Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Anti Virus System Pro and Internet Explorer Problems


  • Please log in to reply
12 replies to this topic

#1 Robert1123

Robert1123

  • Members
  • 62 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 01 December 2009 - 10:37 AM

Greetings,

I had a problem with the Anti Virus System Pro malware. I was finally able to successfully get to my desktop, download the latest Malwarebytes and remove the Anti Virus System Pro malware.

Now, I cannot get my computer to long onto the Internet. I have reinstalled IE7 and have run the Internet Connection trouble shooter on Windows XP SP2 but it says that the Internet connection is not working.

I have another home computer that works on the same LAN and it logs on OK.

Is this a common Post-Anti Virus System Pro problem????? Any suggestions????????

Thanks,

Robert

Edited by Robert1123, 01 December 2009 - 10:40 AM.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:41 AM

Posted 01 December 2009 - 02:45 PM

Generally, most Internet connectivity problems arise out of corrupt Winsock settings due to the installation of a networking software or Malware infestation.

Try resetting the IP address:
  • Go to Posted Image > Run... and in the open box, type: cmd
  • Press OK or Hit Enter. A dos Window will appear.
  • At the command prompt type or copy/paste:: ipconfig /release
  • Hit Enter.
  • When the prompt comes back, type: ipconfig /renew
  • Hit Enter.
  • Close the command box and and see if that fixes the connection. No reboot needed.
-- XP users can refer to XP ipconfig Tutorial: Step 4
-- Vista users can refer to Vista ipconfig Tutorial: Step 4 and How to Enable Run Command in Vista

If that did not resolve the problem:
  • Go to Posted Image > Run... and in the open box, type: cmd
  • Press OK or Hit Enter.
  • At the command prompt, type or copy/paste: ipconfig /flushdns
  • Hit Enter.
  • You will get a confirmation that the flush was successful.
  • Close the command box.
If the above commands did not resolve the problem, the next thing to try is to reset your network settings and Configure TCP/IP to use DNS.
  • Go to Posted Image > Control Panel, and choose Network Connections.
  • Right-click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and and choose Properties.
  • Double-click on Internet Protocol (TCP/IP) or highlight it and select Properties.
  • Under the General tab, write down any settings in case you should need to change them back.
  • Select the button that says "Obtain an IP address automatically" or make sure the DNS server IP address is the same as provided by your ISP.
  • Select the button that says "Obtain DNS servers automatically".
  • If unknown Preferred or Alternate DNS servers are listed, uncheck the box that says "Use the following DNS server address".
  • Click OK twice to get out of the properties screen and restart your computer. If not prompted to reboot go ahead and reboot manually.
-- Vista users can refer to How to Change TCP/IP settings

CAUTION: It's possible that your ISP (Internet Service Provider) requires specific DNS settings here. Make sure you know if you need these settings or not BEFORE you make any changes or you may lose your Internet connection. If you're sure you do not need a specific DNS address, then you may proceed.

If that still does not help and your using Windows XP SP2 or SP3, log on as an administrator:
  • Go to Posted Image > Run... and in the open box, type: cmd
  • Press OK or Hit Enter. A dos Window will appear.
  • At the command prompt, type or copy/paste: netsh winsock reset
  • Hit Enter.
  • When the program is finished, you will receive the message: "Successfully reset the Winsock Catalog. You must restart the machine in order to complete the reset."
  • Close the command box and reboot your computer.
-- Vista users can refer to Resetting Winsock or How to recover from Winsock2 in Vista
This command resets the Winsock catalog to the default configuration and is useful if a malformed LSP is installed that results in loss of network connectivity. Any previously-installed LSPs will need to be re-installed.

Note: Instead of the using the above netsh winsock command, another option for resetting TCP/IP in XP or Vista, is to use Microsoft's Automatic Fix. Click the Fix this problem link. Then click Run in the File Download dialog box, and follow the steps in this wizard. You can save the automatic fix to a USB flash drive or CD, transfer it to the affected computer and then run it.

Also check your Proxy settings to make sure malware did not alter them:
  • Open Internet Explorer > click Tools > Internet Options > Connections tab.
  • Click the LAN Settings... button and uncheck Use a proxy server for your LAN or
    change the settings to the proxy you normally use if you previously reconfigured it.
  • Click Ok and then click Ok again.
  • Close Internet Explorer and restart the computer.
  • Open Firefox, click Tools > Options > Advanced and click the Network Tab.
  • Under the Connection section click on the Settings... button.
  • Under Configure Proxies to Access the Internet, check No proxy. This is the default option if you don't use a proxy.
  • Click Ok and then click OK again.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Robert1123

Robert1123
  • Topic Starter

  • Members
  • 62 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 02 December 2009 - 08:32 PM

Quietman7,

Thanks! I have my IE7 back up and running and interfacing successfully with my Internet connection.

It seems that one of the last things on your instructions worked:

Click the LAN Settings... button and uncheck Use a proxy server for your LAN

But I have a question about this section early on which did NOT restore the connection:

If the above commands did not resolve the problem, the next thing to try is to reset your network settings and Configure TCP/IP to use DNS.
· Go to > Control Panel, and choose Network Connections.
· Right-click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and and choose Properties.
· Double-click on Internet Protocol (TCP/IP) or highlight it and select Properties.
· Under the General tab, write down any settings in case you should need to change them back.
· Select the button that says "Obtain an IP address automatically" or make sure the DNS server IP address is the same as provided by your ISP.
· Select the button that says "Obtain DNS servers automatically".


I changed the "Preferred DNS" from 77.74.48.113 to "Obtain DNS servers automatically."

Again, this did not work. Should I go back and change this setting back to "Preferred DNS" and "77.74.48.113"? Can you explain why or why not?

Thanks so much again,

Robert

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:41 AM

Posted 02 December 2009 - 11:09 PM

The Preferred DNS Server setting is for entering a specific (preferred) IP address for a DNS Server which is commonly used in network (private/work/business) environments. However most Internet Service Provider (ISP) have their own caching DNS server to reduce network load. Please read How Domain Name Servers Work.

More specifically, the DNS (Domain Name Service) is a service that resides on a Server and communicates to client computers what the name is that associates with an IP address. The preferred DNS is where the client will look to first for the name resolution.

The IP address 77.74.48.113 resolves to NL-SOFTSOL (Soft Solutions Inc.) in the Netherlands.

Are you part of a network? Do you recognize Soft Solutions? That's why I said "It's possible that your ISP (Internet Service Provider) requires specific DNS settings here. Make sure you know if you need these settings or not BEFORE you make any changes or you may lose your Internet connection. If you're sure you do not need a specific DNS address, then you may proceed."

If not, then the setting was probably altered by malware. There are Trojan infections (DNSChanger) which can change DNS settings and redirect your browser to their DNS Server or other wanted sites.

...rogue DNS servers are part of click fraud and leakage of personal information...we discovered that this network is now targeting four of the most popular search engines. In a large scale click fraud scheme, the ZLOB gang appears to hijack search results and to replace sponsored links with DNS “tricks”.

ZLOB Enters The Search Engine Market

A new Trojan horse masquerading as a video "codec" required to view content on certain Web sites tries to change key settings on the victim's Internet router so that all of the victim's Web traffic is routed through servers controlled by the attackers...recent versions of the ubiquitous "Zlob" Trojan (also known as DNSChanger) will check to see if the victim uses a wireless or wired hardware router. If so, it tries to guess the password needed to administer the router by consulting a built-in list of default router username/password combinations. If successful, the malware alters the victim's domain name system (DNS) records so that all future traffic passes through the attacker's network first. DNS can be thought of as the Internet's phone book, translating human-friendly names like example.com into numeric addresses that are easier for networking equipment to handle.

Malware Silently Alters Wireless Router Settings
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Robert1123

Robert1123
  • Topic Starter

  • Members
  • 62 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 03 December 2009 - 03:21 AM

The IP address 77.74.48.113 resolves to NL-SOFTSOL (Soft Solutions Inc.) in the Netherlands.

Are you part of a network? Do you recognize Soft Solutions?


No, I do not know who/what Soft Solutions is. I will leave it on automatic.

Thanks again, I will let you know if anything starts acting up with my IE and connection.

Warmest regards,

Robert

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:41 AM

Posted 03 December 2009 - 06:28 AM

You're welcome.

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Posted Image > Run... and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista and Windows 7 users can refer to these links: Create a New Restore Point in Vista or Windows 7 and Disk Cleanup in Vista.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 tom_rand

tom_rand

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:05:41 AM

Posted 03 December 2009 - 08:28 AM

I thought that IP address looked familiar - it's the same one that hit me in my google redirect problem.

On my machine, MBAM cleaned up the following:
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{22c00a2b-4b86-4866-afa4-435e4a0e8163}\NameServer (Trojan.DNSChanger) -> Data: 77.74.48.113 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2be5b63a-19ef-43de-9ae0-11581cdfcaf8}\NameServer (Trojan.DNSChanger) -> Data: 77.74.48.113 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{22c00a2b-4b86-4866-afa4-435e4a0e8163}\NameServer (Trojan.DNSChanger) -> Data: 77.74.48.113 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2be5b63a-19ef-43de-9ae0-11581cdfcaf8}\NameServer (Trojan.DNSChanger) -> Data: 77.74.48.113 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{22c00a2b-4b86-4866-afa4-435e4a0e8163}\NameServer (Trojan.DNSChanger) -> Data: 77.74.48.113 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{2be5b63a-19ef-43de-9ae0-11581cdfcaf8}\NameServer (Trojan.DNSChanger) -> Data: 77.74.48.113 -> No action taken.


which just happens to be the exact same IP address you're seeing.

Make sure you're running the latest MBAM update, and check your registry.

#8 cheezychicken

cheezychicken

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:41 AM

Posted 03 December 2009 - 11:48 AM

try going to control panel->internet settings (or something similar)->advanced then "reset advanced settings"
(i know i shouldnt help but it fixed this problem for me! :thumbsup: )

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:41 AM

Posted 03 December 2009 - 11:59 AM

We have already made the necessary changes (pOST #2) and the OP advised the problem was resolved. Since then I have been explaining the infection.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 Robert1123

Robert1123
  • Topic Starter

  • Members
  • 62 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 03 December 2009 - 03:26 PM

I thought that IP address looked familiar - it's the same one that hit me in my google redirect problem.


which just happens to be the exact same IP address you're seeing.

Make sure you're running the latest MBAM update, and check your registry.


I had to change from the specified DNS address to the automatic setting. THIS IS WHAT FIXED THE PROBLEM OF MY BROWSER INTERFACING WITH MY INTERNET CONNECTION.

And that was after running the most up to date MBAM.

Thanks,

Robert

#11 Robert1123

Robert1123
  • Topic Starter

  • Members
  • 62 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 03 December 2009 - 03:28 PM

try going to control panel->internet settings (or something similar)->advanced then "reset advanced settings"
(i know i shouldnt help but it fixed this problem for me! :thumbsup: )


Thanks for the comment. I did try that early on but it did not work.

With my computer doing the reset DID NOT change the rogue DNS address back to the Automatic DNS option.

Robert

Edited by Robert1123, 03 December 2009 - 11:32 PM.


#12 Robert1123

Robert1123
  • Topic Starter

  • Members
  • 62 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 03 December 2009 - 11:32 PM

You're welcome.

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.


Done, thanks again,

Robert

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:41 AM

Posted 04 December 2009 - 08:13 AM

You're welcome.

Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, uTorrent). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs and infections install themselves, read:Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend you disable Autorun asap as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
How to Maximize the Malware Protection of Your Removable Drives

Other related reading sources:• Finally, if you need to replace your anti-virus, firewall or need a reliable anti-malware scanner please refer to:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users