MrCharlie Posted September 7, 2012 ID:594267 Share Posted September 7, 2012 Download these reg files to your desktop:http://download.blee...es/7/mpsdrv.reghttp://download.blee...es/7/MpsSvc.reghttp://download.blee...vices/7/BFE.reghttp://download.blee...es/7/wscsvc.reghttp://download.blee.../7/wuauserv.reghttp://download.blee...ices/7/BITS.regNow double click on each one and allow it to merge into the registry.Reboot and run another FSS scan. MrC Link to post Share on other sites More sharing options...
planex Posted September 8, 2012 Author ID:594662 Share Posted September 8, 2012 Two the reg files gave me errors. See the pictures below. PeerBlock continues to give me the same error after a hard reboot. Attached is the FSS file. Thanks!FSS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted September 8, 2012 ID:594703 Share Posted September 8, 2012 Click on these links and then "Run Now" to run the fix:http://support.microsoft.com/kb/971058http://support.microsoft.com/mats/windows_updatehttp://support.microsoft.com/mats/windows_firewall_diagnostic/en-usReboot > run another FSS scan, MrC Link to post Share on other sites More sharing options...
planex Posted September 9, 2012 Author ID:595136 Share Posted September 9, 2012 The windows firewall diagnostic fix failed. See image below. Will restart, scan with FFS, and post log. Link to post Share on other sites More sharing options...
planex Posted September 9, 2012 Author ID:595137 Share Posted September 9, 2012 Additionally, I used to have my computer set up to stream video through my Xbox 360. I was still able to do this after the malware hit, but since we've bean applying fixes somewhere along the way my Xbox stopped being able to see my PC. This will need to be addressed as well. Thanks! Link to post Share on other sites More sharing options...
MrCharlie Posted September 9, 2012 ID:595138 Share Posted September 9, 2012 Back up the registry before you attempt this:http://www.geekstogo...ry-using-erunt/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Open the registry editor and navigate toHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent.Right-click on subkey "Persistent" and select "Permissions...". In the permissions dialog select "Add...", then "Advanced...", "Find Now", select "Everyone" and "OK"."OK" once again and in the permissions dialog select "Full Control". Do the same forHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\BootTime\Filter.Afterwards you should be able to start the Base Filtering Engine.Let me know, MrC Link to post Share on other sites More sharing options...
planex Posted September 11, 2012 Author ID:595981 Share Posted September 11, 2012 Ok, after a reboot PeerBlock is running properly. I did get a couple of error messages (see the image below) and attached the FSS Scan.FSS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted September 11, 2012 ID:595989 Share Posted September 11, 2012 C:\Windows\System32\Drivers\tcpip.sys[2012-09-11 13:52] - [2012-08-22 11:12] - 1913200 ____A (Microsoft Corporation) F782CAD3CEDBB3F9FFE3BF2775D92DDCPlease find this file and upload to VirusTotal for a free scan, let me know the results (just copy back the url)http://www.virustotal.com/C:\Windows\System32\Drivers\tcpip.sysMrC Link to post Share on other sites More sharing options...
planex Posted September 13, 2012 Author ID:596645 Share Posted September 13, 2012 The file you asked me to scan was in C:\Windows\System32\drivers\en-US and it came up as tcpip.sys.muiI did go ahead and scan it: link Link to post Share on other sites More sharing options...
MrCharlie Posted September 13, 2012 ID:596714 Share Posted September 13, 2012 Please run Farbar Service Scanner.Type the following in the edit box after "Search:".tcpip.sysClick Search Files button and post the log (FSS.txt) it makes to your reply.MrC Link to post Share on other sites More sharing options...
planex Posted September 14, 2012 Author ID:597266 Share Posted September 14, 2012 Ok, here you go.FSS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted September 14, 2012 ID:597271 Share Posted September 14, 2012 Looks OK, would you mind running ComboFix again > there's a chance you may loose you connection again.Please create a new system restore point first before you run it.Delete your copy of ComboFix and download a fresh one and this time run it in safe modehttp://www.bleepingc...nload/combofix/Please post the log when done, MrC Link to post Share on other sites More sharing options...
MrCharlie Posted September 17, 2012 ID:598159 Share Posted September 17, 2012 How are we doing??Do you still need help or can I close this post??MrC Link to post Share on other sites More sharing options...
planex Posted September 18, 2012 Author ID:598643 Share Posted September 18, 2012 Sorry, I'm still here. Life has become very complicated recently. I'm still working on this, but it's going to take some time between steps. Sorry for the lack of communication. Link to post Share on other sites More sharing options...
planex Posted September 27, 2012 Author ID:601918 Share Posted September 27, 2012 I'm still here, but I'm about to move cross-country. I will be afk for about 2 weeks, but am still determined to fix these issues with my PC. Thanks for your patients! Link to post Share on other sites More sharing options...
MrCharlie Posted September 27, 2012 ID:601920 Share Posted September 27, 2012 OK, let me now when you're ready.....MrC Link to post Share on other sites More sharing options...
Staff screen317 Posted October 17, 2012 Staff ID:608259 Share Posted October 17, 2012 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
LDTate Posted November 2, 2012 ID:608865 Share Posted November 2, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts