BleepingComputer.com: Internet Explorer and windows live will not work

I am running Vista 64 Ultimate. Upon reboot my Internet explorer would not work and windows live messenger could not sign in. I could how ever use my email and was able to talk on Ventrillo. The other pc's in the house have no problems connecting to the internet. I have had one error upon logging into my pc it says it could not initialize or start up csrss.exe; yet 2 of that exe was running in the task manager when I checked. I have run Malwarebytes' Anti-Malware and it found nothing. I was able to do a system restore and it worked until a reboot today brought back all the problems again. I have looked into my anti virus ( Avast Free version) and it said it found 6 virus's but nothing was in the virus chest. Also 3 people got an email from me yesterday at noon, but my pc was off from a power outage from a storm.

Not sure if this is one problem or 2. Thanks for taking your time to help out.

P.S. I did update 2 thisngs on the 10th. First was windows defender and the second was new nvidia drivers 275.33.

This post has been edited by Blade Zephon: 16 July 2011 - 11:35 PM
Reason for edit: Moved from Vista to AII. ~BZ

Ok more news so I got an email from comcast saying I have been hijacked by a bot. I downloaded the exe for Norton and uninstalled avast. while I was waiting for the uninstallation of avast I turned off system restore so it would not reproduce it self and when avast finished it rebooted before i could install norton and now I can't get on the inernet. At the present I am running sophos anti rootkit. I tried to install nortons on my external HD from another pc but it said the destintion was invalid. Can anyone please help me. It has been days since I originaly posted this problem and no one has even said anything.

This post has been edited by Samoot: 16 July 2011 - 11:11 PM

Use good computer and USB flash drive to transfer some downloads.

Install this on GOOD computer, so it won't get infected while moving USB stick around.

Download, and run Flash Disinfector, and save it to your desktop (Windows Vista and Windows 7 users, scroll down)

*Please disable any AV / ScriptBlockers as they might detect Flash Disinfector to be malicious and block it. Hence, the failure in executing. You can enable them back after the cleaning process*

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  
• The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
  
• Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
  
• Wait until it has finished scanning and then exit the program.
  
• Reboot your computer when done.

Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

Windows Vista and Windows 7 users
Flash Disinfector is not compatible with the above Windows version.
Please, use Panda USB Vaccine, or BitDefender’s USB Immunizer

Now, on BAD computer....

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:

• Report IE Proxy Settings
  
• Report FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List last 10 Event Viewer log
  
• List Users, Partitions and Memory size

Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

OK so I ran sophos anti root kit and it found 15 root kits and fixed them. Then I was able to install Norton's on another pc and found the Norton's download file and made a copy and used the copied dl folder to a flash drive and put it on my infected PC and istalled and ran it. It found 52 infections and fixed them and now my infected PC is fixed and all is working fine the only odd thing is that in idle my PC is using 60% of my memory.

In Vista and Windows 7 it's normal.

I still suggest you post all logs I requested, so we can make sure you're clean.

Results of screen317's Security Check version 0.99.7
Windows Vista (UAC is disabled!)
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Wise Registry Cleaner Professional V5.12
Java™ 6 Update 18
Out of date Java installed!
Adobe Reader 9.4.5
Out of date Adobe Reader installed!
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
``````````End of Log````````````


As for my firewall I have a hardwire firewall I use from my Linksys router. I also just updated the Adobe flash player but it is the beta so it may not recognize it as up to date. My OS is up to date not sure why it says it isn't. I have auto update on.

I will post the other as soon as it is done.

Uninstall Wise Registry Cleaner Professional V5.12
Registry cleaners/optimizers are not recommended for several reasons:

• Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.
  
  The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
  
  
• Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
  
  
• Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
  
  
• Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
  
  
• The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".

Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

• Ed Bott's Webog: Why I don't use registry cleaners
  
• Do I need a Registry Cleaner?

Ok after running GMER there were no problems. I would like to take this time and say thanks for all your help.

Well, it's up to you, but I'd like to see MiniToolbox and MBAM logs.

I also strongly suggest, you keep Windows firewall on even while being behind a router.