Solved No Internet access after removing Malware

[Kiruvi]

Hello,

I installed a freeware dvd burning program that used to be clean and fairly reliable, however it infected my system with UniDeals malware.

I ran malwarebytes, Adw cleaner, manually deleted browser extensions, uninstalled the programs from control panel, etc.

After rebooting the machine, I have no Internet access. Attempting to load any page gives a network connection error, attempting to run ipconfig /renew gives an error that the dhcp server cannot be reached. I've also tried to release the ipconfig, reset tcp/ip stack, and reset winsock.

I've attached the requested logs; any assistance would be greatly appreciated. Thanks!

 

[argus]

We won't provide help for work/business/company computers. Do not ask for help to fix someone's PC.
This forum is run by volunteers that spend their time free of charge trying to help people.
We're not here to help someone earn money.

 

[argus]

Okay,

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyalltemp;
  ipconfig /flushdns;b
  emptyfolderscheck;delete

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[Kiruvi]

Thank you for your help!

The zoek log is below. After rebooting the computer when I got home this afternoon, internet access was working again; I'm a little paranoid as to whether that means the issue is resolved or the infection has returned. I re-ran FRST/aswMBR/adwcleaner and attached the results as well.

Zoek.exe v5.0.0.0 Updated 07-March-2015
Tool run by Aaron on Mon 03/09/2015 at 18:15:30.58.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Aaron\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

3/9/2015 6:16:33 PM Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\PROGRA~2\AGEIA Technologies deleted successfully
C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully
C:\PROGRA~3\Oracle deleted successfully
C:\Users\Aaron\AppData\Roaming\GameSave Manager 3 deleted successfully
C:\Users\Aaron\AppData\Roaming\Opera deleted successfully
C:\Users\Aaron\AppData\Local\calibre-cache deleted successfully
C:\Users\Aaron\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1222839750-4111644155-3756804395-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

ProfilePath: C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\dkwnfvqd.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_20150309_0521_.backup

ProfilePath: C:\Users\Aaron\AppData\Roaming\Nightingale\Profiles\pxip690p.default

user.js not found
---- Lines Lyric removed from prefs.js ----
user_pref("extensions.mlyrics.firstrun", false);
user_pref("extensions.mlyrics.popularity_TERRA", 13);
user_pref("songbird.displayPanes.displaypane_right_sidebar.lastURL", "chrome://mlyrics/content/xul/pane.xul");
user_pref("songbird.displaypane.known.chrome://mlyrics/content/xul/pane.xul", "1");
---- FireFox user.js and prefs.js backups ----

prefs_20150309_0521_.backup

==== Batch Command(s) Run By Tool======================


==== Deleting Files \ Folders ======================

C:\PROGRA~2\AGEIA Technologies not found
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found
C:\Users\Aaron\AppData\Roaming\alsoft.ini deleted
C:\PROGRA~3\InstallMate deleted
C:\PROGRA~3\Package Cache deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\dkwnfvqd.default\searchplugins\steam-search.xml deleted
C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\dkwnfvqd.default\searchplugins\youtube-video-search.xml deleted
C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\dkwnfvqd.default\jetpack deleted
"C:\Users\Aaron\AppData\Roaming\PrintingModule" deleted
"C:\Users\Aaron\AppData\Roaming\PrintsService" deleted
"C:\Users\Aaron\AppData\Roaming\Profiles" deleted
"C:\ProgramData\Quartz Composer" deleted
"C:\ProgramData\Radio Sounds" deleted
"C:\ProgramData\Receipts" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"web2pdfextension@web2pdf.adobedotcom"="F:\Programs\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn" [09/10/2014 08:02 PM]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\dkwnfvqd.default
- Undetermined - tineye@ideeinc.com
- Undetermined - {b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- Undetermined - {DDC359D1-844A-42a7-9AA1-88A850A938A8}
- DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- Enhanced Steam - %ProfilePath%\extensions\jid0-SmvlvxGpvCyG252KbVMqIKR79Uc@jetpack.xpi
- YouTube Center - %ProfilePath%\extensions\jid1-cwbvBTE216jjpg@jetpack.xpi
- Reddit Enhancement Suite - %ProfilePath%\extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi
- TinEye Reverse Image Search - %ProfilePath%\extensions\tineye@ideeinc.com.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
- DownThemAll - %ProfilePath%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi

ProfilePath: C:\Users\Aaron\AppData\Roaming\Nightingale\Profiles\pxip690p.default
- Undetermined - F:\Programs\Nightingale\extensions\albumart@songbirdnest.com
- Undetermined - F:\Programs\Nightingale\extensions\bluemonday@getnightingale.com
- Undetermined - F:\Programs\Nightingale\extensions\foldersync-ng@getnightingale.com
- Undetermined - F:\Programs\Nightingale\extensions\foldersync@rsjtdrjgfuzkfg.com
- Undetermined - F:\Programs\Nightingale\extensions\gonzo@songbirdnest.com
- Undetermined - F:\Programs\Nightingale\extensions\pinkmartini@songbirdnest.com
- Undetermined - F:\Programs\Nightingale\extensions\playlistfolders@getnightingale.com
- Undetermined - F:\Programs\Nightingale\extensions\purplerain@songbirdnest.com
- MLyrics - %ProfilePath%\extensions\{6039188e-d135-11df-bcc9-c7e1ded72085}

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\dkwnfvqd.default
198BED114015C2671C88FDC32CDCB21D - F:\Programs\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll - Adobe Acrobat
B5371D2C9017EEE216B5361D600B3543 - F:\Programs\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector
5174E3BE46B2CCCDAF9CEB5B622CEA9B - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll - Shockwave for Director / Shockwave for Director
8560995C727974F27F2A1CE68909FEB9 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll - Shockwave Flash
0FC325593893749364EC4A733E7D9100 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll - Shockwave Flash
C62322C77D1AAB77B1CF1130FCC3673A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll - Shockwave Flash
98137411B9C632095F919E2CE70B288A - C:\Users\Aaron\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll - Google Update
6C3E34E303DBDCB9F7EC1F7A7F6B1629 - C:\Users\Aaron\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer
2D684F0DDF782C73847BED9503250991 - C:\Users\Aaron\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin


==== Chromium Look ======================

Chrome Hotword Shared Module - Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg
Giant Bomb Plus - Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbcimegpkaolfaoabikeekjlhpeeoeeb

==== Chromium Fix ======================

C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage deleted successfully
C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage-journal deleted successfully
C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.re-markit00.re-markit.co_0.localstorage deleted successfully
C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.re-markit00.re-markit.co_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 239200 deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Aaron\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Aaron\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Aaron\AppData\Local\Mozilla\Firefox\Profiles\dkwnfvqd.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=41 folders=38 52199989 bytes)

==== Empty Temp Folders ======================

C:\Users\Aaron\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Aaron\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun-8-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock" not found
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found

==== EOF on Mon 03/09/2015 at 17:25:05.53 ======================

 

[argus]

Looks good.

 

[Kiruvi]

Yeah I think it's back on track. Ran an Avast deep scan overnight that came up clean, as did malwarebytes and Adw. Thanks for all your help.

 

[argus]

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.


Cheers!