Solved Virus Deletion Now Makes Internet Access Impossible

Kaktussoft said:

netsh int ip reset : did do the trick? If so... I don't know what was wrong.

Click to expand...

YES, with every idea from this thread, I followed guru instructions as closely as I could, then rebooted, then tested IE, FF, & Chrome.

It was your last concept (quoted herein) that did the trick. But, it may have been an accumulation of fixes that you & Golden & Indiana posed that led to your final idea working. I don't know because I'm not an expert. But I certainly am delighted by the help I received from you and the others.

I don't want to mark it as solved as yet. I have to move copy temporary files into my email client, merge and purge them, then run a full test. Tomorrow. I'll report further. Good job and thank you.

Also, it should be noted that in answer to this thread, JMScreator has raised a valid issue which merits some attention. Your thoughts on that, Kaktus, Indiana, Golden?

OKAY I just found a solution (THANK YOU VERY MUCH, Kaktussoft and Indiacarnie)


Here's what I discovered, and is why it is now working for Florida Rene.
I deleted EVERY AdpeekProxy.dll and Don't forget the AdpeekProxy64.dll in the system32 folder! AVG doesn't detect that! So find everything that is related to Adpeek and delete it. Then the browsers will stop working after doing the AVG scan and deleting Adpeek completely.

Run this bat file that Indiacarnie mentioned:

(Run as administrator... otherwise it doesn't work)

This will fix it. Thank you! And remember! It was a team effort! I have been working on this for 2 days straight in a row! However, as I own a business in Computer Repair, I do have the tools and such. I have literally been imaging the client's hard-drive back and forth between working internet and non-working internet, and finally that AdpeekProxy.dll was the very thing that caused this problem. The "netsh winsock reset all" command fixes the Proxy Reference. So it no longer is looking for Adpeek virus.
Check this link out. It tells you what winsock reset does netsh winsock reset
This command in cmd should show you a list of all/any changes made to the winsock catalog!

(If anyone found something else regarding this issue... please do share! and also if someone could post a list of file locations for Adpeek that AVG does NOT detect, such as the AdpeekProxy DLL in system32. Thank you!)

I am glad to say that this terrible and extremely painful annoyance has been solved.

So remember... Don't get Scorpion Saver or Adpeek.. they're really bad.


~jmscreator
Computer Smith, MA

My apologies to jmscreator but I'm a little leery of self proclaimed "experts" in any field. I WOULD NOT personally replace that .dll file. The .bat file I gave you in post #16 should have done the trick as it contained all the commands that eventually led to your net being restored. In my haste I may have forgotten/neglected to mention that any .bat file should be run as an administrator (Elevated Command Prompt). And for this I deeply apologize for wasting your time and that of the other members helping you.

The .bat file I suggested, and what it does is available on the net without too much searching. I know because that's where I got it and I've had it saved for over a year now in my "tools" folder. Its worked before in similar situations and dumbfounded me when it didn't work for you. Again, my apologies for neglecting something so basic as running it as an elevated command. (I've since made a note to myself in my tools folder so this doesn't happen again)

Yes, its becoming increasingly more common for malware to change/rewrite system files. That's why I suggested a repair install/clean install when my original posting of the "fix" didn't "fix" the problem.

I'm just happy that your machine is up and running. (I'll catch heat for this, but maybe you should consider a different anti-virus also. AVG is not like it used to be and there are many other free alternatives that perform better and faster.) Also, when downloading anything pay extra attention as you install, unchecking any and all things you don't want. Everybody, it seems, wants to install the little extra's that lead to this kind of thing. Save any programs/things you download and scan them first before installing. I know this advice is very basic, but after my slip-up earlier vis-a -vis the command prompt, I'd rather err on the side of caution.

indianacarnie said:

My apologies to jmscreator but I'm a little leery of self proclaimed "experts" in any field. I WOULD NOT personally replace that .dll file.

Click to expand...

I understand what you are saying here, but the AdpeekProxy DLL is a virus. Go look up online, and you will clearly see that everyone has detected it as a virus. This Proxy DLL is used in replace of the system DLL
(mswsock.dll to be exact) What it does is acts like the mswsock.dll, but also tracks information and such. This DLL should be removed, as AVG knows it's a virus too. However, when you reset the winsock catalog, it puts the OS proxy settings to refer back to the mswsock.dll. So it will work again, but remember to get rid of those bad Adpeek DLLs.
As far as my self proclaimed expertise, I am not an "Expert" at computer technology, however with my many years of advanced experience, I can figure out how to repair computers. This is why I am now running a business. As far as running it as Admin, it's no trouble at all. I always run it as admin, I was just throwing that out there so other's wouldn't get confused.
My website is still under construction, so it's just a contact form.

www.computersmithservices.com


~jmscreator

netsh winsock reset : That has solved it I think.
Although the poster posted that didn't solve it (even after reboot). He did "netsh int ip reset" as well. tcp/ip was running fine... no reason to reset actually.

There wasn't a generic http proxy in the tcp/ip stack Netsh Commands for Windows Hypertext Transfer Protocol (WINHTTP)
Neither was there a proxyserver defined in internet explorer (and most likey not in other browsers).

Only common tcp/ip stuff which could cause these http errors is winsock Winsock - Wikipedia, the free encyclopedia

It supports Layered Service Providers. a Layered Service Provider can intercept and modify inbound and outbound Internet traffic. It allows processing of all the TCP/IP traffic taking place between the Internet and the applications that are accessing the Internet (such as a web browser, the email client, etc.). For example, it could be used by malware to redirect web browers to rogue websites, or to block access to sites like Windows Update. Alternatively, a computer security program could scan network traffic for viruses or other threats.
Layered Service Provider - Wikipedia, the free encyclopedia

There can be more Layered Service Providers (LSP) chained together. You deleted the DLL (the LSP)... the cause of the problem.

netsh winsock reset : that resetted the LSP chain to default standard order. Maybe virusscanner isn't working corectly now (maybe we deleted that LSP as well[?]). Uninstall and install AVG again

Kaktussoft said:

netsh winsock reset : That has solved it I think.

Maybe virusscanner isn't working corectly now (maybe we deleted that LSP as well[?]). Uninstall and install AVG again

Click to expand...

Another good suggestion from Kaktussoft. So, I have removed AVG from the previously-infected computer and after it reboots, I'll install it from a fresh download I've already made and report on my tests later, hopefully today.

Thank you all once again.

BTW, is AVG the best free anti-virus program today?

All is NOT well...yet.

Removed AVG per Kaktussoft recommendation. Restart did NOT work. Hung up forever.
Tried "normally" reboot. Would NOT work.
Tried "Last Good" reboot. Would NOT work.
Tried "Safe with Networking." Worked. Updated MalwareBytes.
Ran MalwareBytes. Found and removed 51 threats, mostly with Adpeak in their file names.
Removed them all. (see attached .txt file)
Ran Agent Ransack. Found "Peak Files.jpg.lnk" shortcut under \Users\Rene\AppData\Roaming\Microsoft\Windows\Recent
Deleted that file via Ransack

Most of the files found at 11:02 a.m. EST today included this verbiage:
PUP.OPTIONAL.Adpeak
PUP.OPTIONAL.DefaultTabA
PUP.OPTIONAL.GreatArcadeHits.A
PUP.OPTIONAL.ScorpionSaver

Your comments would be appreciated on this listing found by MalwareBytes and how to permanently end this fracas (THANK YOU):

More lurking problems.

After the above post, ran MalwareBytes and AVG again. Both said no threats.

Did a restart and again updated MalwareBytes. Ran it again.
It found 30 new threats (see attached txt file). Removed them all.

Went to Add/Remove and found Scorpion Saver again. Tried to delete it. Attached screen print shows what happened. Used Agent Ransack to search for missing file t.msi. Not found on C:\ or any other partition.

Went to Piriform and downloaded/installed updated version of CCleaner. Ran new CCleaner. Took forever compared with previous version. Found and deleted only normal internet histories etc.

Went to Start Folder to see if something is strange there. Found nothing weird that I can determine.

I will restart and again run scans.

My apologies Kattussoft.

Run your A/V in safe mode and Malwarbytes too for that matter just to be safe. PUP = Potentially Unwanted Program. (NO you don't want any of these.) It looks like Malwarebytes successfully got them. You can also run Superantispyware (which I highly recommend) (Full scan)

There is no "best" Anti-Virus as its a matter of taste. There ARE leaders in the field (we have multiple threads pertaining to this subject so I will not recommend one. I used Avast until this morning when I changed to Bit Defender. Avast is near the top at detection rates but I personally don't care for the new UI and its increasing amounts of nag balloons.)

Just a suggestion from a NON EXPERT. (ME)
Something I use often and it does help me. Using Microsoft I.E. works best for me with the download.

Free Virus Scan | Online Virus Scanner from ESET

ScorpionSaver has been removed already by malwarebytes on your system. It's only on the list (fake info).
Search in registry for ScorpionSaver. Is it in some UNINSTALL branch? If so... delete it.

Also Scorpion Saver Removal Guide

So delete:
folder C:\Program Files\ScorpionSaver Services\
folder C:\Windows\Installer\{6E810AB6-F34E-49A3-A93F-9E503660F718}\
C:\Windows\SysWOW64\AdpeakProxy*.*
C:\Windows\System32\AdpeakProxy*.*

Did you get back up and running?

BTDT yesterday and today.

[FONT=&quot]1. REMOVE ScorpionSaver[/FONT]
[FONT=&quot]2. Run : ipconfig /flushdns[/FONT]
[FONT=&quot]3. Run : sfc /scannow[/FONT][FONT=&quot][/FONT]
[FONT=&quot]3. Start your browser. I/E. FireFox. [/FONT]

cCleaner has a tool to remove "fake" entries in the install list.

Launch cCleaner -> click Tools in the left hand pane -> select Uninstall from the tools list -> select the program you wish to remove from the list -> click on Delete Entry in the righthand option list.

This ONLY removes the program from the list, it does not uninstall or affect the program in any other way.
If all else fails, you need a bigger hammmer. There are nine scanners in this guide, so it takes a while to run through all of them.

Kaktussoft said:

ScorpionSaver has been removed already by malwarebytes on your system. It's only on the list (fake info).
Search in registry for ScorpionSaver. Is it in some UNINSTALL branch? If so... delete it.

Also Scorpion Saver Removal Guide

So delete:
folder C:\Program Files\ScorpionSaver Services\
folder C:\Windows\Installer\{6E810AB6-F34E-49A3-A93F-9E503660F718}\
C:\Windows\SysWOW64\AdpeakProxy*.*
C:\Windows\System32\AdpeakProxy*.*

Click to expand...

Thank you. You are most helpful.

Ran full scans with AVG and SuperAntiSpyware again today and all was fine. Also ran MalwareBytes again, same report. I will next try running them in Safe Mode to be sure.

Searched for the 4 files you listed. Can't find any of them. Maybe we have eliminated the problem since all is running well today. I'll do the Safe Mode Scans and some more testing later today and tomorrow, and then report back.

Again, many thanks.

Slartybart said:

cCleaner has a tool to remove "fake" entries in the install list.

Launch cCleaner -> click Tools in the left hand pane -> select Uninstall from the tools list -> select the program you wish to remove from the list -> click on Delete Entry in the righthand option list.

This ONLY removes the program from the list, it does not uninstall or affect the program in any other way.

Kaktussoft said:

ScorpionSaver has been removed already by malwarebytes on your system. It's only on the list (fake info).
Search in registry for ScorpionSaver. Is it in some UNINSTALL branch? If so... delete it.

Click to expand...

If all else fails, you need a bigger hammmer. There are nine scanners in this guide, so it takes a while to run through all of them.

How to easily clean an infected computer​

Bill​

Click to expand...

Hi Bill.

Tried your CCleaner suggestion and the attached jpg shows you what happened.

I am proceeding as indicated in my above post responding to Kaktussoft.

P.S. to KAKTUS: Since I can not consider myself even close to being a pro, I have made it a firm rule to never manually attempt to amend or emend the Registry. I'll use some of the PCTools variety of software to edit the Registry, but not me personally. It's just something that I don't feel comfortable with.

Hmmm....

That's odd - you clicked on Delete Entry, not Uninstall, right?

cCleaner should have removed the registry install entry for ScorpionSaver - at least that's how I understand the process. Your image seems to indicate it is trying to delete an msi file. It might be 'protected' in the registry - not sure.

In a Windows Explorer window, select the c:\ drive and enter the following in the search box (the word OR must be capitalized)
Scorpion OR Adpeak

post a screenshot of the search results

ipconfig /flushdns

[FONT=&quot]Command prompt run :[/FONT] [FONT=&quot]ipconfig /flushdns

[/FONT]
[FONT=&quot]It cleaned up the errors from the AVG removal. Last week I removed the adware, later I restarted the computer. That is when I noticed I had a bigger problem. I ran several restore points until I got a clean one. Then the sht hit again. Warned of the coming problem, I started cleaning and searching for a fix.[/FONT]


[FONT=&quot]This process worked for me on Win7 32bit to keep my browser connection.[/FONT]

Hi Florida Rene

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Using AdwCleaner v3: Scan & Clean:
Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

SLARTYBART: Yes, I clicked on Delete Entry. I will try your other suggestion as soon as I can.

KAKTUSSOFT: Mbam in SafeMode with Networking reports about 15 instances of Scorpion and some movie links I never saw before. I'm weary now and will try again tomorrow night.

JACEE: I downloaded the AdwCleaner.exe file from Bleeping Computer and got the following warning I've never seen before: "This program is not commonly downloaded and could harm your computer." So, I'm hesitant.

INDIANACARNIE: I am trying to avoid a Repair/Install as I've heard that it often results in having to re-install all your software...and I have a ton of graphics programs and other software packages that I've upgraded and patched a number of times (like various Corel, Adobe, and Serif products that need frequent patching).

I must say that I am very heartened and pleased by the helpful suggestions on this Forum. But I'm puzzled (and frustrated) too. For instance, MalwareBytes reported no infections 7 hours ago (normally) and now found a lot of them (safe with networking).

Thank you all again.

AdWCleaner is completely safe to download and use - its just your AV being overzealous.