DNS Changer removal breaks internet

[srd]

After running Malwarebytes and eliminating all but 1finding, if  I delete the last one which is a "dns changer"  in the registry, the internet connection stops working. I can restore the os but the dnschanger remains. I'm sure you guys have come across this before and would really appreciate the help in removing it. The machine is our businesses server, windows 8.2.

Thanks in advance

Steve

[Aura]

Hi srd

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

• As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
• As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
• The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
• If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
• If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
• Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
• I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules
• In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
• I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
  This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread
  

This being said, it's time to clean-up some malware, so let's get started, shall we?

Follow the instructions in the thread below, and provide me both FRST logs (FRST.txt and Addition.txt) and the Malwarebytes log. You can attach them in your next post, or copy/paste their content.

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

[srd]

Hello Yoan, pleased to meet you and thanks for the help.

Attached are the files you requested.

Steve

tuesdayScan.txt

FRST.txt

Addition.txt

[shadowwar]

This was fixed recently in the latest version Of Malwarebytes. If you want please go to settings and then application and hit install application updates to update to the latest version. Let me know if it doesnt solve the broken internet issue. Was this just edge it was broken with?

 

[srd]

Did what you asked. Ran the scan and quarantined the file. Rebooted and no internet. Since this is our server I need it to get back up. Before I removed the file, I set a restore point. Now it can't restore. I turned off the Malwarebytes protection, but it still won't restore the internet connection. I've tried a couple of different restore points.

 

Steve

 

[Aura]

Seems like your server is still infected, so we'll remove the infection before proceeding.

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Fix button
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
• Copy and paste its content in your next reply
  

fixlist.txt

[srd]

Quote

when I click on "FIX" a window appears saying no "fixlist.txt" found

 

 

[Aura]

Did you download the fixlist.txt file that was attached in my previous post? And it needs to be in the same folder as the FRST executable.

[srd]

I didn't...my bad. OK here is the log from the "FIX"

FRST.txt

[Aura]

The logfile should be called fixlog.txt and it should be on your desktop.

[srd]

got it...here it is

Fixlog.txt

[Aura]

Good! Now you should have a folder called C:\FRST\Quarantine. Can you .zip it and attach it in your next post?

[srd]

Don't have a .zip program, but I'll get one.

 

[Aura]

Zipping file is a built-in Windows feature. Simply right-click on the folder you want to .zip, go to Send to and select Compressed (zipped) folder.

[srd]

Got it, but error says need to change some names because they are Russian.

[srd]

the file size is too big...75 mb

[Aura]

You can upload it on SendSpace.com and PM me the download link for it.

[srd]

I'll have to do it tomorrow when I go back to work where the computer is.

 

Thanks for the help

[Aura]

All good, I'll be waiting  

[srd]

Hey Yoan,  Just wanted to make sure you got the link for the Quarantie.zip file.

 

Steve

[Aura]

Good. Run the following FRST fix and attach the fixlog.txt here after.

fixlist.txt

[srd]

here ya go...

Fixlog.txt

[Aura]

Alright. Give me a bit, I reported that issue to Malwarebytes to see if they can address this somehow. I'll also look into it tonight when I get home and have access to my Windows 8.1 VM.

[Aura]

Farbar Service Scanner (FSS)
Follow the instructions below to run Farbar Service Scanner and provide a log.

• Download Farbar Service Scanner and move the executable to your Desktop
• Right-click on FSS.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Check every options:
  
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
  • Other Services
    
  
  
• Once done, click on the Scan button to launch a scan
• On completion, a Notepad file called FSS.txt (saved where FSS.exe was ran) will open. Copy and paste the content of this file in your next reply and post it
  

[shadowwar]

We are looking into this. We resolved an issue with windows 10 permissions. Which was the fix i mentioned. Seems there is still an issue with 8.1. Thanks for all the logs and reporting.

Aura please fix him and i am in touch with dev.