Family members computer got the AntiVirus 2010 trojan. Had computer on for some time before noticing it so it got really corrupted. Only way to stop from copying itself was to scan HD as a secondary drive on another computer. Afterwards, ran MalwareBytes again to get the rest.

After removing virus key files where deleted. Have reinstalled them one by one, but running into a problem.

Can connect to network and internet but DNS is totally messed up. Can ping google by ip but not by name.

migrated from serverfault.com Oct 21 '10 at 19:44

This question came from our site for system and network administrators.

  • Should go on SuperUser. – Cody Harlow Oct 21 '10 at 19:25
  • 2
    This is heading to SU, judging from the votes... But just wipe the computer, reinstall OS and then restore the user's data from backups. – jscott Oct 21 '10 at 19:39
  • All ready recommending wipe and reinstall. Just trying to see if I could give them some time to backup IMPORTANT pictures and email instead of copying everything over. – pcasa Oct 21 '10 at 20:09
  1. Run malicious software removal tool. it removes all traces of antivirus 2010 trojan.
  2. type ipconfig /flushdns.
  3. run combofix. it will flush out corrupted dns * hosts entries.

i had resolved the issue with these tools.

  • You might want to clean up, restructure and clarify your answer. At first glance I thought you were another (nothing personal and no insult intended) AntiVir-Spam-User. – Bobby Oct 22 '10 at 12:53
  • Thank you, that's way better (and also makes a better looking answer which is likelier to get upvotes). – Bobby Oct 22 '10 at 13:58
  • 1
    As a Sidenote: Combofix will also look for and remove rootkits, so you might want to run a full-antivirus-scan again after running combofix. – Bobby Oct 22 '10 at 14:05
  • You probably want to flush the DNS cache (running ipconfig /flushdns) after running combofix, in case any requests are made between the two. – Fahad Sadah Oct 24 '10 at 14:33

Are you pointing to a valid DNS server? This can be manually set when setting your local IP / gateway, or inherited from a DHCP server. If you don't have one set, you can use Google's public DNS server at

  • Just tried it, didn't work – pcasa Oct 21 '10 at 19:23
  • 1
    Can you ping Also what happens if you NSLookup google.com? – PMGoldstein Oct 21 '10 at 19:27
  • Can ping IP addresses, just not names. will try NSLookup in 10 min. Finishing another chkdsk /r now. – pcasa Oct 21 '10 at 19:29
  • Cool, never new about superuser.com. – pcasa Oct 21 '10 at 20:00
  • 1
    NSLoookup google.com result = Server:google-public-dns-a.google.com Address: Non-authoritative answer: Name:google.com Addresses:,,,,, – pcasa Oct 21 '10 at 20:01

You should use Spybot S&D when something is fiddling with your network.

  • Just ran Spybot and that didn't work either. – pcasa Oct 21 '10 at 22:57

It sounds to me like there may be something screwed up in the layered service protocol stack. Download LSPFix and run it.


Do a Google search on any suspicious LSP entries before deleting them.

WARNING: Deleting valid (i.e. non-malicious) entries can cripple your computer's network-ability.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.