Solved backdoor win32 cycbot.b

[niemiro]

Leave it in quarantine, but don't restore it. It makes very little difference, but if you want us to roll the die, rather than yourself, do that.

This just makes your copy of Vista conform to everybody else's. Having that key is abnormal, but not malicious. Just leave it deleted.

 

[FCUSA]

Got it - I think your roll is better than mine. Thanks guys.

I am starting on the Vista instructions provided by Jaycee. I am going to quote that post and ask some questions about those instructions.

 

[Lorien]

We'll do our best to answer, but we aren't Jacee (and she's on holiday so she won't be responding until after the weekend at least and possibly not until next year). We'll see how it goes once we hear your questions.

P.S. What is the public link to your company web site where people can shop? This is not SPAM because I have asked the question (and want to check out the site with all three of my browsers to make sure it is showing properly after the trouble you had with the admin section - though I may have other interests as well). If you hesitate to post it here, just send me a PM. Thanks!

 

[FCUSA]

Yikes! Sorry I'm late ....

FCUSA, first let's flush your DNS cache, and restore MS's Hosts file.
Copy and paste these lines in Note pad.
@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Right click and choose to run as Administrator. Your computer will reboot itself.

Next, download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.


This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Right click (run as administrator)combofix.exe and follow the prompts.
• When finished, it will produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply.
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
A guide and tutorial on using ComboFix

OK - I have done the flush.bat. and computer rebooted.
I have read through the Tutorial and am grateful I have this computer up and running while the Vista does its' thing.

I thought I had a question about the link 'Here' but that refers to the anti virus software/firewalls etc AFTER downloading Combofix - correct?

Should Screen Saver be disabled also? (if so, where do I do that?)

 

[Lorien]

Correct.

 

[FCUSA]

Wow - that was quick - I ammended the post to ask if I should disable Screen Saver (& how, with my head hung low )

Do I sound nervous?

PS will get back to you on that.

 

[FCUSA]

OK - after the reboot, I went to load IE and my internet connection is telling me I am LOCAL ONLY

DSL wireless.

The WiFi light in front of the Dell is lit and obviously my DSL is working as I am on it now.

If changes are made, do we need to rerun the 'flush.bat' portion?

 

[niemiro]

Hello!

Have you run ComboFix yet? If so, please post the logs. No need to disable screensaver, unless your computer goes into Sleep Mode. Make sure your computer doesn't go into Sleep mode. Local Only is a common problem for ComboFix. Have a look at "Manually Restoring your Internet Connection" at the very bottom of this page: A guide and tutorial on using ComboFix

Good luck!

Richard

 

[FCUSA]

OK - I did NOT run ComboFix yet. I lost the connection after the 'flush.bat' reboot.

I read the instructions on the ComboFix tutorial. On rebooting, it said limited connectivity with the 'yellow warning' triangle (don't know the proper term). I further clicked the diagnose & repair as suggested and the relpy is a list titled "there might be a problem with one or more network adapters on this computer'.

I could have hardwired it - I didn't realize. Please advise - and should the 'flush.bat' be run again before downloading ComboFix (assuming hardwire reconnects)

My computer is set to go to 'sleep mode' but that is fair amount of time - however, I would rather disable to play that safe - please advise.

Sweating bullets as I haven't even reached the point of disabling firewalls etc.

Very distressed,
Sally

 

[FCUSA]

In the tray and Network & Sharing folder it is showing my connection as 'unidentified network' - signal strength excelllent ; access 'local only'

I clicked on the 'unidentified network' computer icon and it brought up another window (with a statement 'Network discover is turned off. Network computers and devices are not visible. Click to change'.)

 

[Lorien]

That alone would cause your problem (and may be all it takes to fix the issue), but I don't know how it works in terms of Combofix (and whether or not that's supposed to happen), so you really need to hear from Richard as I'm not sufficiently familiar with Combofix and don't know if I attempt to fix your network issues I will mess up Combofix. I could help you with the network problem if it weren't for the Combofix complication - and if Richard says I can, I'll go about doing that (but we may need to do some other things first as I'm not quite sure the cause at the moment (unless Combofix is the cause or just enabling Network Discovery will do the trick or if it will take a bit more than that)).

 

[FCUSA]

Just to clarify, I haven't even downloaded ComboFix yet. I lost the connection after the automatic reboot from running 'flush.bat'.

I just tried hard connection and that did not work. As Richard (the instructions said) rebooting typically has corrected this (I have lost the connection before, but not often enough to be considered a problem). However, one time I could not fix it and ATT (my provider) actually said I lost my IP address? I am looking for notes on that (good luck to me).

 

[FCUSA]

OK, with a little work we are now connected (unplugged and replugged and refresh). There are more connections than I usually see in the tray, but I guess that is another subject.

Do I need to run that 'flush.bat' file again before downloading ComboFix?

Thank goodness for the additional computer - it would not have been pretty around here if I was isolated from this Forum!!

 

[Lorien]

Go to Start / Control Panel / Network and Sharing Center / Make sure Network Discovery is on. Try connecting. If that doesn't work, read on:

Please go to http://www.vistax64.com/network-sharing/284688-network-posting-tips.html and follow the instructions - then post back with the screenshots requested.

Let's see if we can figure out what's going on with your internet connection. This will provide me with information about the connection and will also reset most of your network settings so we can rule them out as problems. After that, the next steps depend on what happened with these steps and what I see in the screenshots.

BTW, do you connect directly to a modem or do you connect to a router to which the modem is attached? Are you connected wirelessly or by direct cable?

Thanks and good luck!

EDIT: This is obviously no longer required; however, to see if we can figure out why you have multiple connections, please do steps one and two ONLY from the Network Posting Instructions above.

P.S. I haven't the faintest idea about that batch file or Combofix - you need Richard to intruct you there.

 

[FCUSA]

Hello Lorien -

Here are the files you asked for - I do get excited when something goes right!

I typically am wireless at home. We have an ATT Gateway 2wire426 (router/modem?). On a normal day, if I mouse of the connection icon, it will just say the name of our connection and show local & internet.

When we lost the connection, it said Unidentified network Local Only.

Now we are wired directly into the router with an ethernet cable and 3 networks are showing (1 being the Unidentified Network)

I still haven't put Network discovery on yet. (I must say, I am not thrilled about the confinement of being wired - but certainly do not want to take any chances during this process.

thanks -


PS I'm sorry if I misunderstood - did you want me to turn Network Discovery on before I did the IP Config?

 

[FCUSA]

Hello!

Have you run ComboFix yet? If so, please post the logs. No need to disable screensaver, unless your computer goes into Sleep Mode. Make sure your computer doesn't go into Sleep mode. Local Only is a common problem for ComboFix. Have a look at "Manually Restoring your Internet Connection" at the very bottom of this page: A guide and tutorial on using ComboFix

Good luck!

Richard

I found the settings for Screen Saver and Sleep Mode (it was set) - so I know where to disable when ready to run ComboFix.

Thanks!

 

[FCUSA]

P.S. This is post #100 in this thread! That makes it one of the longest question/problem resolution threads in the forum (not counting stuff in Chillum). There may be some bigger, but not very many at all. It's hard to believe we spent so much time and effort on it - but I suppose it happened. Amazing!!

You must have slipped this in?! Are you trying to say......what exactly are you trying to say?? I just want to be sure I do it right and hopefully no more surprises! Actually, I never noticed the number - I can't believe it either!

Thanks for the reminder!!

 

[Lorien]

P.S. This is post #100 in this thread! That makes it one of the longest question/problem resolution threads in the forum (not counting stuff in Chillum). There may be some bigger, but not very many at all. It's hard to believe we spent so much time and effort on it - but I suppose it happened. Amazing!!

You must have slipped this in?! Are you trying to say......what exactly are you trying to say?? I just want to be sure I do it right and hopefully no more surprises! Actually, I never noticed the number - I can't believe it either!

Thanks for the reminder!!

I was merely pointing out the fact that this was a very long thread as I happened to notice it was post #100 (a milestone) - nothing more and nothing less. It was only a statement of fact and astonishment. I think I've been in only one other this long before (and I'm not sure even it was this long). It was not meant as a comment on your number of questions or your attempts to do it right - (c'mon now, you should know me better than that by now as this isn't our first thread together, and deep down you certainly must know what you were thinking was nowhere on my mind). I don't really care if it goes on to 200 posts if that's what it takes. I was simply stunned to notice how quickly it had grown to such size and remarking on it. I thought you would merely find it amazing - it had no other hidden meaning (though I see what you seem to have surmised and can't believe you thought me capable of such a comment after all the work we've done together - it never even occurred to me when I posted it - it might have with someone else but never with you - and most certainly wasn't meant that way). Do you honestly think I would change so dramatically overnight? After all the time I've spent helping you and we've spent working together, how could you even imagine such a thing?

I realize this is all very stressful (now with two computers to deal with and the procedures perhaps more complex than ever), but please don't assume the worse when I think I've more than proven I would never make comment as you took it (have I even come close EVER before or do you see anything like it in any of the other threads of mine you've read?) - and I have done more than my best in your case because I've come to think of you as a friend to help as much as possible because of all we've been through together and plan to continue to do so. Please relax and we'll take this all one step at a time until everything is resolved - I can't believe you reacted like that to a simple comment that was meant more humorously than anything else - please regain your perspective and composure. If I knew your address, I might even overnight you some of my Valium (actually, Clonazapam) if it was legal to do so - LOL!! C'mon, lets get back that old sense of humor and awareness.

**********************************************

As far as the networks go, I could only find two in IPCONFIG - good work getting that done (but suspect I know what the third is). Your ethernet connection is fine. Your wireless connection is hosed (no valid IP address, no DHCP enabled, no default gateway,...). This is probably due to Network Discovery being off or we need to reconfigure your wireless setup (or Combofix if you've gotten that far). I think the third might actually be your internet connection (separate from the others - it was setup like that at first for me until I configured it to automatically connect with the wireless connection and then I had to even delete it because it was causing problems). It may have done so automatically because Network Sharing was off. I needed the ISP to reconfigure my modem to work for both - but it may do so automatically once we get that wireless connection working. To be sure (or to see if we can learn more), please go to Start / Control Panel / Network and Sharing Center / manage network connections / expand it to full screen and take a screenshot and attach it. That should tell us all your current connection options. I also sometimes pickup wireless signals from my neighbors and it could be that as well (though probably not with Network Discovery off) - but I think this screen should tell most of the story (though we may have to dig deeper into any we can't clearly identify to make sure we know what they are - I want to be certain there isn't a rogue connection into your system) - but we can probably do that with just questions and not screenshots (I hope).

But we can't really fix any of this until you turn on Network Discovery and if you want to wait until Jacee gives you the green light on that (which may be a wise decision though I suspect it isn't required but she's the expert - but better safe than sorry), that's fine and we'll deal with it when the time is right. At least you can connect by cable in the meantime even if it is somewhat inconvenient.

Thanks and good luck!

P.S. When reading my posts, please refresh the screen periodically as I have a bad tendency to edit a lot and you may miss something I added or changed.

 

[niemiro]

Hello!

The only thing I can think of is it wiped your settings. Do you actually have a router? Do you normally set up your internet by typing numbers into your computer rather than a router or similar?

Forget about it for the very moment. Delete your version of ComboFix. Download a new one, and transfer it to your Computer. Run ComboFix, and transfer the log back to the other computer and post please. The log is also stored at C:\ComboFix.txt

Thanks!

Richard

 

[FCUSA]

Sadly, that was my attempt at humor! I don't belong to any Social Networking sites (although I am told it would be good for my business); maybe this is a sign! I know you realize how stressed out I am and believe it or not, I have come to terms with the fact that this will take some time. (I want my XPS back). I am typically up very early working at the computer (limited lights so I won't wake anyone - no lighted keyboard on the little Toshiba; it will be great for traveling, but certainly not my work machine).

With each passing day, I realize more & more files that I don't have - pretty much none - (and fear they all may be lost or compromised). Although they are backed up, the Back UP drive was attached to the computer (disconnected before it's scheduled backup) and at this point I just don't know if it is trash or not. If the XPS needs to (or can even be) reinstalled, I am guessing I have lost my entire Business Contact Manager - which backs up to the computer rather than the Back Up Drive.

I head out on the road in just a couple weeks and one of the two events (10 days) really kicks off the year and sets the pace for 2011. If I am not ready, it will just be a big waste of time, effort & money. At this point, the decision to cancel is on my plate as I am evaluating whether or not I can pull it off - unfortunately, the pendulum is swaying to the wrong side. Trust me I'm no quitter. I've salvaged my little business from near extinction and felt good about making some headway in 2010 (with many hours and lots of 'elbow grease'). And now, I am at a screaching halt.

**************
I am glad to hear you edit your posts as I often want to as well. I typically don't because I was afraid the info would be lost in the sequence. As someone who is here seeking support rather than providing it, I am hoping the information contained here will assist others like me who land at this forum seeking answers (and feel bad about slipping the new Windows 7 into the mix).

I have said it before - this forum is priceless to me and grateful to have found it (and you) way back in September. Do I proceed with caution? a big fat YES. When the 'Tech' came to install the DSL, he saw my old (very old) Inspiron 8000 and said he could get that to work with the DSL! Proceeded to stick in an obsolete disk (that apparently he wasn't even supposed to have or use anymore), screwed up the computer and literally walked out the door leaving it hung up. A very interesting story and believe me I handled it (one new computer later). This was not a 'fly by night' company - I should have been able to trust them technically - whao!

*************

Well, the Network Discovery sounds like it could be the reason I had trouble with wifi. I guess I have misunderstood Network Discovery and like you, I usually can see my neighbors signals but I don't believe that one (the third) is any of theirs. Come to think of it, I have been able to see them in the past however when we lost the signal during the flush.bat reboot, I no longer did. As mentioned before, I had a problem once that was not corrected by simply rebooting and ATT was surprised (more stunned) to learn I lost my IP. I (try to) keep good notes - I'll see if I can find that, otherwise it is a call to ATT.

I will get that snapshot as soon as I can.

***********
So, for clarification purposes - if ever in doubt about one of my comments, just consider it humor (past, present & future)! You will never, ever read anything from me that is disrespectful, contradictory or downright rude (at least not deliberately). After all, I am the one seeking the assistance and not foolish enough to 'bite the hand' providing it!

Thanks again!