no internet after running Norton to remove download.exe

Thanks for your help. I just got off the phone with my ISP and they say everything is fine on their end...Norton support "accidentally got disconnected" after saying it was nothing Norton could have done.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:24:56 PM, on 11/9/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: 890166 helper - {A48FE9AC-DD02-4FF7-9211-B7BA9A2C8BF2} - C:\WINDOWS\system32\890166\890166.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - https://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

--
End of file - 4845 bytes

Thanks. There is still a presence of an infection. So lets get started.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: 890166 helper - {A48FE9AC-DD02-4FF7-9211-B7BA9A2C8BF2} - C:\WINDOWS\system32\890166\890166.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

====

Delete this folder shown below in bold.
C:\WINDOWS\system32\890166

Next,

• Download combofix from here, use the top links - combofix.exe
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

k , good so far but how do I do the combo fix without internet connection? I did NOT have the console installed.

This is gonna prove to be harder than usual.

Do you have a USB memory stick or some form of transportation to the infected machine?

yes, i'm moving all of this back and forth on cd

Okay, I'll be here.

i've already moved combo fix to the infected machine and it wants internet...i'm stuck there. I've removed the folder already.

Okay, choose not to install the recovery console.

I got a couple of error messages saying 'execute processes remotely has encountered a prob..." then I got:

ComboFix 08-11-09.01 - Admin 2008-11-09 20:04:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.679 [GMT -5:00]
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\TinyProxy

.
((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 )))))))))))))))))))))))))))))))
.

2008-11-09 18:31 . 2008-11-09 18:31 d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
2008-11-07 13:22 . 2008-11-07 13:22 1 ---h----- c:\windows\f49f4daa.dat
2008-10-28 19:33 . 2008-10-28 19:33 d-------- c:\documents and settings\Admin\Application Data\HDRsoft
2008-10-28 19:21 . 2008-10-28 19:21 d-------- c:\program files\PhotomatixPro3
2008-10-28 19:16 . 2008-10-28 19:17 d-------- c:\windows\system32\URTTemp
2008-10-25 02:00 . 2008-10-25 02:00 d-------- c:\program files\MSXML 4.0
2008-10-24 10:52 . 2008-10-24 10:52 d-------- c:\documents and settings\All Users\Application Data\Ahead
2008-10-24 10:49 . 2008-10-24 10:49 d-------- c:\documents and settings\All Users\Application Data\Nero
2008-10-14 20:08 . 2008-08-14 05:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-14 20:08 . 2008-08-14 05:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-14 20:08 . 2008-08-14 04:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-14 20:08 . 2008-08-14 04:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-09 23:31 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-09 23:31 --------- d-----w c:\documents and settings\Admin\Application Data\Symantec
2008-10-24 15:51 --------- d-----w c:\program files\Common Files\Ahead
2008-10-24 14:57 --------- d-----w c:\documents and settings\Admin\Application Data\Ahead
2008-10-07 00:53 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-23 22:46 245,408 ----a-w c:\windows\system32\unicows.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 15:24 --------- d-----w c:\program files\Common Files\Adobe
2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 10:09 2,145,280 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 09:33 2,023,936 ----a-w c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-18 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-18 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-18 131072]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-01-14 29753344]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3390:TCP"= 3390:TCP:RDP

R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1e51x86.sys [2008-01-20 37888]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-01-02 215936]

*Newly Created Service* - PROCEXP90
.
.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Settings,ProxyOverride = *.local;
R1 -: HKCU-Internet Settings,ProxyServer = http=127.0.0.1:9090
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-09 20:05:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-09 20:05:54
ComboFix-quarantined-files.txt 2008-11-10 01:05:52

Pre-Run: 93,688,918,016 bytes free
Post-Run: 93,731,885,056 bytes free

95 --- E O F --- 2008-10-30 15:14:31

Thank you.
I think I now know why your net connection isn't working.
This malware caused it.

To fix it:
In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection.

Delete this file:
c:\windows\f49f4daa.dat

gulp...I did that, unchecked it, restarted and still no connection

wait, just saw where you said to delete another file and I hadn't done that

although I have been sitting here for 12 hours, I'm sure I dont see that file in C:/windows

I'm trying to fix two computers and one has that dat file. The one I was fixing first does not...I did a search for the file name and it wasn't there.

Sorry about the delay, I was just reading about this, it's a horrible infection.

You may want to copy these instructions to a notepad file, because we need to use safe mode.

First, we need to get to safe mode.
To do this, reboot your machine, and start tapping F8 before the windows loading screen to get the advanced menu. Choose Safe mode.
Allow safe mode to load up, once you are in safe mode, follow these instructions.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  regedit /e peek1.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services"
  type peek1.txt >> look.txt
  del peek1.txt
  del look.bat
  start notepad look.txt
  
  

  
  
• Save this as look.bat, save it to your desktop.
  
• Double click look.bat to run it.
  
• It will make a log for you.
  

=====

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Delete these files and folders if you can find them.

C:\Program Files\ProtectService <== folder
C:\Windows\fmark2.dat <== file
C:\Windows\kenny**.exe <== file

**Note** - the two ** in the kenny file name stands for numbers, so it maybe named kenny18.exe.

Boot back to normal mode. Paste look.txt back here.

it is saying that my posted message is too big

Can you upload it at rapidshare.com?

great. The first set of logs and the computer I was trying to fix first is PMP2 link is http://rapidshare.com/files/162302367/lookPMP2.txt.html

This is the computer logs i sent first

Last edited by raif on 10th November 2008, 2:19 am; edited 1 time in total

The other computer that I'm trying to fix is PMP 1. PMP1 had the one of the files to delete...PMP2 didn't have any Click here to download file


http://rapidshare.com/files/162302584/lookPMP1.txt.html

Is there any internet connection improvement on the infected machine?

I must not have hit send on my last post right, I"m not seeing it here. The first log is from PMP2 my computer we have been discussing

http://rapidshare.com/files/162306092/lookPMP2.txt.html

I see it above.
Please answer my above question.

[edit]
I'm going offline now, I'll sleep on an answer and let you know when I post again tomorrow.

oops, just saw your response. There is no connection yet but it is moving along much quicker. PMP2 has no connection at all.

PMP1 said it had a winsock issue and I ran winsockfix and it seems to be very close...It acted very different, said it says website found and it taking a reaaaaaaallllllyyy long time to start and load IE...it starts to load the site, says it found the site, I see a part of the site, it then times out! Closer than ever though on one of them! But the computer is still running really slow

PMP2

Lets try this before I leave.

Press Start > Run
Type this in: netsh winsock reset
Then press enter.

Does net connection seem any better?

I had tried that one all day but that got PMP back up and running!!! Didn't do anything for PMP2. PMP1 is my main computer though so I'm so thankful!!!

food for thought...PMP1 is still very slow and freezing IE..but something is better

Are we talked about seperate machines?
If so, open a new topic for that machine and post a Hijack This log from that machine and I'll answer in the morning.

gotcha, thanks

I kept trying your solutions and making sure everything was as you said last night. I had to google how to reinstall the Windows XP recovery console, then ran WinsockFix, then did an ipconfig /release and ipconfig renew and everything started working fantastic upon restart. I am so thankful for this site and for your help on this...I learned a lot so THANK YOU! Both computers are running excellent now.

Yay. So glad it's working.
Well done raif.

I will add solved tags to this topic.

This site is awesome.