Well If we must we must. Tomorrow then I'll run GMER & then combofix and post the results or do I even need to run gmer? Did it do anything?

If we're about to run Combofix, GMER is not needed.

Combofix will have to wait until tomorrow because super antispyware will take a while.

Not a problem. Don't forget about fresh restore point

Originally Posted by broni

Not a problem. Don't forget about fresh restore point

I wouldn't dare. Not after today. Are you going to be on in the morning?

I'll be shortly on in the morning, and then I should be back for good around lunch time.

Ok I have run both scans. Super-Antispyware found the same file but I'll post the scan anyway. Also I have lost internet again. Is there something else that won't mess up internet? So now what?

SA:

Combofix:

HJT:

We'll need to investigate a little.

First...

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

DEQUARANTINE::
C:\Qoobox\Quarantine\C\Windows\system32\drivers\snetcfg.exe.vir
QUIT::

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. Reboot, and see, if the connection is back.

If not, re-run same 5 steps, but this time, use different script:

Code:

DEQUARANTINE::
C:\Qoobox\Quarantine\C\Windows\system32\ndisapi.dll.vir
QUIT::

After restart, check the connection again.


I'll be back in a few hours.

This didn't work. I tried it but I got an error that listed combofix and its path & the error said that the directory is invalid. I tried rebooting the computer even re-downloaded combofix but still the same error. The file was on the desktop as was the script. Could I just move the files back manually and take off the .vir?

In addition I have been unable to reinitialize avira since the first combofix scan. WTF is going on with this computer?