residual virus? - Page 2

[jholland1964]

In firefox go to Tools, Options, Advanced, Network. Be sure there is a tick in No Proxy.

[egghead8488]

There wasn't. I clicked it so that there is now. Refreshed page, but still "Server Not found"

[jholland1964]

In Firefox,
Where you would type in a url, type about:config. Next click the button "I promise to be careful". Next right click anywhere in the preference name field and choose new>boolean. Next, type in network.dns.disablePrefetch and click ok. Then finally choose true
See if you can go online then.

[egghead8488]

Still "Server not found"

[jholland1964]

Ok, then you need to do the following using the flash drive on the affected computer;
On the infected computer go to the following locations, look for the following files noted in red and upload them to the flash drive:
c:\windows\system32\drivers\oycmitiy.sys
c:\windows\system32\drivers\yeddef.sys
c:\documents and settings\Kendra\Local Settings\Application Data\ijomrexeq
Then take the flash drive to the working computer. Go to http://virusscan.jotti.org/en
Upload each one of those files there for scanning by the 20 scanners there. Report back here with the findings.

[egghead8488]

Could not find c:\windows\system32\drivers\oycmitiy.sys on the computer; files go from nsrdr to oprghdlr to p3 alphabetically in the drivers folder. Found c:\windows\system32\drivers\yeddef.sys and Jotti found nothing with any of the scans. Found c:\documents and settings\Kendra\Local Settings\Application Data\ijomrexeq but it is an empty folder, and Jotti wanted me to open it but then there was nothing in it to scan.

[jholland1964]

Ok, that's good. Those were questionable files and we needed to check to be certain there were no infections in them. Let me do some checking on this inability to go online however and will get back with you shortly.

[jholland1964]

1. Click on the Start button.
2. Click on the Settings menu option.
3. Click on the Control Panel option.
4. When the Control Panel opens, double-click on the Network Connections icon. If your Control Panel is set to Category View, then double-click on Network and Internet Connections and then click on Network Connections at the bottom.
5. You will now see a list of available network connections. Locate the connection for your Wireless or Lan adapter and right-click on it.
6. Click on the Repair menu option.

Alternatively, if your network icon also appears on the Windows taskbar, then you can repair it by right-clicking on the icon and selecting Repair

[egghead8488]

It ran through several things, then said "Windows finished repairing your connection. You can try connecting again. If the problem persists, contact the person who manages your network." I clicked "close" then started Firefox and Internet Explorer. Neither can display webpage or find server.

[jholland1964]

Are you directly connected or do you use a router?

[egghead8488]

Netgear Rangemax router and Westell 6100 modem

[jholland1964]

Try to connect directly using the internet cable without the router.

[egghead8488]

Ethernet connection from affected CPU to router, router connected to modem, modem to dsl phone splitter/filter which is connected to wall outlet for DSL/phone.

[jholland1964]

Have you reset the router?
Is it not possible to take the router out of the mix?

[egghead8488]

I will reset the router. If I take the router out of the mix, I will not have internet on this laptop. I will be offline briefly while resetting router.

[jholland1964]

I will reset the router. If I take the router out of the mix, I will not have internet on this laptop. I will be offline briefly while resetting router.

Oh, that is right, sorry.
Try this;
Go into the Properties for the Local Area Connection and uncheck TCP/IP, click Okay. Reboot and then go back and check TCP/IP again. Reboot.

[egghead8488]

Reset router & modem both. unchecked TCP/IP, and rebooted. Checked TCP/IP, then rebooted. Tried Firefox--server not found. Tried Internet Explorer--cannot display the webpage.

[jholland1964]

do you have a firewall installed? Turn it off.

[egghead8488]

I uninstalled McAfee Security so that shouldn't be a problem. Microsoft Security has a red circle with a white "x" on it, but did have "on" checked. I just clicked "off" for it. Refreshed
Firefox, and voila! Internet is working! Fabulous! You are a genius! Now what do I need to do to keep from getting any more nasty virus/malware issues?

[egghead8488]

Internet Explorer is working well, too! The lovely green task bar came back as soon as computer was rebooted after ComboFix. No more popups about script debugging, either, since ComboFix. So far so great!

[jholland1964]

I uninstalled McAfee Security so that shouldn't be a problem. Microsoft Security has a red circle with a white "x" on it, but did have "on" checked. I just clicked "off" for it. Refreshed
Firefox, and voila! Internet is working! Fabulous! You are a genius! Now what do I need to do to keep from getting any more nasty virus/malware issues?

So the problem was the Windows Firewall? Is it turned off now? Or when you say Refreshed do you mean you turned it back on?

[egghead8488]

Guess the firewall was blocking internet this time. I clicked "refresh" on the Firefox browser after clicking "off" on Microsoft Security. Strangely enough, it has turned itself back on.I just clicked Windows Security Center, and the "greenlight" is on for Firewall and for Automatic Updates. It has the redlight on Virus Protection saying "no antivirus software found"

[jholland1964]

Well I'm no genius, that is for sure. Just stuff like this drives me nuts and I keep researching until we hit the right answer.
Now for a virus program I really recommend that you NOT reinstall McAfee. It obviously didn't work for you. I would recommend that you install Avira Free. I have used it for years, provides great protection, it is not intrusive but does it's job. Here is the link. It is easily configured. You can set it to update daily automatically, and also scan weekly automatically. I will post attachments for you to follow to do this.
http://download.cnet.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlPid=11012914

Download and install it and then I will post the attachments for configuring it.

[egghead8488]

Well I'm no genius, that is for sure. Just stuff like this drives me nuts and I keep researching until we hit the right answer.
Now for a virus program I really recommend that you NOT reinstall McAfee. It obviously didn't work for you. I would recommend that you install Avira Free. I have used it for years, provides great protection, it is not intrusive but does it's job. Here is the link. It is easily configured. You can set it to update daily automatically, and also scan weekly automatically. I will post attachments for you to follow to do this.
http://download.cnet.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlPid=11012914

Download and install it and then I will post the attachments for configuring it.

It's downloading now--9 minutes remaining.Thank you again. I had put in so many hours trying to figure this out, and just couldn't seem to stay ahead of the viruses. I'd seem to have it fixed, but then would end up right back where I started. Whew! What a learning experience!

[jholland1964]

Here are the printscreens for correct configuration of Avira.
Go through each as you go through the program, they are pretty self explanatory
The last one you will see is a "nag screen" you will get when the program updates each day. It is just wanting you to purchase the program. Just "X" out of it. Some people get annoyed when they see this, but my feeling it is a way to know the program updated plus if you can use this free program and have this pop up once a day...what the heck. When you hit the "X" in the corner it's gone until the next update.
Install the program, set it up and then I will have a couple more things you will need to do.

[egghead8488]

Thanks again! I'll get it configured as soon as it finishes the download--2 minutes remaining. I agree that a little pop-up reminder a day is pretty cheap protection. It's gotta beat what I paid for mcAfee, then all they wanted to do was pass me off to their "paid" extra tech support. Kinda made me wonder what I had already paid for!

[jholland1964]

>>>> Kinda made me wonder what I had already paid for!
No kidding!
Once you get that installed then you have a few more steps and I have at least one other program I want you to install to help with protection.

[egghead8488]

Avira is now active with scheduled weekly scan and daily update.

[jholland1964]

Fantastic! Ok here are your next steps:
You can get rid of GMER, DDS, HostExpert, you won't need them anymore.
You should remove HiJackThis, you don't need it any more.
You also should uninstall combofix. It basically is a "one time" fix. If a person is told to use it again some other time then a new copy would be needed.

* Click START then RUN
* Now type ComboFix /Uninstall in the runbox and click OK. The space between the combofix and the /uninstall, it must be there.
When shown the disclaimer, Select "2"

Keep the ATF-Cleaner and use it at least weekly. After using ATF-Cleaner then use MBA-M, run a weekly scan at least, Quick Scan should be sufficient. ALWAYS update it BEFORE each scan. If Quick Scan finds something, have it remove whatever is found, reboot, update again and do a Full Scan with it. Have it Remove Everything found and always reboot after the scan is complete.
Keep SpyBot if you wish but DON'T use the TeaTimer portion and only use SpyBot for scanning, update first of course.

The last program you need is SpywareBlaster. It also is FREE. A superb protection program, I wouldn't run my computer without it.

From Javacool Software :

"SpywareBlaster doesn't scan for and clean spyware--it prevents it from being installed in the first place. SpywareBlaster prevents the installation of ActiveX-based spyware, adware, dialers, browser hijackers, and other potentially unwanted programs. It can also block spyware/tracking cookies in IE, Mozilla Firefox, Netscape, and many other browsers, and restrict the actions of spyware/ad/tracking sites."

Download, install, update, Enable All Protection and close the program. That's it. Just manually check for updates once a week. If there is an update, download and then Enable All protection. It doesn't have updates weekly but always check.

You also need to set a new, clean Restore point.
To do this Right Click My computer.
Choose Properties
When System Properties opens choose the System Restore Tab.
Place a check mark in Shut down System Restore.
You will probably get a message telling you it will be shut down, click ok or yes.
Allow it to shut down.
Wait a moment. Then go back in and take that check mark Out so that System Restore will turn back on.

Now I would recommend that you Update MBA-M, run another Full Scan with it and have it remove everything found, hopefully there won't be anything though there could be some residuals, then reboot. IF something is found please post that log here, tomorrow will be fine since it is quite late here where I am.
Hopefully everything will run well from now on.

I would recommend that you install the same programs onto the laptop you have been using throughout all of this. That has been a lifesaver and you need to keep it clean also. Be sure too to dump all that you have on the flash drive so it will be clean too.
Any questions, just post them here. Hope all is good and the next MBA-M scan comes up clean also.
Judy

[egghead8488]

Thanks again! I'll finish this up & get some rest (it's late here, too--central time zone). I really appreciate your help!