Fake Alert Trojan - No internet connection

[nana1]

My computer was attacked by a fake virus protection program. My VP (AVG 9.0) did not detect it. I ran several scans and Malwarebytes found a "Trjoan Fake Alert". It has been deleted, and I have run several more scans but I still cannot connect to the internet. I get the "Unable to find Web Page" Windows message. Their "diagnostic" is that it is a firewall issue. I cannot update my Malwarebytes because I cannot connect to the internet. When I try I get error message "732 (0,0)". I am running version 1.40, database version 2749, Windows 5.1.2600 service pack 3. My OS is Windows XP.

I have seen sites that provide instruction about file removals to clean the system, but I am somewhat of a novice at this. Any reliable instructions for further cleaning would be appreciated.

[Firefox]

Hello and Welcome to Malwarebytes....

For a 732 Error....

Step 1: Verify Internet Connectivity of Internet Explorer:

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

• Please download ERUNT from here
  
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  
• Double click on erunt-setup.exe to Install ERUNT by following the prompts.
  
• Use the default install settings but say NO to the portion that asks you to add ERUNT to the Start-Up folder. You can enable this option later if you wish.
  
• Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
  
• Choose a location for the backup.
  
  • Note: the default location is C:\Windows\ERDNT which is acceptable.
    

  [*]Make sure that at least the first two check boxes are selected.

  [*]Click on OK

  [*]Then click on YES to create the folder.

Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

Once you've completed backing up your Registry, please do the following:

• Click on Start and select Run
  
• In the Run box copy and paste the text in the following code box exactly as written and press Enter or click on OK:

  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v GlobalUserOffline /t REG_DWORD /d 0 /f

  
  

• Try updating again and if it does not work then please proceed to Step 2
  

Step 2: Verify Your Internet Connection Settings:

• Open Internet Explorer
  
  • Note: It MUST be Internet Explorer, not Firefox, Opera, Chrome or any other internet browser
    

  [*]Click on Tools at the top and select Internet Options

  • Note: If you do not see Tools, press the Alt key on your keyboard and it will show up
    

  [*]Click on the Connections tab

  [*]Click on the LAN settings button

  [*]Under Automatic configuration make sure that the box next to Automatically detect settings is checked, if it is not, then click the box next to it to check it

  [*]Under Proxy server make sure that the box next to Use a proxy server for your LAN (These settings will not apply to dial-up or VPN connections). is not checked and if it is, click the box next to it to uncheck it

  [*]Click on the OK button to close the Local Area Network (LAN) Settings window

  [*]Click on the OK button to close the Internet Options window

  [*]Try updating Malwarebytes' Anti-Malware again to see if it now works correctly

Now try updating Malwarebytes' Anti-Malware once more and if it does not work then please proceed to Step 3

Step 3: Exclude Malwarebytes' Anti-Malware's Files and Folders From Other Active Security Programs:

For Windows XP:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

For Windows Vista or Windows 7:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

For 64 bit versions of Windows Vista or Windows 7:

• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\SysWoW64\drivers\mbamswissarmy.sys
  

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude MBAM.EXE from it as well

Step 4: Ping the Content Delivery Network

For Windows XP:

Click on START - RUN and type in or Copy/Paste the following and verify that you get a response

CMD.EXE /K PING mbam-cdn.malwarebytes.org

For Windows Vista or Windows 7:

Click on START and in the search line type in CMD and press the Enter key

Then in the DOS console window type in the following and press the Enter key and verify that you get a response

PING mbam-cdn.malwarebytes.org

The FAQ contains examples of setting file exclusions for some known AV products.

[nana1]

Thank you for your response. However, I am accessing this forum from a separate computer, since I cannot connect, in normal mode, to the internet from the computer with the problem. I can connect in safe mode. Can I download the ERUNT program you've recommended while in safe mode and make the back up from there following your instructions? If so, then should I do the rest of the steps in normal mode or can they be done from safe mode? I have run my Malwarebytes in normal mode up to this point.

Thanks again...

[Firefox]

Yes that should be fine... do all the steps in normal mode.

Download any files needed to a flash drive (from a computer that has internet) and use them from there if you have to.

[marktreg]

I am running version 1.40, database version 2749.

Just thought I should mention that your version of Malwarebytes is badly out of date. The latest version is 1.45 and the latest database version is 4008.

When you get online again, please follow the instructions below:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to the following:
  
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
    

  [*]Then click Finish.

  [*]If an update is found, it will download and install the latest version.

  [*]Once the program has loaded, select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad and if required the program will ask you to reboot to remove locked files.

[Firefox]

Doh.... Slap me with a stick.... I missed that one.... LOL

[marktreg]

LOL. No worries, Firefox. I've missed worse than that before.

[nana1]

Wanted to say THANK YOU for your help - fortunately, I was able to resolve the issue by doing a System

Restore. Once I did that, I was able to open Malwarebytes and update. I ran a complete scan and it found a Registry Key infected with the same virus. I deleted it and have run daily scans since the 21st with no infections found. So I didn't have to use your instructions, but I do appreciate your taking the time to reply.

Nana1

[Firefox]

Great, glad to hear you got it sorted out.