Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Family members computer got the AntiVirus 2010 trojan. Had computer on for some time before noticing it so it got really corrupted. Only way to stop from copying itself was to scan HD as a secondary drive on another computer. Afterwards, ran MalwareBytes again to get the rest.

After removing virus key files where deleted. Have reinstalled them one by one, but running into a problem.

Can connect to network and internet but DNS is totally messed up. Can ping google by ip but not by name.

share|improve this question

migrated from serverfault.com Oct 21 '10 at 19:44

This question came from our site for professional system and network administrators.

    
Should go on SuperUser. –  Cody Harlow Oct 21 '10 at 19:25
2  
This is heading to SU, judging from the votes... But just wipe the computer, reinstall OS and then restore the user's data from backups. –  jscott Oct 21 '10 at 19:39
    
All ready recommending wipe and reinstall. Just trying to see if I could give them some time to backup IMPORTANT pictures and email instead of copying everything over. –  pcasa Oct 21 '10 at 20:09

4 Answers 4

up vote 5 down vote accepted
  1. Run malicious software removal tool. it removes all traces of antivirus 2010 trojan.
  2. type ipconfig /flushdns.
  3. run combofix. it will flush out corrupted dns * hosts entries.

i had resolved the issue with these tools.

share|improve this answer
    
You might want to clean up, restructure and clarify your answer. At first glance I thought you were another (nothing personal and no insult intended) AntiVir-Spam-User. –  Bobby Oct 22 '10 at 12:53
    
Thank you, that's way better (and also makes a better looking answer which is likelier to get upvotes). –  Bobby Oct 22 '10 at 13:58
1  
As a Sidenote: Combofix will also look for and remove rootkits, so you might want to run a full-antivirus-scan again after running combofix. –  Bobby Oct 22 '10 at 14:05
    
You probably want to flush the DNS cache (running ipconfig /flushdns) after running combofix, in case any requests are made between the two. –  fahadsadah Oct 24 '10 at 14:33

Are you pointing to a valid DNS server? This can be manually set when setting your local IP / gateway, or inherited from a DHCP server. If you don't have one set, you can use Google's public DNS server at 8.8.8.8.

share|improve this answer
    
Just tried it, didn't work –  pcasa Oct 21 '10 at 19:23
1  
Can you ping 8.8.8.8? Also what happens if you NSLookup google.com? –  PMGoldstein Oct 21 '10 at 19:27
    
Can ping IP addresses, just not names. will try NSLookup in 10 min. Finishing another chkdsk /r now. –  pcasa Oct 21 '10 at 19:29
    
Cool, never new about superuser.com. –  pcasa Oct 21 '10 at 20:00
1  
NSLoookup google.com result = Server:google-public-dns-a.google.com Address:8.8.8.8 Non-authoritative answer: Name:google.com Addresses: 74.125.67.147, 74.125.67.104, 74.125.67.105, 74.125.67.106, 74.125.67.103, 74.125.67.99 –  pcasa Oct 21 '10 at 20:01

You should use Spybot S&D when something is fiddling with your network.
http://www.safer-networking.org/index2.html

share|improve this answer
    
Just ran Spybot and that didn't work either. –  pcasa Oct 21 '10 at 22:57

It sounds to me like there may be something screwed up in the layered service protocol stack. Download LSPFix and run it.

http://download.cnet.com/LSPFix/3000-2085_4-10417026.html

Do a Google search on any suspicious LSP entries before deleting them.

WARNING: Deleting valid (i.e. non-malicious) entries can cripple your computer's network-ability.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.