I must say that i find your pc's inability to connect to the web a bit ironic, cos you have amongst other pests a backdoor trojan [ an IRC bot in this case], and that one would most definitely want to connect. A backdoor trojan?- it means that you have a trojan implanted which allows someone to control your computer. After this is over you will want to change passwords, esp any banking or other critical passwords...you have been keylogged.
Okay let's get started. It's going to be a pest but copy these downloads into the pc. They fit on a floppy. But first you must delete the instance of hijackthis you have used, and download a fresh copy from http://216.180.233.162/~merijn/files/HijackThis.exe
-install it to a new folder alongside your program files. Rename the hijackthis.exe to imabunny.exe.
-when next you run it first close ALL other applications and any open windows including the explorer window containing HijackThis.
===Download this temp file cleaner from http://www.atribune.org/ccount/click.php?id=1
===Download SDFix from here: http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
and save it to your desktop. Dclick SDFix.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
===ATF- Dclick ATF-Cleaner .exe to run it, and when ATF Cleaner opens go Select all, and then Empty Selected.
Close ATF.
===Restart you computer in Safe Mode:- press F8 several times while POST is running and before IDE detection completes.
- On the Windows Advanced Options Menu, select Safe Mode and press Enter.
- When the Boot Menu appears again, select Microsoft Windows XP and press Enter.
- Log in by using the Administrator account and password. NOTE: The password is blank by default unless you set a password.
===Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Post the contents of the file Report.txt here.
Restart the pc in normal mode. If you can now get on the net....
===GET AVG antispyware 7.5 here.. http://free.grisoft.com/doc/5390/lng/us/tpl/v5 -the link is almost at the bottom of the page , avgas 7.5.0.50. Install it and update it.
Now start AVG a-s 7.5; under Scanner/ Settings set Recommended actions to Quarantine, and run the scan. Save the log file and only then click Apply all actions. Post the log file.
Whether or not you got on the net re-run Hijackthis [as imabunny.exe] and check the following [if they exist] for fixing, and press Fix Selected.
C:\WINDOWS\TEMP\1E2D5597.exe
O2 - BHO: (no name) - {371EE1EF-F177-1390-7807-08525DC0E55C} - C:\WINDOWS\system32\nweipeg.dll
O2 - BHO: (no name) - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - (no file)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [hrcopul.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Shaun Thomas\Local Settings\Application Data\hrcopul.dll",vuljcec
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE ==this one is benign, but a time waster.
O4 - HKLM\..\Run: [fwewwqwe3] C:\WINDOWS\TEMP\1E2D5597.exe
O4 - HKCU\..\Run: [icasServ] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [hkgaqge] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdPopup] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [acenotes] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [4bysw3l3aemdj#] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
If you could not get on the net before, restart now and try again, and if it works download and run AVG as above.
Post those logs.
