that and try my previous post first.

PP :)