Tenacious Malware issue

Germsrosolino

Hey guys, been a while since I've posted anything (been deployed overseas for the army), but I need a little help with a buddy's computer. He had some malware on there, and I used a manual install of malwarebytes to purge the system of it, then we ran some more scans with MBAM and Spybot, until nothing more was found. So that's all fine and dandy. The issue is that he still can't access internet on the computer. I've checked to make sure there were no changes to the DNS settings and that it's not running through a proxy. I've reset his internet settings, cleared temp files associated with internet, and even did a full uninstall and reinstall of his browsers. Still no go. Anyone have any ideas what could cause it? Something I missed? Please and thank you.

stigweard

Make sure there are no proxy settings left in the browser that shouldn't be there- reset the browser settings to default, and verify the lmhosts file. Check out the size of tcpip.sys. If it isn't the correct size he most likely has some variant of zero access. You should also check for rootkits as mbam doesn't do a very good job with them. For the former, you can substitute the correct file from another computer with the same operating system, or you can try doing a system restore to a point before the malware appeared (hard to know in some cases). Be sure to check out the thread in this forum for better instructions.

TL DR

Yeah, check IE's LAN/Proxy settings and also the etc/hosts file to make sure there are no weird entries.

Also, run TDSSkiller from Kaspersky. It will take care of the issue if you're dealing with a rootkit.

Germsrosolino

no rootkits found. not seeing any proxy settings in there, tcpip.sys file looks normal. dammit. this is rather annoying. also, he doesn't have any system restore points, because people around here don't take care of their computers.... at all.

TychoCelchuuu

sfc /scannow in command prompt.

Unknown

This content has been removed.

Germsrosolino

i actually told him that was the next step, just thought i'd check with you guys, in case i missed something. thanks for all your help