@jimbo45
I've been at work and haven't been able to do anything other than read forum posts. :)
On the topic of using a system restore, I tried to do that immediately once the attack hit but it appeared my system restore had been corrupted so I had to go to "plan B" and I thought I had eliminated the problem then it hit again.
Got home and ran the flush, my webrootkit went popped up and said system32/netsh.exe we trying to install each reboot and recommended a block, so I did...now I cqnt access the web on my comp, posting from phone
(EDIT). Apparently I have a restore point from 2 days ago, restoring to that point and will uninstall webrootkit and rerun the flush
Are you running Webroot Antivirus/Spysweeper? I may be wrong, but I think Webroot hooks Layered Service Providers (LSP) which would be why it's not letting go of netsh winsock reset all
Ya that's it. I tried a system restore and my reboots are taking forever. Restore failed because it "could not access a file, probably due to an antivirus" . I uninstalled all but avira and ran again with same error message. Not sure what to do at this point
Disable the proxy settings in Internet Explorer:
1) Under “Tools” in the browser tool bar select “Internet Options”.
2) In the “Internet Options” window that pops up, click the “Connections” tab at the top.
3) Click “LAN Settings” near the bottom of the “Connections” section.
4) If the “Proxy server” checkbox is marked with a check, click it to deselect/uncheck it.
5) Click “Ok” to close the “Local Area Network (LAN) Settings” window.
6) Click “Ok” to close the “Internet Options” window.
Reboot
Make sure "Proxy server" is still disabled under your LAN Settings.
Test whether internet connectivity is restored.
Ok system restore pushed through. Should I uninstall Webroot SecureAnywhere and flush again or is there a different course of action to take?
Let's see what DDS says ... it doesn't 'fix' anything, it just gives me the information I need to look at :)
Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3
- Disable any script blocking protection
- Double click the dds icon to run the tool.
- When done, DDS will open two (2) logs:
- DDS.txt
- Attach.txt <--- will be minimized in the task tray
- Save both reports to your desktop.
Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.
Copy + Paste the DDS text and add Attach.RAR as an attachment ya?
Quote