Solved Virus Deletion Now Makes Internet Access Impossible

[indianacarnie]

Hmmmmmmm.. A couple more things we can try. Reopen Farbar, click scan. In Internet services see if you see any of these : afd service not running, tdx service not running, Netbt service not running, IPsec service not running,Nsi service not running.

Have you considered a repair install? Or even a clean install? (The repair install will save your files/settings etc.) I was hoping to avoid this but it could be your best option at this stage. Its not hard just a little time consuming.

Heres a link to a tutorial on how to do that : http://www.sevenforums.com/tutorials/3413-repair-install.html

There's a link in the tutorial on where/how to get an official .iso of Win7 if you don't have the disc. If you have any questions someones always here and I'll be back in the morning. I'm also going to see if I can get a network specialist to look into this for you. We'll get your net back one way or the other!

 

[indianacarnie]

Here's one other you could try. I must admit your problem is proving tougher than anticipated ...... must have been a particularly nasty bug you caught !

Complete Internet Repair from Petrichorsoft

 

[Florida Rene]

Good Morning, and thank you again, Indiana...

On my first cup of coffee now. Just ran Farbar as you suggested, and here's what it reported:

Farbar Service Scanner Version: 05-12-2013
Ran by Rene (administrator) on 20-12-2013 at 06:53:28
Running from "C:\batch"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

I appreciate your other thoughts and I'll get to them when I'm more fully awake.

Thank you so much for sticking with me!

 

[Golden]

Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

'
This implies internet connectivity......can you post a screen capture image of what you see if you try and access google.com?

 

[Kaktussoft]

Is skype, your mail client or any p2p software working correctly?

 

[Kaktussoft]

Which of those files are on your computer?
Files installed by ScorpionSaver Services
Program executable:adpeakproxy.exe (Malware detected)
Name:AdpeakProxy.exe
Path:C:\Program Files\scorpionsaver services\adpeakproxy.exe
MD5:8cbe07b5aa098830acb1e1f555c7f92b

Additional files:

• adpeakregisterlsp64.exe (RegisterLSP)
• installdll.dll
• installdll64.dll
• adpeakwfpinstaller.exe (WFPInstaller)
• adpeakregisterlsp.exe
• adpeakproxy.dll
• adpeakproxy64.dll
• installbat.dll
• installbat64.dll
• pcproxydll.dll
• microsoft.deployment.windowsinstaller.dll (by Outercurve Foundation) - Windows Installer XML

Behaviors exhibited


Service

• adpeakproxy.exe runs as a service named 'AdpeakProxy' (AdpeakProxy) "Adpeak Service".

 

[Kaktussoft]

Or, you can uninstall ScorpionSaver Services from your computer by using the Add/Remove Program feature in the Window's Control Panel.

• On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:
  • Windows Vista/7/8: Click Uninstall a Program.
  • Windows XP: Click Add or Remove Programs.
• When you find the program ScorpionSaver Services, click it, and then do one of the following:
  • Windows Vista/7/8: Click Uninstall.
  • Windows XP: Click the Remove or Change/Remove tab (to the right of the program).
• Follow the prompts. A progress bar shows you how long it will take to remove ScorpionSaver Services.
• If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.

 

[Florida Rene]

Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

'
This implies internet connectivity......can you post a screen capture image of what you see if you try and access google.com?

Screen Capture hopefully accompanies this post.

In case it doesn't...

Trying to get to Google.com results in "This webpage is not available."

 

[Kaktussoft]

Please do #27
Please do #26 (any files with "peak" in filename on computer?)

 

[Kaktussoft]

http://198.211.122.92/ works?

 

[Florida Rene]

Is skype, your mail client or any p2p software working correctly?

Neither Thunderbird or Yahoo mail clients work.

Do not have Skype.

Can't access anything on the web. Have tried many of my previously-working shortcuts, e.g.: CNN, ABC, Pandora, MSNBC, Drudge, HuffPost, Tampa Bay Times, Tampa Tribune, New York Times, Weather Channel.

 

[Kaktussoft]

Answer post 26, 27 and (most important 30) please.

 

[indianacarnie]

I must say this problem of yours is..... intriguing to say the least. Almost everything I've found pertaining to your problem points to Malware but your first post clearly says its been removed. So we SHOULD just be looking at the aftermath of the removal, but it seems to not be the case. I'll be almost totally deferring to Golden and Kaktussoft as both have more experience in internet/networking than me. I'm sorry I couldn't have been more help to you.

Have you tried accessing the net in "safe mode"?

 

[Florida Rene]

Please do #27
Please do #26 (any files with "peak" in filename on computer?)

Okay...and Thanks. Rebooting now, then will try Internet Access again.

Scorpion Saver removed via Add/Remove.

No "adpeak" files on C:\ per Agent Ransack search.

Here is list of files containing "peak" on C:\ and they all look okay to me:

 

[Kaktussoft]

Answer post 30!

 

[Kaktussoft]

in command prompt do:

ftp  [URL="ftp://ftp.microsoft.com"]ftp.microsoft.com[/URL]

Post output

 

[Florida Rene]

I must say this problem of yours is..... intriguing to say the least. Almost everything I've found pertaining to your problem points to Malware but your first post clearly says its been removed. So we SHOULD just be looking at the aftermath of the removal, but it seems to not be the case. I'll be almost totally deferring to Golden and Kaktussoft as both have more experience in internet/networking than me. I'm sorry I couldn't have been more help to you.

Have you tried accessing the net in "safe mode"?

Hello again...

Yes, it was removed according to AVG, and I also ran MalwareBytes (1 week old) and Security Essentials (1 day old) which both said no threats. Of course, I can't update these tools because I can't access the Internet via that computer.

I am now trying recommendations by Golden and Kaktussoft, and I also have one or two more of yours to tackle.

I do greatly appreciate your attempts to resolve my issue.

Yes, I tried to go online with Firefox and with I.E. in safe mode. Neither worked.

 

[Florida Rene]

KaktusSoft Sportsoftware - Welkom works?

No, it doesn't. See attached.

I just rebooted. Tried it again. No dice.

 

[Florida Rene]

Answer post 30!

Ya...

Laatste wijziging: 04-12-2013 10:54

Alte.

Me too.

Danke fir alles helfin (yup, bad spelling, but you understand)

 

[Florida Rene]

in command prompt do:

ftp  [URL="ftp://ftp.microsoft.com"]ftp.microsoft.com[/URL]

Post output

I greatly appreciate your help.

Here's what I got with the command you suggested: