[Resolved] CANT ACCESS INTERNET using avast AIS 5

[Skowy]

hi

what do you think it means?


C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe

There are at least 3 more similar entries all beginning with C:\WINXP which seems incorrect
to me.

question;
do you think this is a result of the new motherboard installed?

do you think its because of the reinstalled software? (I'm not sure what is required when you replace a motherboard, or what the consequences are when you reformat a computer"

what questions should i ask the tech guys who did the reformat or motherboard install? is the problem really this deep? 

 

 

[SafeSurf]

I'd like you to run some tests on your machine and I'm going to have one of our Certified Malware Experts, Essexboy, take a look your logs after you post all of them.  In the meantime, we will still be here to provide you with help. 

Part 1:

Check your computer for malware with Malwarebytes’ Anti-Malware (MBAM).
·   Download free http://www.malwarebytes.org/ for an on-demand scanner.
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform FULL Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts -- Click OK to either and let MBAM proceed with the disinfection process; If asked to restart the computer, please do so immediately.

Part 2:

Check the information on the first post of this thread under Virus/Worms for you to check your machine for malware: http://forum.avast.com/index.php?topic=53253.0. 

Follow the directions of obtaining the OTL logs.  Post the two (2) OTL log as an attachment (Additional Options > Attach > Browse (the logs will be on your desktop > Post).  After you post your logs, then Essexboy will analyze your logs and give you further instructions in this thread; please follow his instructions as he may be doing additional testing.  After posting your logs, please do not make any changes to your machine or this will change your logs.  Thank you.

Let me know if you have any questions in the meantime.  I will also be here while Essexboy is with you but in the background as to not interfere.  Thank you.

[Skowy]

PART 1 - completed

MBAM log Attached

[Skowy]

i downloaded the OTL to PC i selected "RUN" i clicked on "min output" but where is the file scan.txt? i right click on the program and nothing appears? i double clicked the "custom scan box" and the file appears but when i select "open" i get an error message -

[essexboy]

Hi lets use a different variant - you also state you have re-installed windows, was it a full install or a parallel install ?

 Download OTS to your Desktop and double-click on it to run it

• Make sure you close all other programs and don't use the PC while the scan runs.
  
• Select All Users
  
• Under additional scans select the following

Reg - NetSvcs
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check
File - Purity Scan

• Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  
• When the scan is complete Notepad will open with the report file loaded in it.
• Please attach the log in your next post.

[Skowy]

Hi Essexboy

PART 2 - file attached as requested -

[Skowy]

you also state you have re-installed windows, was it a full install or a parallel install ?

I am not sure, i recall i had to purchase a service pack when i got the computer back... A windows notification stated in effect "Microsoft office software required a service pack upgrade"?? 

[Skowy]

what would this mean - and would it apply to this error?

Check your firewall configuration. For the correct operation the Web Shield process (ashWebSv.exe or aswWebSv.exe) needs a permission to access the Internet on TCP port 80 and a permission to act as a server and accept incoming connections from localhost (the local machine) on TCP port 12080.

[essexboy]

Looks like a parallel install was done, data transfered and the old windows deleted, hence winxp as your windows folder

The only thing I can see is remnants of AVG and Norton - this will clear them.  What problems if any are you experiencing ? 

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Unregister Dlls]
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} [HKLM] -> Reg Error: Value error. [AVG Safe Search]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YY -> "C:\Documents and Settings\Scott\Local Settings\Temp\7zS8D.tmp\SymNRT.exe" -> C:\Documents and Settings\Scott\Local Settings\Temp\7zS8D.tmp\SymNRT.exe [C:\Documents and Settings\Scott\Local Settings\Temp\7zS8D.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool]
[Custom Items]
:Files
ipconfig /flushdns /c
:end
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.  Post that information back here

I will review the information when it comes back in.

[Skowy]

essexboy - i am really "freaking out" i  ran the program fix but an error box popped up and the only prompt option i had was to click continue, so i clicked it, now its been an hour and the OTS fix seems stuck on [Create restore point] is an hour normal?

man i know it could take you hours to respond because of the time zone difference, so i will leave it until something happens...really freaking me out;  

the program doesn't look frozen because there is a flicker of an hourglass every now and again and the mouse pointer moves across the screen -

what do i do?

(a) close the program and start again
(b) leave it running...But, for how long?

[Skowy]

okay - not freaking out now the program has ended and stated " system needs to reboot" so i rebooted it - But there was no window that popped up as a notebook containing a file?

do i redo it?

[DavidR]

Its 3:25a.m. in the UK, so essexboy will be tucked up in bed now, so it will have to await essexboy's return. However, given this was a specific fix to get rid of remnants of AVG and Norton and it appears to have completed successfully (other than no notepad report), I wouldn't have though it would need to be rerun.

As essexboy asked, "What problems if any are you experiencing" ?
If you have anything to report post it now so he can see it when he returns.

[Skowy]

DavidR

"What problems if any are you experiencing" - what do you guys mean? its the same problem since the first post and throughout this entire thread -

the problem - I cannot access the internet via any web browsers [Mozilla] - [IE] - [ Google chrome] unless, i disable the webshield then avast allows connectivity....

see image in previous post for browser screen shot error
     
Re: CANT ACCESS INTERNET using avast AIS 5
« Reply #48 on: September 25, 2010, 11:34:54 PM »

 

[DavidR]

I think essexboy is asking if it still exists after the his latest suggestions.

I think that the hope was after removing remnants of previous AVs it would break any potential conflict allowing you to connect.

[Skowy]

Thanks essexboy, it was a good idea, i appreciate everyone's effort here to help me;

Do you think i should uninstall AIS and reinstall it now that there are no remnants?

can anyone tell me how to do this - Check your firewall configuration. For the correct operation the Web Shield process (ashWebSv.exe or aswWebSv.exe) needs a permission to access the Internet on TCP port 80 and a permission to act as a server and accept incoming connections from localhost (the local machine) on TCP port 12080.