Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Jamec on August 29, 2011, 07:33:50 AM
-
Hello,
I think it is important to mention that I possess mediocre, at best, computer skills. I also performed a search of the forum in reference to my problem and was not able to find much.
That said, my notebook recently contracted some sort of virus; however, the virus did not affect the computer's ability to access/browse the internet; just pop ups, false security reports and so on.
I was advised to download the free version of Avast. I was unable to download it effectively to the damaged notebook in regular mode or in safe mode so I downloaded it to another computer, transferred it via external hard drive, and uploaded it to the notebook.
I ran it and it detected 40 some 'infected files' which I then deleted. Upon restarting the notebook I could no longer access the internet via firefox or internet explorer. I am greeted with a 'there was a problem...could not detect server' screen every time I attempt to open the web browser.
I already ran 'netsh winsock reset' as well as fiddled with the proxy settings on the notebook all to no avail.
There is no problem with my internet connection/modem either at home or at work. Thus, the problem is definitely local to the notebook.
I would appreciate any suggestions from the resident experts. Thank you
-
did you have any AV installed before installing avast ?
if so, did you remove it before installing avast ?
if removed, did you run a removal tool to clear any leftovers ?
Uninstallers for Security Software - run and reboot
http://thewebatom.net/uninstallers/security-software/
That said, my notebook recently contracted some sort of virus;
check for malware using this
Malwarebytes Anti-Malware 1.50.1 http://filehippo.com/download_malwarebytes_anti_malware/
make sure the program is updated before you scan
click on the remove selected button to quarantine anything found
if anything is found, you may post the scan log here
-
Thank you for the reply
I failed to mention in my initial post that I had malware bytes already installed on the computer and whatever virus the computer contracted would not allow me to run malwarebytes; even in safe mode. I then uninstalled malware bytes from the notebook; however, I did not use a removal tool.
I'll see if I can download the removal tool with my other computer to an external hard drive and use it on the disabled notebook. Then, based upon your advice, I will download malwarebytes on my other computer, transfer it via external hard drive to the notebook, run it, and see what happens.
-
I then uninstalled malware bytes from the notebook; however, I did not use a removal tool.
MBAM works perfectly fine alongside any AV program....but running more then one AV will create all kind of windows errors and false positive detections
you may also try this....as this will be fully updated when you download
you can run it directly from the USB stick
SUPERAntiSpyware Portable Scanner
http://superantispyware.com/portablescanner.html?tag=SAS_HOMEPAGE
-
Ok, If I understand you correctly should I then run the removal tool for MBAM but not re-install MBAM and just stick with Avast?
-
you do not need to run removal tool for Malwarebytes as it does not conflict
see what Superantispyware can do first, if that works fine then try to install MBAM again, update it and run it
-
Understood. I will be taking action in the morning and then provide an update with my status. Thank you
-
if you still have problems after this, then there is a guide here on how to continue
http://forum.avast.com/index.php?topic=53253.0
post (attach ) the logs essexboy need to help you
and since you have already started this topic here you do not need to start a new one, i will notifie essexboy so he will monitor this
he usually arrive here late UK time..
-
Apologies for interrupting but, if I understand correctly, you can't use any web browser, not even in "safe mode with network connection"?
Although it could be some malware-related problem, the possibility that some of the files already deleted were somehow related to web browsing is still opened. So maybe installing anew your web browser (and reboot) could help?
Of course, you still need to check your system for malware anyway.
(BTW, web browsing under Windows is very related to the OS itself, so the deleted files and/or malware you have/had might have been related to system files too. In such a case, the system might be in a not-so-stable condition.)
-
Ok,
Pondus, as you noted, a machine with more than one anti-virus system installed may result in each system detecting aspects of the other.
This is what has happened. I ran Avast, complete scan and boot scan, and zero hazards were detected.
I then installed the super anti spyware, via my other computer and external hard drive, and it, to my surprise, found loads of infections which I then removed.
I then installed MBAM, via my other computer and external hard drive, however I could not update it on the notebook because MBAM could not connect to the internet. So I ran it anyway and it only found 3 infections; however, I think they may have been from the external hard drive- I've attached that scan file to this post.
I should note that I made the mistake of having the super anti spyware scan my external hard drive as well as the notebook hard drive so I'm sure it found infections in both.
ady4um, I appreciate your comment and what you've said makes perfect sense; however, I do not possess the skill set to determine what needs fixing and I cannot download a new browser because I cannot access the internet.
Despite the fact that I've ran Avast, MBAM (albeit not updated), and SAS, the notebook is still remarkably slower to shut down as well as boot up (versus its pre-virus state) and I'm still unable to access the internet.
SAS log is attached.
Thanks for all your time
-
well most of what SAS found is tracking cookies and this is not malware,
and your malwarebytes log say "no action taken" you need to click the remove selected button after the scan to quarantine the infection
now you should follow the guide ( see the link i posted ) and attach the OTL and aswMBR logs
-
Will do Pondus. I actually saved the MBAM scan log before I hit the 'remove' tab so they were, in fact, removed.
I will run the OTL and aswMBR programs today.
Thanks again
-
I ran the OTL and aswMBR programs; however, I screwed up and ran the OTL program without copying and pasting the custom scan instructions from the other thread. When I re-ran the program with the instructions it produced the OTL log but not the extra text log.
I also failed to save the logs in ANSI format.
At any rate, I've attached the scan logs from both programs to this post.
Thank you for the assistance and tolerating my incompetence in these matters.
-
essexboy is notified, he is usually in here around 08:00pm - 11:59pm uk time
-
What I will do here is remove the remant I can see, clear all the temp files and flush the DNS. Once done could you try to connect again, wirelessly at first and then with an ethernet cable, letting me know the reults on completion
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
[2011/08/23 20:30:29 | 000,000,000 | ---- | M] () -- C:\WINDOWS\776373457
:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
Thank you for the assistance Essexboy
I followed your instructions to the letter and have attached the quick scan log to this post.
I tried to use my web browser with no success. I continue to be met with a "problem loading page" window which reads "server not found...firefox can't find the server at www.google.com"
-
OK lets try a little trick here, also do you get the same error with IE ?
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..network.proxy.type: 4
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
Ok, I ran your instructions and have posted two logs.
The first one appeared immediately after I rebooted the computer and the other one is the quick scan log.
I am still unable to connect to the internet with firefox or ie; it's the same 'cannot find server...' message
Thanks again
-
Prior to this did you have a firewall installed that you removed by using add/remove ?
-
Prior to this did you have a firewall installed that you removed by using add/remove ?
No, as far as I can tell the windows firewall was never activated and I never removed one.
-
The reason I ask is that if you had McAfee before and it failed to uninstall properly the firewall element will block internet access
Download and run winsockxp fix from here http://www.snapfiles.com/get/winsockxpfix.html
Then could you download and run the following programme
Please download (http://artellos.com/sino-page) SINO by Artellos (http://artellos.com/me).
- Save SINO to a place you can remember and run SINO.exe. (If you downloaded the ZIP version you will need to extract it first)
- Then please check the following checkboxes:
System Info
Services
Boot Check
Tasklist
Startup Items
Event Log
Ipconfig
Ping
Netstat
Hosts file
Shares
Routing Table- Once checked, hit the Run Scan! button and wait for the program to finish the scan.
- A notepad window will pop up. Please copy all of the content into your next reply.
Note: If you try to interact with the program once it’s started scanning it might appear to hang. The scan however will continue.
-
I ran the winsockfix program; however, I am unable to run the SINO program.
I downloaded the .exe version and when I run it on my notebook SINO states that it's unable to connect and that it will run the current version.
I hit ok
I then check all of the tick boxes that you listed and every time I hit 'run scan' a window pops up stating that:
"No selection has been made
You haven't made a selection
Please select one or more tick boxes to proceed"
When in fact I'm checking all of the boxes
-
OK that shows that there is no connection at all
Could you go to control panel > Device manager and let me know if there are any yellow exclamation marks there. If there are could you let me know the name of the devices
Then go to control panel > network connectors and right click on the one marked local area connection (ignore 1394 devices).
Go to properties and scroll down the list until you reach tcp/ip
Double click to select properties and confirm under the general tab that the device is set to obtain IP addresses automatically -if they were preset, make a note of the numbers before you change anything.
If you change anything, click OK and reboot to make sure the cache is cleared and settings applied. See if this fixed it.
-
OK that shows that there is no connection at all
Could you go to control panel > Device manager and let me know if there are any yellow exclamation marks there. If there are could you let me know the name of the devices
Then go to control panel > network connectors and right click on the one marked local area connection (ignore 1394 devices).
Go to properties and scroll down the list until you reach tcp/ip
Double click to select properties and confirm under the general tab that the device is set to obtain IP addresses automatically -if they were preset, make a note of the numbers before you change anything.
If you change anything, click OK and reboot to make sure the cache is cleared and settings applied. See if this fixed it.
It took me a while to find the device manager. had to go through administrative tools and few other windows. I do not see any yellow exclamation marks. When I click on device manager it opens a drop down list of devices. That's it.
As for the network connection, I only have wireless. That said, the setting within tcp/ip is as you have listed 'detect IP addresses automatically'
-
Next stage is to restore the computer to a time when you had internet connection, but first uninstall Avast. This may bring back some of the malware but I can remove that manually
Once you have restored then run OTL again and let me know if the connection is restored
-
I restored the notebook to a pre-infection date and ran the full OTL scan
Still no internet
OTL scan log is attached
Thanks for your continued assistance
-
Hmm this is curious
Could you go to device manager please
Open it up then locate the network devices
Expand that
And take a screenshot to post
-
Forgive my lack of computer skill Essexboy- I do not know how to take a screen shot. Please provide me with instructions
-
Forgive my lack of computer skill Essexboy- I do not know how to take a screen shot. Please provide me with instructions
Please read:
How to attach a Picture or File on the forum:
http://forum.avast.com/index.php?topic=8982.0
What is your operating system as you will need an application to take the screen shot.
I like CaptureIt Plus:
http://captureitplus.codeplex.com
-
@Jamec,
You have a "print screen" key in your keyboard. In my keyboard, it reads as "Prt Sc" over a text that reads "SysRq" in the same key.
So, in MY keyboard, when the focus is on the screen you want to copy, I would use the following simultaneous combination of keys:
<Ctrl>+<Alt>+<Shift>+<PrtSc>
This puts the screenshot in memory. Open the Windows program named "Paint" (start menu -> accessories -> Paint) and press <Ctrl>+<V>, which should paste your screenshot. Save that file as "screen1.JPG" for example, and attach it ti your next post.
HTH.
-
Thank you ady4um, excellent instructions
Essexboy, screen shot of the device manager is attached.
-
@Jamec,
Here I quote essexboy with the request. In your device manager, you need to open (click on the plus sign) the "network adapters" and only *then* take the screenshot.
Hmm this is curious
Could you go to device manager please
Open it up then locate the network devices
Expand that
And take a screenshot to post
-
Thanks ady4um, I wonder how many times I'm going to embarrass myself on this thread.
correct screen shot is attached
-
Could you now download and install this driver http://download.cnet.com/Broadcom-802-11g-Network-Adapter/3000-2112_4-162122.html
Then run the command prompt
To get the command prompt :
Go Start > Run
Type cmd.exe
In the black box that opens
Type in the following pressing enter after each line
ipconfig /flushdns
ipconfig /registerdns
NEXT
Go to Start and click on Run.
Type Services.msc in the Run command box.
A window listing all the services will pop up.
Search for a service called DNS Client.
Double click the listed DNS Client service and click Start.
-
essexboy, when I state my computer skills are remedial I'm not exaggerating.
I downloaded the zip file; however, I do not know how to install it.
When I click on the downloaded folder it just reveals its components
-
Right click the "zip folder" and select "extract all". It will create a new folder with the name of the zip. Run the .exe file in that folder. Once the installation of the driver finished, reboot.
-
I did as you said already; however, the problem I'm having is that there is no .exe in the extracted zip folder
-
What do you see in the zip?
-
What do you see in the zip?
I open the zip and there's a folder: 80211g
I open that folder and there's 4 files:
- bcm43xx.cat
- bcmwl5.inf
- BCMWL564.SYS
- Version.txt
-
I *GUESS* that what essexboy wants from you is to run the *.inf file, but not from inside the zip itself.
Close every other program, including the device manager you have open before.
Open the new folder, the one that was created after the "extract all..." (be carefull not to confuse it with the zip!!!).
From that folder, right click the inf file and you should see "install" Run it, and when all is finished, reboot.
Just to be clear, I don't know what the driver "exactly" includes, so I don't know what exactly you will see after running the inf file. If you are unsure, you'd better come back and ask essexboy and wait for his answer.
-
Ok, I did as you said, hit install, the screen blipped and that was it. Not knowing if anything was installed I rebooted anyway.
I then ran the command prompt according to essexboy's instructions; however, this is what the response was:
windows IP configuration
an internal error occurred: The request is not supported
please contact microsoft product support services for further help
additional information: unable to query host name
does this mean that the driver did not install?
-
According to your description, it "seems" it wasn't. If it is, then it should be also present in the device manager. I'd tend to think that more details should come from essexboy, since he probably knows what you should have expected to see and do. I am just trying to accelerate your posts/feedback for him if I can (considering that previous posts between you 2 have been taking several hours each day).
So, essexboy?
-
I appreciate it. Now that my notebook is unable to connect to the internet I only have internet access in the evenings and weekends and I am on pacific standard time.
-
In the meantime, look for the new installed driver "somewhere" (click all plus signs) in the list of device manager (although I'm not sure if it was actually successfully installed), until essexboy comes back.
-
I looked under all of the headings in the device manager and it doesn't appear as if it was successfully installed. Of course, I could be missing something.
Thanks for your time
-
No it was installed. I did not realise that , that driver version had an inf rather than a exe
Did you check the services.msc to confirm that the DNS client was running
There are slight differences as I am running windows 7, but you should see something similar within the services
Ensure the service is started and set to automatic start
-
No it was installed. I did not realise that , that driver version had an inf rather than a exe
Did you check the services.msc to confirm that the DNS client was running
There are slight differences as I am running windows 7, but you should see something similar within the services
Ensure the service is started and set to automatic start
Ok, yes it is set to automatic however it was 'stopped'.
I clicked the start button and this window appeared:
"services"
could not start the DNS client service on local computer
error 1068: the dependency service or group failed to start
-
Do you have a windows cd as it looks like we may need to do a sfc /scannow on this
These are the dependencies
-
Do you have a windows cd as it looks like we may need to do a sfc /scannow on this
I might have one somewhere from another computer. I'll have to check; however, I don't have an external CD unit and the notebook doesn't have a CD drive.
-
OK that is not to good
Go to the Run box on the Start Menu and type in:
sfc /scannow
Note the space between sfc and the /
-
I ran it and this window appeared:
Windows File Protection
Files that are required for windows to run properly must be copied to the DLL Cache
Insert your windows xp home edition cd-rom now
which I am unable to do...
-
I keep hitting cancel, regarding the command to insert the cd, and the program is still running. I'll let you know what happens upon its completion.
-
The window just keeps popping up asking if I'm sure I want to 'skip this action' (regarding not inserting the windows xp cd) so I shut it down
-
Looks like a reinstall may be required... But lets do a search for the files that appear to be absent first
- Run OTL.
- Select All Users
- Under the Custom Scan box paste this in
/md5start
tcpip.*
nsisvc.*
/md5stop
CREATERESTOREPOINT
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
-
scan log is attached
-
OK the Nlasvc file is missing
Go to my site here https://skydrive.live.com/?cid=32d8666f4048075b#cid=32D8666F4048075B&id=32D8666F4048075B%21117 (https://skydrive.live.com/?cid=32d8666f4048075b#cid=32D8666F4048075B&id=32D8666F4048075B%21117)
Scroll down until you find nlasvc.zip
Download this, unzip and copy nlasvc.dll to your c:\windows\system32 folder
Then :
1. Press "Start" and select "Run".
2. Type CMD and press Enter.
3. Type regsvr32 nlasvc.dll and press enter again.
4. Reboot and then try to connect again
-
I followed your instructions with precision.
After typing the instructions in the cmd and hitting enter a window popped up stating:
RegSvr32
LoadlLibrary("nlasvc.dll") failed - The specified procedure could not be found
I double checked and the file successfully downloaded to the c:\window\system32 folder so it's definitely there
-
After typing the instructions in the cmd and hitting enter a window popped up stating:
RegSvr32
LoadlLibrary("nlasvc.dll") failed - The specified procedure could not be found
I double checked and the file successfully downloaded to the c:\window\system32 folder so it's definitely there
@Jamec,
Just to be sure, under the "c:\window\system32" the file that should be there is "nlasvc.dll", and NOT "nlasvc.ZIP".
So, please confirm that the content of the zip archive is extracted first, and then copy or move it to the "c:\window\system32" folder to continue with the instructions.
If it still doesn't work, and the "dll" file is indeed there (you see it using Windows Explorer while showing hidden files), then reboot and get administrative permissions to follow the instructions.
If after trying, whatever you don't know or if I wasn't clear enough, please report back and don't hesitate to ask again.
-
The file ending in .dll is definitely there and after a reboot I am still unable to browse the internet.
As for asking windows for permission I am unclear as to what this means or how to do it.
Thanks for the assistance
-
As for asking windows for permission I am unclear as to what this means or how to do it.
Close all programs.
For Vista/Seven, go to:
Start menu -> all programs -> accessories -> Right click on "command prompt" -> "run as administrator".
This will open a command line box, where you can try again the command:
regsvr32 nlasvc.dll
(Note the space after the "32".)
And once the prompt returns (meaning, the above code finishes) you type "exit" (without quotation marks).
Now close the command box and reboot.
-
We definitely need to get access to a windows CD as there are probably a lot more corrupt files. Could you borrow an exernal CD/DVD drive ?
-
We definitely need to get access to a windows CD as there are probably a lot more corrupt files. Could you borrow an exernal CD/DVD drive ?
@Jamec,
I don't remember your OS, but for Seven, MS has a tool to install/repair Windows using USB Flash drives, and it is not hard to set up. There are other similar tools for other versions, but usually are not so "newbie-friendly".
A temporal external drive and CD/DVD of the correct Windows version and edition is possibly the "default" choice (only if it is temporal).
Or you may have some repair/restore partition, but usually this extra hidden partition works by putting all back as "factory default", so you would also need to backup your documents and settings into some other disk.
-
I have windows xp on the notebook.
When I right click on the command prompt within the accessories heading there is no administrator option in the menu.
I'll have to see if I can get a hold of an external cd drive.
Unfortunate for me that this occurred; however, let this be a warning to others that may read this thread. While my computer certainly became infected by a virus, the virus posed no threat to me accessing the internet; only annoying pop ups.
Only after having run the free avast download and selecting to remove the infected files did the damage occur that seems to now require that I reload the operating system.
essexboy and ady4um I certainly appreciate your time and attention, however. I will notify if/when I am able to locate an external cd drive.
-
We definitely need to get access to a windows CD as there are probably a lot more corrupt files. Could you borrow an exernal CD/DVD drive ?
@Jamec,
I don't remember your OS, but for Seven, MS has a tool to install/repair Windows using USB Flash drives, and it is not hard to set up. There are other similar tools for other versions, but usually are not so "newbie-friendly".
A temporal external drive and CD/DVD of the correct Windows version and edition is possibly the "default" choice (only if it is temporal).
Or you may have some repair/restore partition, but usually this extra hidden partition works by putting all back as "factory default", so you would also need to backup your documents and settings into some other disk.
I've long since taken all valuable data off the notebook and placed it on my external hard drive.
I'd have no hesitation in restoring factory settings as there is nothing for me to lose. I do not know how to perform this task, however.
Thanks for your continued time.
-
I've long since taken all valuable data off the notebook and placed it on my external hard drive.
Well, backups might need to include not only documents, but settings too. For example, if you don't want to call your ISP for some configuration data (in some cases, not necessary, but it might). Other classic example are Outlook (or similar) emails, contacts and settings.
I'd have no hesitation in restoring factory settings as there is nothing for me to lose. I do not know how to perform this task, however.
Well, that depends on your specific notebook. Probably the support website of your specific notebook has this info.
JFYI, after Factory Defaults, you would need to (recursively) apply Windows Updates, re-validate your Windows installation and reboot, and then repeat the process until no new Validation is needed and no Updates arise.
After that, install Avast anew, scan with Avast your backup and solve any conflicts, and restore your backup documents.
Next time, when you have an infection, better to send to the chest instead of deleting all files. This action (chest) might not completely solve the problem, but at least it gives a clue about it.