Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Removal of virus has blocked internet. PLEASE PLEASE HELP

22 Jun 2015   #71
cottonball

Windows 7 Home Premium
 
 

You are correct!! Those may be the entries that, if MBAM removes them, you will not have an Internet connection.
Hold tight on those!! Need to find out more info.



Boot in Safe Mode and see if you create a restore point:
  1. When the computer is powered on or restarted, tap the F8 key in 1 second intervals.
  2. After your computer displays hardware information and runs a memory test, the Advanced Boot Options menu appears.
  3. Use the arrow keys to select Safe Mode,and press: ENTER



My System SpecsSystem Spec
.
22 Jun 2015   #72
cottonball

Windows 7 Home Premium
 
 

Doubt that I will get the folks from MBAM at this hour.

Also, I do need to get some sleep.

Will get back with you tomorrow and see if we can figure out what to do with those blankity-blank entries.

You have been great through all this.
My old brain is not what it used to be.

Thanks for your patience.
My System SpecsSystem Spec
22 Jun 2015   #73
ChronicX

Windows 7 Home Premium 64
 
 

I created some restore points although I have not tested them out yet. Overnight I will be running full scans with ESET and Malwarebytes Anti-Rootkit. Thank you again. I cannot tell you how thankful I am. I am hopeful we can smoke out those other Pure Leads instances. Thanks again!
My System SpecsSystem Spec
.

22 Jun 2015   #74
ChronicX

Windows 7 Home Premium 64
 
 

And oh yes... I made backups of the plsapp/plsapp64... renamed them and squirreled them away just in case.
My System SpecsSystem Spec
22 Jun 2015   #75
ChronicX

Windows 7 Home Premium 64
 
 

Updated AdwCleaner report.


Attached Files
File Type: txt AdwCleaner[R5].txt (1.3 KB, 2 views)
My System SpecsSystem Spec
22 Jun 2015   #76
cottonball

Windows 7 Home Premium
 
 

Will you also download a new copy of the Farbar Recovery Scan Tool:
Farbar Recovery Scan Tool Download

Check: Addition.txt

Remove the old copy. This program gets updated often. New version: 21-06-2015

Please post the two reports.

Thanks.
My System SpecsSystem Spec
22 Jun 2015   #77
ChronicX

Windows 7 Home Premium 64
 
 

Here are the latest reports. Malwarebytes Anti-Root Kit came up clean.


Attached Files
File Type: txt FRST.txt (87.3 KB, 6 views)
File Type: txt Addition.txt (39.0 KB, 6 views)
My System SpecsSystem Spec
22 Jun 2015   #78
cottonball

Windows 7 Home Premium
 
 

ChronicX,

Checking a few things out to get rid of the nuisance without losing the Internet connection.

Also need to go out for a while. Will be back later.

Thanks for your patience.
My System SpecsSystem Spec
22 Jun 2015   #79
ChronicX

Windows 7 Home Premium 64
 
 

Thanks, Cottonball, I am updating a lot of the tools and rescanning fairly often. Nothing has come up and the scans as of yet. Thanks again for your help.
My System SpecsSystem Spec
22 Jun 2015   #80
cottonball

Windows 7 Home Premium
 
 

ChronicX,

Let's roll once again...

We are going to take a chance, since the entries found by MBAM are a Layered Service Provider .dll that uses Winsock APIs to attempt to insert itself into the TCP/IP protocol stack. However, we need to get rid of the .dll.

If, after running MBAM you have no Internet connection, the program that follows processes the netsh winsock reset catalog command. It resets the winsock catalog to the standard Windows configuration, which means that all Layered Service Providers (LSPs) that were added, are skipped. So if you were using third-party LSPs, the associated programs may have to be re-installed or repaired.

So, here we go...

Run Malwarebytes Anti-Malware
Make sure you update the program.

Run the Threat Scan.

When the scan completes, you are presented with a screen showing what Malwarebytes Anti-Malware has detected.
Click on the Quarantine All button, and then click on the Apply Actions button.

Malwarebytes Anti-Malware quarantines all the files or entries that it found.

When removing the files from Quarantine, Malwarebytes Anti-Malware requires a reboot.
When it displays a message stating that it needs to reboot the computer, please allow it to do so.
A prompt appears after the first reboot stating MalwareBytes Anti-Malware needs to reboot the computer a second time. Please do so.

Please post the MBAM report in your reply.

[The log is automatically saved by MBAM and is also viewed by clicking:
History tab > Application Logs.]


Test the Internet.


In case of Internet failure, please use the tool: Zoek

First, temporarily disable your AV program.
Info on how to disable your security applications > How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

Zoek Download > http://download.bleepingcomputer.com/smeenk/zoek.exe
When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator (Give it a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:

Code:
createsrpoint;
netsh winsock reset catalog;b
ipconfig /flushdns;b
emptyfolderscheck;delete
emptyclsid;
emptyalltemp;
autoclean;
Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed log is opened after the reboot.

Please attach the zoek-results.log in your reply.
My System SpecsSystem Spec
Reply

 Removal of virus has blocked internet. PLEASE PLEASE HELP




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
help with possible virus removal?
I thought there was a section here, that gave details on what to submit here, in order for a professional from within to examine the content and then give further instruction. Is it still here, or is it gone? I looked under security. Hmm, I'm missing something...Thx, DM
System Security
Virus Removal
Just bought a laptop pretty decently priced even with the virus problem. I am just having problems getting rid of this one. It has content explorer which sets up proxy so after disabling it i can not get on net to install removal sofware. It has wb.exe, pc health, a password viewer, scorpion...
System Security
Want ideas for Virus removal if virus shows up in safemode CMD
Hi, Looking for general ideas on how everyone else handles a strong virus. If the virus is showing up in Windows regular mode, it opens in safemode and opens in safmode with command prompt. Besides the usual such as boot to repair mode and use system restore, dock hard drive to another pc and...
System Security
Virus Removal
My Microsoft Security Essentials keeps alerting me to something called: Name: Exploit:HTML/IframeRef.gen Alert Level: Severe I click remove but sometime later the message pops up again saying to remove. I have clicked remove quite enough times now but still the pop-up appears. I have also...
System Security
no internet after virus removal
I removed a virus from my friends e machine net book a week or so ago it was the system tool 2012 virus.it was removed fully and have checked this via AV and malwarebytes etc.but since then the internet always finds wifif points and connects but always says limited connection.problem is he lost his...
Network & Sharing
After Virus Removal
After virus removal, this message has been popping up every time I start the computer. What do I do to restore these two DLL files? Startup repair has done nothing and I don't want to system restore because I just installed tons of drivers.
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 21:37.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App