Error 1068, Can't connect to internet

Please download the following to a USB pen drive using a non-infected computer, and then move the programs to the Desktop of the suspect infected computer...

Download the Farbar Recovery Scan Tool
Select the version that applies to the system.


Save it to the Desktop.

• Double-click the downloaded file to run it.
• When the tool opens click Yes to disclaimer.
• Press the Scan button.
• FRST64 makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply. <<---


The first time the tool is run, it also makes another log: Addition.txt
Also post the Addition.txt in your reply. <<---


Also, download Farbar Service Scanner
Save to the Desktop

• Make sure the following options are checked:
  
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press: Scan
• FSS creates a log, FSS.txt, on the Desktop.

Please provide the FSS.txt in your reply. <<---

Please do the following:

Make sure there are no USB drives connected to the infected computer except K:\
FRST is running from K:\ <<--- so the fixlist to follow also has to be on this drive!!

Open Notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the quote box below (Do not copy the word 'Quote');
Save it on the USB pen drive (K:\) that has FRST and name it: fixlist.txt

Code:

Start
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$8d6e451df1df7da1582cafd4e7bd6506\n. ATTENTION! ====> ZeroAccess?
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3925031014-69785429-301285770-1000\$8d6e451df1df7da1582cafd4e7bd6506\n. ATTENTION! ====> ZeroAccess?
HKLM-x32\...\Run: [] -  [x]
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3925031014-69785429-301285770-1000\$8d6e451df1df7da1582cafd4e7bd6506
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$8d6e451df1df7da1582cafd4e7bd6506
C:\ProgramData\SMRResults311.dat
end

This script is written specifically for jkoll66, and, only for use on this infected computer.
Running this on another computer may cause damage to the Operating System!!

Run FRST, and press the Fix button, just once, and wait.
The tool creates a report on the pendrive called: Fixlog.txt

Remove the pen drive from the infected computer, and post Fixlog.txt in your reply using the good computer.

Still using the clean computer, continue with the USB pendrive (K:\) plugged in, and download RogueKiller: http://tigzy.geekstogo.com/roguekiller.php
Select the version that applies to the infected system.
Save to the USB pen drve (K:\)

Also press on with Downloading MiniToolBox
Save to the USB pen drve (K:\)

Now, connect the USB pen drive (K:\) to the infected computer.

After closing all windows and browsers, right-click the downloaded RogueKiller file and select: Run as Administrator
At the program console, wait for the Prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN
When done, a report opens on the drive: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.

Next, double-click the MiniToolBox downloaded file to run it.
When the program console opens, please check the following boxes:

Flush DNS
Report IE Proxy Settings
Report FF Proxy Settings
List content of Hosts
List IP Configuration
List Winsock Entries

Click: Go

Please post the MiniToolBox Result.txt in your reply.


Are both Norton and McAfee Antivirus installed on the infected computer??

I think McAfee might have been installed during an Adobe Flash update. I uninstalled it.

Here are the files you requested. Thanks.:)

Fixlog.txt

RKreport[0]_S_07292013_163958.txt

Result.txt

Good job!

All sorts of "stuff" still remains, so let's remove some more. We need a clean computer before we start repairing services causing the Error 1068.

Since you have no Internet connection, please download the following programs to the USB pen drive, move the programs to the Desktop of the troubled computer, and run them from there.

Download AdwCleaner:
http://www.bleepingcomputer.com/download/adwcleaner/


Also use the Junkware Removal Tool Download


Please go to the TDSSKiller Download, and select the .exe version.



AdwCleaner:

• Save the program to the Desktop
• Close all open programs and internet browsers.
• Right-click on adwcleaner.exe and select: Run As Administrator
• At the program console, click on: Delete
• When the program is done, the computer is rebooted automatically, and a text file opens after the restart.

Please post the AdwCleaner report in your reply.


Junkware Removal Tool:
Save to the Desktop.

Make sure you temporarily disable your AntiVirus, Firewall, and any other AntiSpyware applications.
These programs may interfere with the running of JRT.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

Right-click JRT.exe and select: Run as Administrator
The tool opens and starts scanning the system. Please be patient as this can take a while...

When done, a report, JRT.txt is saved on the Desktop.

Please post the contents of JRT.txt in your reply.


TDSSKiller:
Move from the USB pen drive to the Desktop!!
Double-click on TDSSKiller.exe to run the program.

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System
Click: OK

Press: Start Scan

•If a suspicious object is detected by this program, the default action is Skip. Leave this action as is, and click on: Continue
•If malicious objects are found, they show in the Scan results.
Ensure Cure (the default action) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)

When done, the tool creates a log on the disk with the Windows Operating System, normally C:\

Logs have a name like:
C:\TDSSKiller.X.X.X_07.31.2013_15.31.43_log.txt

Please attach the TDSSKiller log in your reply.



Now, let's use HitmanPro.Kickstart on the troubled computer, scan it for any leftover malware, and remove any infection that may still be present.

Also, you may want to print these instructions, so they are available to follow.

Load the USB flash drive with HitmanPro.Kickstart as follows...
Note: the contents of the USB flash drive are erased during this process!

Use the clean (non-infected) computer, and download:
HitmanPro.Kickstart - Anti ransomware, politievirus, bundestrojaner, Reveton, BKA, GVU - SurfRight

Under Download (on the right) select the program applicable to the infected system: 64-bit or 32-bit

When HitmanPro opens, click the KickStart icon at the bottom of the screen.

Plug in the USB flash drive.

When the USB flash drive is detected, a selection screen is presented.
Select the USB flash drive from the choices, and press: Install Kickstart
A warning that all contents of the selected flash drive will erase is presented.
Press: Yes

As the HitmanPro.Kickstart files are loaded, a progress indicator is shown on the screen.
Once the process is completed a screen is presented with the contents of HitmanPro.Kickstart

Remove the USB flash drive from the clean computer and press: Close


Now, with the problem computer shut down, plug the USB flash drive into a USB port, and turn on the power.

When the computer starts, press the key that brings up the Boot Menu. (On some machines its F12, F10, or F2)

From there, select to boot from the USB drive. (It may say 'Removable Drive' in the options.)
Info: How to Remove Ransomware - Select Real Security

Once you select the USB flash drive to boot from, press: Enter

A KickStart prompt with USB boot options appears.
Select: 1 (Bypass the Master Boot Record (Default))

The system continues to boot from the hard drive and starts Windows.

If you get a message stating that Windows failed to start, etc., just select: Start Windows Normally

When Windows boots, you either get a logon screen, or the Desktop is started.
If you see a logon screen with your User name, logon with it.


In the next prompt, to start the program without installing to the local hard disk, select the option to do: One-time scan to check the computer

To start scanning for malware press: Next

If malware is detected, the program shows what malware is present on the system using a red framed screen as shown below:


Select Next to quarantine the malware into a secure storage where it can no longer start.


At the next screen, activate the 30-day free license:

After successful activation (30 days), press: Next

A screen indicating that the malware was successfully disabled or removed is presented.
Press: Next

To obtain a report of the scan results, press: Save log
Save the Notepad log!!
It has a name such as: HitmanPro_xxxxxxxx_xxxx


Remove the USB drive, and press: Reboot
If no malware is found, press: Close

After HitmanPro.Kickstart is done, you should be back into normal Windows.

Please post the HitmanPro log in your reply.

Presuming that this is the error you are getting:
Error 1068: The dependency service or group failed to start.

Let's do the following and see what it can repair...

Please download the ESET ServiceRepair to the good computer:
http://kb.eset.com/library/ESET/KB%2...icesRepair.exe
Save to the USB pen drive.

Remove the pen drive from the good computer and plug it into the troubled computer.

Must do: Move the ESET ServiceRepair program from the pen drive to the Desktop of the troubled computer. Just let it be for now.

Next, in the infected computer, see if you can do the following:
Since the step that follows involves editing the Registry, please create new restore point before proceeding.
Look at the following instructions (on the good computer) and follow: Option Two
System Restore Point - Create

Now, back to the ESET ServiceRepair program on the Desktop...
Double-click the file to run it.
When the program runs, a prompt appears asking if you want to proceed.
Click: Yes

When the Services routine is Completed, you are asked to Reboot.
Click Yes to allow the reboot.

The tool creates a folder named CC Support on the Desktop.
Open the CC Support folder, and please provide the CC Support\Logs\SvcRepair.txt in your reply.

Last, run the Farbar Service Scanner once again, but do so from the Desktop!
Select all the options.
Press: Scan

Please provide the new FSS.txt in your reply.

Made some progress, but, still have more to do. Let's give the following a whirl to see if we can get the services running...

Please open Notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the quote box below (Do not copy the word 'Quote'):

@echo off
sc config Dnscache start= auto
Net Start Dnscache
sc config Dhcp start= auto
Net Start Dhcp
sc config Nsi start= auto
Net Start Nsi
sc config nsiproxy start= auto
Net Start nsiproxy
sc config tdx start= auto
Net Start tdx
sc config afd start= auto
Net Start afd
sc config Tcpip start= auto
Net Start Tcpip
sc config mpsdrv start= auto
Net Start mpsdrv
sc config MpsSvc start= auto
Net Start MpsSvc
sc config bfe start= auto
Net Start bfe
sc config wscsvc start= auto
Net Start wscsvc
sc config wuauserv start= auto
Net Start wuauserv
sc config WinDefend start= manual
Net Start WinDefend
shutdown -r -t 1
del %0

In Notepad, select: File > Save As...
Select the Desktop on the left side of the Save As... dialog box.
In File name box, type: isvcfix.bat
Press: Save
Close: Notepad

Right click the file on the Desktop, and select: Run as Administrator
If prompted by User Account Control, select: Yes
When the batch file is processed the system will reboot.

After the reboot, run the Farbar Service Scanner once again (from the Desktop!)
Select all the options.
Press: Scan

Please provide the new FSS.txt in your reply.



If the above does not get your Internet back, let's go on a hunch, and uninstall Norton Internet Security using Control Panel > Programs and Features > Uninstall List. When you get your Internet back you can either reinstall NIS, or install another AntiVirus program.