Losing network connection after cleaning

[deathtospyware]

Had a PC that was infected with both trojans and viruses. Used Mbam to clean and it seemed successful and viruses were removed with AV software. Still a couple of days later the network quit. Ran Mbam and AV again but nothing was found. HijackThis scan also found nothing. Downloaded ComboFix and it found several items some which were cleaned but there are entries in the log file I'm not sure of what they mean as I have never seen these before. Could someone take a look at the ComboFix log and perhaps steer me in the right direction? Thanks.

attach.zip

[screen317]

Hi and welcome to Malwarebytes.

Do you still need help?

[deathtospyware]

I was just wondering what the following was:

"5779:TCP"= 5779:TCP:rruydmo

I have not run across this before and haven't been able to find any info on it. It's in the [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

section of the log file. Thanks.

[screen317]

The random nature of the text appended to the end is suspicious to me. There is other malware present in your log, so let's take care of that too.

First, please go to VirusTotal, and upload the following file for analysis:

c:\windows\system32\advpack.dll

Post the results in your reply.

Next, please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.

Next, please open Notepad - don't use any other text editor than notepad or the script will fail.

Copy/paste the text in the quotebox below into Notepad:

Driver::

gbfcnqgkd

hpopar03

ddzftkom

ofohzg

qzqqndex

Netsvc::

gbfcnqgkd

KILLALL::

Dirlook::

c:\documents and settings\Owner\Local Settings\Application Data\trchwe

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5779:TCP"=-

Filelook::

c:\windows\system32\advpack.dll

Save this as CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Finally, update MBAM, run a Quick Scan, and post its log.

-screen317

[deathtospyware]

Sorry for the delay but here are the scan results you requested. Unknown entry in Winsock found in HijackThis log, MBAM scan was clean.

allscansresult.zip

[screen317]

Hi,

Please post logs directly into your reply instead of attaching them.

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  conime.exe

  
  

• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.

• Click Start Scanning.
  
• You should get a notification bar (on top) to install the ActiveX control.
  
• Click on it and select to install the ActiveX.
  
• Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
  
• In case you are having problems with installing the ActiveX/starting the scan, please read here.
  
• Click the Full System Scan button.
  
• It will start to download scanner components and databases. This can take a while.
  
• The main scan will start.
  
• Once the scan has finished scanning, click the Automatic cleaning (recommended) button
  
• It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
  
• The cleaning can take a while, so please be patient.
  
• Then click the Show report button and Copy/Paste what is present under results in your next reply.
  

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[deathtospyware]

Again my apologies for being so slow in responding. Here are the results you asked for with the exception of the F-Secure scan which only found some tracking cookies. I believe the PC is now clean.

SystemLook v1.0 by jpshortstuff (11.01.10)

Log created at 14:09 on 06/04/2010 by Owner (Administrator - Elevation successful)

========== filefind ==========

Searching for "conime.exe"

C:\WINDOWS\$NtServicePackUninstall$\conime.exe -----c 27648 bytes [02:34 18/03/2010] [12:00 04/08/2004] 054DF8F752497C6B74DD7B65CCA61132

C:\WINDOWS\ServicePackFiles\i386\conime.exe ------ 27648 bytes [22:01 26/08/2008] [00:12 14/04/2008] ABC9002269E569538901109441660DD2

C:\WINDOWS\system32\conime.exe --a--- 27648 bytes [12:00 04/08/2004] [00:12 14/04/2008] ABC9002269E569538901109441660DD2

-=End Of File=-

Results of screen317's Security Check version 0.99.2

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

McAfee SecurityCenter

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 18

Adobe Flash Player 10

Adobe Reader 9.3

````````````````````````````````

Process Check:

objlist.exe by Laurent

McAfee VIRUSS~1 mcshield.exe

McAfee VIRUSS~1 mcsysmon.exe

McAfee VIRUSS~1 mcods.exe

mcafee VIRUSS~1 mcvsshld.exe

````````````````````````````````

DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Thank you for all your help. A recent scan with MBAM also came up with no problems.

[screen317]

Hi,

Delete SystemLook.

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following programs (if present):

Java

[deathtospyware]

Wouldn't you know Java 6 19 would come out right as I was doing the last request. It requested the update and I applied it so that was taken care of. Removed the others per your request. Everything seems to be working fine now.

[screen317]

Great.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Download and install IE-Spyad, which will place over 5000 'bad' sites on your Internet Explorer Restricted List. A tutorial on it can be found here.

3) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

4) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

5) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

6) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!