cant connect to the interent after XP Malware removal

[Yockie]

Hello, I had XP Malware few days ago and after research online I found a way to remove it with Malwarebytes Anti-Malware. Now it seems ok, but I cant connect to the internet. This is a scrap computer from a school where a friend of mine use to work, and Im apperantly the Admin on this computer. However, it worked very well so far and in addition I dont know what to do as Admin, so just used it because of a lot of memory avialable. I have a small box which comes before anything else, which is nam,ed "SECURUS" and I never gave it a lot of thought. Now, after the Malware removal, this box start saying" Could not bind to firewall server port". When I try to connect to the net it says that the remote computer does not respond, which is obviously false, as Im using my laptop with the same connection to write here.

Any ideas how to fix the big computer, I need internet on it, please?

[Starbuck]

Hi Yockie and welcome to FreePcHelp.

 

Have you tried the obvious things first:

 

Try one or both of these and see if your connection comes back.

 

Click Start...Run... Type in (or copy and paste) ipconfig /flushdns (don't forget the space) then click the 'enter' key. You'll get a confirmation that the flush was successful.

 

FOR CONNECTION PROBLEMS :

Click on Start... Control Panel, select the 'Network and Internet Connections' category or double click on Network Connections, depending on which View you are using. Then right click on your default connection, usually 'local area connection' for cable and dsl, and left click on properties. Double-click on the 'Internet Protocol' (TCP/IP) item. Write down the settings in case you should need to change them back. Select the radio dial that says 'Obtain DNS servers automatically'.

Press OK twice to get out of the properties screen and reboot if it asks. If it does not prompt you to reboot go ahead and reboot manually.

 

If that doesn't get it, try this one:

 

Go to Start ... Run and type in cmd

A dos Window will appear.

Type in the dos window: netsh winsock reset

Click on the 'enter' key.

 

Reboot your system to complete the process.

[Tootech]

Starbuck, do you know if the Winsock Fix XP does the same job?

 

WinSock XP Fix Freeware download and review - fix XP internet connectivity from SnapFiles

 

I saw this post last night and thought I ought to leave it the malware guys, and wondered if the Winsock fix would sort it out.

[Yockie]

Starbuck, thank you very much for the answer, I have tried all that and it doesnt work :( The same pannel that says "Could not bind to firewall server port" comes up every time I restart. I went to Cont.Pan.-amin tools-services- Windows Firewall /Internet Connection Sharing ICS, and startup type is Autimatic, but Service status is Stopped, and when I click START, its says:Error 2001- The specified driver is invalid. I cant make the Firewall to work, may be just to disable it? Or fix this problem somehow, may be that is what it is?>

 

Tootech, thank you for that link, does it sound like it will help me?

[Starbuck]

@Tootech

do you know if the Winsock Fix XP does the same job?

It's not a program that i've used, so couldn't say for sure.

 

@Yockie

thank you for that link, does it sound like it will help me?

Like i say, i've never used it... but it's certainly worth a try.

 

As this started after you ran Malwarebytes ..... can you let me have the report.

Start MBAM, click on the Logs tab.

The reports will be date stamped.

double click on the one you ran and it'll open in notepad.

If you can then transfer that to another m/c so that you can post the report in your next reply, that would be great.

For all we know MBAM may have removed a legit file ( does happen sometimes)

 

Thanks

[antronpc]

I can't help as I am the new dinasour BUT .. spooky .. I've got AOL / XP and slow running (see my post today). I was installing 'spybot S & D' an hour ago and suddenly 'wallop' the router would not work or authenticate. I managed to stop 'spybot S & D' and AOL helped me and were great

[Yockie]

Starbuck, there it is, but bare in mind, that there were 3 bugs, I just deleted them, dont know why its says all ) now on the report.

 

Malwarebytes' Anti-Malware 1.45

Malwarebytes

 

Database version: 3930

 

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

 

25/04/2010 23:15:51

mbam-log-2010-04-25 (23-15-51).txt

 

Scan type: Full scan (A:\|C:\|D:\|E:\|G:\|)

Objects scanned: 219506

Time elapsed: 1 hour(s), 37 minute(s), 11 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

(No malicious items detected)

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

(No malicious items detected)

 

 

 

I also have HiJack report, if this could help?

[Starbuck]

Hi Yockie

 

according the MBAM report, nothing was removed.

What was removed and by what or by who?

In your first post, you said:

 

I had XP Malware few days ago and after research online I found a way to remove it with Malwarebytes Anti-Malware.

so i assumed that MBAM had removed the infection and would have shown in the report.

[Tootech]

I think that as SECURUS is showing an error on startup you should remove it - it is not needed now anyway.

 

It may be that part of that program runs a firewall system and that may have been damaged - causing the no internet problem.

 

Also, what antivirus software do you run? If you have no firewall installed, once SECURUS is removed, and PC restarted, run the Winsock Fix as it does fix faulty firewall issues.

 

Note: if you use it with a firewall still installed it may damage the firewall - so remove any firewall first.

[Yockie]

Starbuck, I had few days ago something that was named XP Antivirus 2010, which came from nowhere on my computer and start blocking programs one by one. Luckly I have lap top spare and had a look at the Net- and found out that its some virus. I didnt download nothing of the things this virus aske me to, as its so bad made, its visible form a plane that its something fake- its not even on focus to be sen well! So, I found out that Malwarebytes' Anti-Malware is the program that clears it up, and I have it on the computer and I run it, but couldnt get to the net to get the latest version. I have tried to do it from the lap top trough USB, but it didnt permit me, so I ran the version I already had on the compueter. It showed 3 bugs and I deleted them.I dont know why it doesnt show it on the report, but Im sure that there were 3, as they have a small icon of bugs in front of them,like greenish funny creatures.

I ran Malwarebytes' Anti-Malware few more times and it showd nothing anymore, and all the nasty windows which blocked every program just disapoeared. But I cant conect to the net.I can see that Windows Firewall doesnt work properly, but I cabt fix it, as I explained in my previous post. I do somewhat know computers, at least to the point to know when I have a virus and to look how to clean it, but cant fix the damages...I have HiJack report too, and deleted 3 items from there, but there is no difference, and I dont know what else to delete or how to fix the Firewall..

 

Tootech, you are right, SECURUS is something I never put on this computer and I cant find how to rid of it, I dislike it from a long time, but its not in add- remove programs, and I dont know where to find it and delete it.

I run Anti-Malware, and Avira, as far as I know...like I told you its old scrap-school computer and I dont know everything on it, although I have it quite long time now, it just worked great so far, has lots of memory and space, and I never pay attention to a lot of antivirus programs, although from my bank they offer free. I dont like how they block everything I want to do and scare me with warnings all the time. I just asume :confused2: that all will be all right and it is ...so far . .. LOL

I dont know how to remove Firewall, just to disable it, you mean? From Admin tools- Services? And how to run this Winsock Fix?

[Starbuck]

Hi Yockie

 

but Im sure that there were 3, as they have a small icon of bugs in front of them,like greenish funny creatures.

This sounds more like SuperAntiSpyware.

 

Ok, let's get a lot more info on your system then we'll take it from there.

Anything you can't remove.... we'll be able to do with this program.

 

Can you try downloading this program to another system and then transfer it to the broken one, by use of a usb stick etc.

You'll then have transfer the 2 reports back again so that you can post them.

 

• Download OTL to your desktop.
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/newOtl2.png

Now copy the lines below.
 
netsvcs
msconfig
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT
 
 

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

 

Thanks

[Yockie]

still scaning....just waiting to finish, hope it will be today...LOL

[Yockie]

The text that you have entered is too long (668718 characters). Please shorten it to 80000 characters long.

 

I did it, but its really big, what to do?

[Yockie]

Starbuck, I managed to send one here, but the other is 231 Word pages, do you want to give me some idea how to show it to you, please?

[Tootech]

Yockie, I'll leave it be for now until Starbuck is sure you are clean, then see how things look.

[Yockie]

Tootech, good idea. Lets see what he will say, but I am not sure really how to post the big document. If you have any ideas, please tell me, as you can see I posted only the short one from the two.

[Yockie]

May be that will work.

Starbuck, hope these 3 attachments are what you need?

[Yockie]

Starbuck, where did you go?:(

[RandyL]

Hi Yockie.

Please be patient. Starbuck will be back to assist you.

 

One thing that was mentioned by Tootech is your antivirus program. Are you running more than one? Which one or ones do you have?

 

As this is a used school computer and it has things you never installed I'm betting it was never formatted and Windows reinstalled. On any used computer I always suggest to completely reinstall Windows to rid yourself of leftover garbage and problems.

 

Just my thoughts if you have the Windows disks.

[Yockie]

RandyL, thank you for the answer, I’m using Malwarebytes, Avira( deleted by the virus I had) and...that’s about it, I think…eventually there could be some left avast things, I’m not sure...sorry, excuse my ignorance :o

I don’t have Windows disks at all, my friend from the school just gave me another scrap computer- this one- when the previous broke down by some reason, not virus. He didn’t want to bother with reinstalling Windows, etc, and he actually had 20-30 computers, pretty good, but for scrap, as new ones were bought from the school to the children. I should’ve take 3 then, urrrgggg.... its my fault now that I don’t have spare

Unfortunately the business with the old computers there died off, and now I’m stuck with old, big, good machine, with still life to go, but cant reinstall Windows, never did, and its shame. My daughter’s laptop, which I’m using, does have Windows XP too, but no disk, although she bought this one from a shop- they didn’t gave her disk, we never asked for one anyway, may be we shoil've ask then.Its late now anyway, the laptop is 2 years old itslef.

Bottom line - no Windows disks.:(

 

 

[Yockie]

RandyL, regarding Starbuck - I just want to make sure he didnt run away screaming after looking at the size of my attachmets, LOL...or the content of it in that matter...

[Starbuck]

Hi Yockie

 

Sorry about that, for some reason i didn't get a message to say you had replied.

 

I just want to make sure he didnt run away screaming after looking at the size of my attachmets, LOL

you'd be surprised at some of the reports i've seen before :)

 

The logs are difficult to read in 'Word' format, could you please post the notepad versions as attachments.

Also let me know the programs you want to get rid but can't... i'll add them to the fix then.

Edited April 30, 2010 by Starbuck

[Yockie]

Ok, I have tryed this severeal times, I have them on my USB, but its just to big for uploading here. Tell me how to upload them here, pls?

This is the reason I have converted them in Word.

 

There is some small box, SECURUS,which shows up every time I turn on the computer, with different messages. I cannot find it in the program list, (add-remove programs place), I never knew what this box is,but now seems its stops somehow connection.Or at least I think so.

 

Also, I dont know did you read in one of my previous posts about the Window firewall?

Cont.Pan.-amin tools-services- Windows Firewall /Internet Connection Sharing ICS, and startup type is Autimatic, but Service status is Stopped, and when I click START, its says:Error 2001- The specified driver is invalid. I cant make the Firewall to work.

[Starbuck]

Hi Yockie,

 

Follow the instructions in the PM i sent.

Also, go into add/remove and uninstall the following:

 

Securus Client

McAfee VirusScan Enterprise

 

let me know if they uninstall ok.

 

Cont.Pan.-amin tools-services- Windows Firewall /Internet Connection Sharing ICS, and startup type is Autimatic, but Service status is Stopped, and when I click START, its says:Error 2001- The specified driver is invalid. I cant make the Firewall to work.

this is actually a known problem with SP2, once we have run the fix and get you back online .... we'll take care of this.

[Starbuck]

Thanks, i've got the reports.

 

Have just noticed in the report that avira is showing a lot of files missing.... are you using this or McAfee for the anti virus?

if using McAfee, uninstall avira.