Connection problems after removing http://xn--koa.net/server.pac

Sagezu

New Member
Thread author
Jun 10, 2016
11
Yesterday I noticed connection problems and I couldnt open google as it was deemed unsecure. After scanning with malwarebytes I noticed the aforementioned malware, so I procedd to remove all affected files and restarted. I could access google now but connection problems kept persisting so i did a scan with adwcleaner and it detected other threat files and removed them but problem kept persisting and even after doing a repair with Complete Internet repair software or AviraDNSrepair.
Now after removing the malware and making sure there's no trace of it in registry I can access google but connection problems are still present with webpages loading indefinetely until connection is reestablished. This also seems to happen mostly at night strangely enough.
 

Attachments

  • FSS.txt
    2.6 KB · Views: 1

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hello,


Please download Zemana AntiMalware and save it to your Desktop.
  • Install the program and once the installation is complete it will start automatically.
  • Without changing any options, press Scan to begin.
  • After the short scan is finished, if threats are detected press Next to remove them.
Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
  • Open Zemana AntiMalware again.
  • Click on
    4zu6vb.jpg
    icon and double click the latest report.
  • Now click File > Save As and choose your Desktop before pressing Save.
  • The only left thing is to attach saved report in your next message.



FRST.gif
Fix with Farbar Recovery Scan Tool

icon_exclaim.gif
This fix was created for this user for use on that particular machine.
icon_exclaim.gif

icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 

Attachments

  • fixlist.txt
    1.9 KB · Views: 7

Sagezu

New Member
Thread author
Jun 10, 2016
11
Should I delete the 2 files zemana quarantined?
 

Attachments

  • 2016.06.11-13.19.12-i0-t92-d4.txt
    3.1 KB · Views: 7
  • Fixlog.txt
    9.2 KB · Views: 2

Sagezu

New Member
Thread author
Jun 10, 2016
11
Until now everything's been fine, but Im gonna wait till dusk cause thats the time I get the problem. Also thanks for the help.
 

Sagezu

New Member
Thread author
Jun 10, 2016
11
As I expected the connection problem came back, and exactly at 7:48 PM. I've been browsing all day without a single interruption but Idk why this happens only during this time..
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition.txt option is checked.

    2873ryc.png

  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please attach report into your next reply.
 

Sagezu

New Member
Thread author
Jun 10, 2016
11
Not at all as I ve noticed this happens daili around that hour of the day and persists through the night
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Okay, then we will have to use a big fella for this one.

Process Monitor

Extract and run Procmon.exe as Administrator, that is important.

Let it run minimized, it needs to stay active in order to catch how this happens.

When you notice that this happened again, click on File Save and save the Process Monitor Log file so some location you can find. Then zip fhat file up and upload it here: Free large file hosting. Send big files the easy way!

Then copy download link to me.
 

Sagezu

New Member
Thread author
Jun 10, 2016
11
Sorry for not posting sooner as i had been busy with work, anyway seems like the problem doesnt happen aside a single time during the evening,I opened procmon as you said but during the time the problem persisted cause I forgot to keep it open preemptively, SHould I still upload it?
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
I don't see anything in this report.

FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition.txt option is checked.

    2873ryc.png

  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please attach report into your next reply.
 

Sagezu

New Member
Thread author
Jun 10, 2016
11
Ok I kept procmon open this time and gave a general look of the processes enlisted before and after the problem happened, and what i noticed is that after the connection starts lagging the number of avast processes is really high, like if before it occured there were 4-5 lines every once in a while, after there were entire rows of avast processes.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top