Cannot access AVAST webpage!

[Kary]

I was so happy... 'cause I could load Avast page and enter the forum...
But each time the responses were slower and slower...
Tried to load Microsoft page and couldn't do it (always says that it is not to find the server)
I newly reloaded the browser (I always clean all before closing it), but this time couldn't even charge the Avast page... :'(

Am attaching the log as you asked.

Thanks for your help and patience Essexboy.

[essexboy]

OK next lets clear all the caches and flush your DNS

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
  
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Lets check some settings on your system:

• Enter your Control Panel and double-click on Network Connections
  
• Then right click on your Default Connection
  
  • Usually Local Area Connection for Cable and DSL, or AOL Connection.
• Left click on Properties
  
• Double-Click on the Internet Protocol (TCP/IP) item
  
• Select the radio dial that says Obtain DNS Servers Automatically
  
• Press OK twice to get out of the properties screen
• Restart the computer

Go to Start->Run->Type CMD and click Ok. The MSDOS Window will be displayed. At the command prompt, type the following and press Enter after each line:

ipconfig /flushdns (The space between g and / is needed)
regsvr32 netshell.dll
regsvr32 netcfgx.dll
regsvr32 netman.dll
Exit

Restart the computer.

[Kary]

Have tried twice to run TFC and PC reboots without letting the TFC run completely.
The first time the reboot was too fast. The second time it let 2 seconds the TFC running and rebooted.
Maybe I continue trying?

About that rebooting, sometimes my PC used to do it, don't know why. Thought it was the antivirus (had AVG). With Avast it happened rarely.


OK, I have repeated it 5 times. Always appears a small window saying something about the system (?) and dissappears all, followed by reboot.

Then I have done what you asked (DNS was already in 'automatic').

When I went in MSDOS and wrote those lines in red, after ENTER, said in all that it was not recognized as any internal or external command, nor an executable program nor a batch file.

Anyway, the problem persists..., cannot load Avast nor Microsoft pages (always 'server not found' message appears).

[Onix]

I think you have got Kido(Conficker).You should install these 3 patches from Microsoft:
http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
http://www.microsoft.com/technet/security/bulletin/ms08-068.mspx
http://www.microsoft.com/technet/security/bulletin/ms09-001.mspx

Furthermore,you should disconnect from Internet and launch this tool from Kaspersky Lab:
http://www.kaspersky.ru/support/downloads/utils/kk.zip
Unzip the folder and run KK.exe


Regards,
Onix

[YoKenny]

Onix, I said the same thing back in my post:
http://forum.avast.com/index.php?topic=53205.msg451115#msg451115

Then essexboy took over.

[Kary]

Thanks for your help, but how can I load those patches from Microsoft when I cannot open even the Microsoft page?

May I only load that executable file and try it without loading first those patches?

As I understand, i must run it offline, is that OK?

Tks again.

[Onix]

Onix, I said the same thing back in my post:
http://forum.avast.com/index.php?topic=53205.msg451115#msg451115

Then essexboy took over.

Yeah,but i offer KidoKiller

As I understand, i must run it offline, is that OK?

You're right

[essexboy]

Download the attached log file and rename the extension to .ZIP then extract the files to your destop run KK.exe and let me know the result

[Kary]

Hello Essexboy

Have done as you said. Appeared a window in black with a list of eliminated files. Have closed immediately internet and zip prog.
It continued and after a while it rebooted the PC.

Then tried to enter internet and Avast page: same problem. Also with Microsoft page: always says server not found...

Tried to run it again but seems 'it ' has detected KK.

Have been trying to see why  there is always  a growing quantity of files to compress when I clean the disk. Found a file in System32 modified in the future (?) and a zip file with the same name.
Going to TEMP in Windows found 4 or 5 files (and it should be empty, cause I had just run the disk cleaning prog. and it was 0KB)  (?) Have sent them to the bin. One of them says it's in use...(?)

I am also having problems with the clock. It gets back. Yesterday night left it OK, and now it was 10 hours back (!!).

Note. After loading KK. as you said, have tried to load KK from the link Onix gave, but couldn't open the page (same 'server not found').

[essexboy]

So confiker removed some stuff but did not cure the problem ?

I have a fair size armoury of tools each a bit stronger than the previous one

Download AVZ from here http://www.mediafire.com/file/nnz111y252r/avz4.zip  then follow the instructions below for usage ignore the dowload and update links as they are for Kaspersky and will probably not work

• Unzip it to your desktop to a folder named avz4
  
• Double click on AVZ.exe to run it.
  
• Run an update by clicking the Auto Update button on the Right of the Log window:
  
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• Start AVZ.
• Choose from the menu "File" => "Standard scripts " and mark the "Advanced System Analysis with Malware removal mode enabled " check box.

• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
  
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

When restarted

• Start AVZ.
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Analysis " check box.

• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both virusinfo_syscure.zip and virusinfo_syscheck.zip to your next post Rename the zip extension to txt to enable an upload

[Kary]

OK, all done.
But still can't load Avast page, and now it takes so long to load my mail, that i had to use other address.
(I've been using my mail to pass the files from my PC to the netbook.)

Am attaching the logs (zips).

(Note- Have rebooted after the second run too).

[essexboy]

A quick question - do you use a router ? Can other computers access the net through that router with no problems ?

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code: [Select]

File::
c:\documents and settings\Utente\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
c:\documents and settings\Utente\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2140:TCP"=-


3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below.  This will start ComboFix again.




6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt .

[Kary]

A router? (?)

There is a way to connect 2 PCs to solve problems using Windows. Have seen the possibility somewhere in my PC. But I have never used it.

On the other side, I am connected to the internet by an adsl modem attached to the telephone line.
This connection is secured by a password. My PC, is connected by an ethernet cable. Netbook not.

[essexboy]

So you use the same router for both netbook and the infected system.  Can you install OpenDNS and see if the problem remains

ON your router is the login password the default one ?

[Kary]

There is a window to get in the internet and all is ready filled there just  to click 'OK' .

The Modem is connected to the PC via a LAN connection, i think. Netbook wireless.

Have now seen my modem is 'bridged + routed' active connected.

HAVE TRIED TO CHANGE THE DNS : SAYS ERROR 734 AND CAN'T CONNECT  (USUALLY DNS IS IN AUTOMATIC).