2

Family members computer got the AntiVirus 2010 trojan. Had computer on for some time before noticing it so it got really corrupted. Only way to stop from copying itself was to scan HD as a secondary drive on another computer. Afterwards, ran MalwareBytes again to get the rest.

After removing virus key files where deleted. Have reinstalled them one by one, but running into a problem.

Can connect to network and internet but DNS is totally messed up. Can ping google by ip but not by name.

3
  • Should go on SuperUser. Commented Oct 21, 2010 at 19:25
  • 2
    This is heading to SU, judging from the votes... But just wipe the computer, reinstall OS and then restore the user's data from backups.
    – jscott
    Commented Oct 21, 2010 at 19:39
  • All ready recommending wipe and reinstall. Just trying to see if I could give them some time to backup IMPORTANT pictures and email instead of copying everything over.
    – pcasa
    Commented Oct 21, 2010 at 20:09

4 Answers 4

5
  1. Run malicious software removal tool. it removes all traces of antivirus 2010 trojan.
  2. type ipconfig /flushdns.
  3. run combofix. it will flush out corrupted dns * hosts entries.

i had resolved the issue with these tools.

4
  • You might want to clean up, restructure and clarify your answer. At first glance I thought you were another (nothing personal and no insult intended) AntiVir-Spam-User.
    – Bobby
    Commented Oct 22, 2010 at 12:53
  • Thank you, that's way better (and also makes a better looking answer which is likelier to get upvotes).
    – Bobby
    Commented Oct 22, 2010 at 13:58
  • 1
    As a Sidenote: Combofix will also look for and remove rootkits, so you might want to run a full-antivirus-scan again after running combofix.
    – Bobby
    Commented Oct 22, 2010 at 14:05
  • You probably want to flush the DNS cache (running ipconfig /flushdns) after running combofix, in case any requests are made between the two. Commented Oct 24, 2010 at 14:33
1

Are you pointing to a valid DNS server? This can be manually set when setting your local IP / gateway, or inherited from a DHCP server. If you don't have one set, you can use Google's public DNS server at 8.8.8.8.

5
  • Just tried it, didn't work
    – pcasa
    Commented Oct 21, 2010 at 19:23
  • 1
    Can you ping 8.8.8.8? Also what happens if you NSLookup google.com?
    – PMGoldstein
    Commented Oct 21, 2010 at 19:27
  • Can ping IP addresses, just not names. will try NSLookup in 10 min. Finishing another chkdsk /r now.
    – pcasa
    Commented Oct 21, 2010 at 19:29
  • Cool, never new about superuser.com.
    – pcasa
    Commented Oct 21, 2010 at 20:00
  • 1
    NSLoookup google.com result = Server:google-public-dns-a.google.com Address:8.8.8.8 Non-authoritative answer: Name:google.com Addresses: 74.125.67.147, 74.125.67.104, 74.125.67.105, 74.125.67.106, 74.125.67.103, 74.125.67.99
    – pcasa
    Commented Oct 21, 2010 at 20:01
0

You should use Spybot S&D when something is fiddling with your network.
http://www.safer-networking.org/index2.html

1
  • Just ran Spybot and that didn't work either.
    – pcasa
    Commented Oct 21, 2010 at 22:57
0

It sounds to me like there may be something screwed up in the layered service protocol stack. Download LSPFix and run it.

http://download.cnet.com/LSPFix/3000-2085_4-10417026.html

Do a Google search on any suspicious LSP entries before deleting them.

WARNING: Deleting valid (i.e. non-malicious) entries can cripple your computer's network-ability.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .