Fuck, my internet has been destroyed by adware (winsock, need help)

[Myst]

Alright. I really thought that with SP2, using browsers like maxthon, popup blockers and what not, that getting shit installed on your computer from websites was a thing of the past. Nope, i was wrong, a couple of days ago, some asshole on gfy posted some links (cant remember what they were). I went there, see popups, and immideately theres program after program being executed (task manager).

I grab adaware/spybot/kaspersky/hijack this, reboot in safe mode, kill all the shit (some manually), and restart.

All the stuffs gone, my computer appears to be clean but my internet is severely fucked.



theres a nice little summary of whats going on. Apparantly, winsock is buggered up, or something in the registry is not quite right (note, this is AFTER removing all viruses, doing a repair with my xp cd). My ip appears to be local 127.0.0.1, and not the 129.128 one its supposed to be. 10.0.0.1 is a network ip that i have to connect to via SSH for access to the internet.

In IE, evreything shows up as 'page cannot be displayed'. Firefox shows a blank page. Clearly requests arent being properly at all it seems.

I dont know what the fuck to do, im all out. I dont use system restore or registry backups cause im an idiot. A decade of computing and nothing has raped me like this before. Any suggestions on what to do?

[darkember]

try to delete your network card in XP let it rediscover and set it up.

where it says ping statistics for (garbage chars) thats not a good sign

If you did the xp repair install then the correct files should be there (dll wise) but the settings are hosed. If you CAN move the network card to a different slot it should 9/10 times give it a completely different config instead of rewriting the old one. Try the delete/rediscover of the network card, go from there.

[LiveDose]

Jesus christ... This is exactly what I have been dealing with on one of the computers here for the last 3 days.

Fuckin' sucks. I am trying at all cost to avoid wasting time reformatting....

[NaughtyINC]

is your host file changed at all (c:\windows\system32\drivers\etc\host) check it out see whats in it... maybe just something was added into it (some spyware does that to prevent you from being able to hit specific sites)

[Linkster]

check your hosts file under windows/system32/etc and delete all entries except the localhost 127.0.0.1(use notepad to view the file) or whatever it has in there - then go to a cmd windown (start - run - type in cmd and hit return) then type in ipconfig /release and return.
Exit the window
Make sure all browsers and mail programs are closed while you do this
Then just do a hard boot (complete power off) and it should find the new IP for you

[Myst]

hosts file is empty

[LiveDose]

Didn't check host file yet. Good suggestion, thanks.

[Myst]

also, my ip is not DHCP dynamic, its a specific one so releasing wont help

[quantum-x]

just a note here, I've found, after a LOT of frustration, that spybot/adaware etc, really do suck.
They pick up some stuff, but miss others - just too inconsistant.

I run http://webroot.com/products/spysweeper/ and it's great.

Nothing gets through, the cleans are fast and effective, the database is always up to date, and it makes sure things like your bookmarks etc don't get touched.

Instead of running 5 programs that try to cover different areas, run this, and have it cover them all, properly

[NaughtyINC]

i dont think it has anything to do with the ip.. i mean it wouldnt hurt to try a release and a renew but i doubt it would make a difference..

you said you have tried some spyware programs etc and nothing resolved.. did you try bulletproof spyware?

also u on xp home or pro?

[NaughtyINC]

Originally posted by LiveDose
Didn't check host file yet. Good suggestion, thanks.

no probs

[LiveDose]

Quick question... I am able to release and renew ip, login & ping from the router admin screen out to sites but explorer, outlook, wsftp seem blocked. Any programs which need to access the net won't...

Does this give any better indication of what might be happening?

[NaughtyINC]

Originally posted by LiveDose
Quick question... I am able to release and renew ip, login & ping from the router admin screen out to sites but explorer, outlook, wsftp seem blocked. Any programs which need to access the net won't...

Does this give any better indication of what might be happening?

you have the firewall turned on.. u using zone alarm or norton firewall or anything to that level?

[darkember]

firewall ?

[NaughtyINC]

also you using a router or anything that may be specific on settings... lots of variations what could be going on...

let me know and i should be able to help ya

[LiveDose]

I've tried connecting with all firewall & AV off to test. Also I connected directly to the wall jack to test. Exact same results.

Don't know if it's a coincidence but I had just upgraded aol to 9.0 for someone who is visiting and this happened soon after. I remember about two years ago having this type of problem after a buggy aol install as well.

I haven't made any other recent changes to the system or router.

Myst have you installed anything new right before this happened?

[Trixxxia]

I've had a similar problem to this - took me awhile to figure it out but for me, on the LAN Settings, it changed my 'Automatic Configuration' settings - from Automatically Detect to Proxy Server 127.0.0.1.

Check if that's the same problem - go to Tools->Internet Options->Connections->Lan Settings->Check if it's set for the Proxy Server or Automatic configuration.

I hope that helps!

[ALiEn_OuT]

Your suffering from Winsock2 corruption, I get alot of this in longhorn and the new media center windows. Microsoft kabse article : 811259 lists these steps as the resolution :

Step 1: Delete the corrupted registry keys
1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock2
4. When you are prompted to confirm the deletion, click Yes.
Note Restart the computer after you delete the Winsock keys. Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.
Step 2: Install TCP/IP
1. Right-click the network connection, and then click Properties.
2. Click Install.
3. Click Protocol, and then click Add.
4. Click Have Disk.
5. Type C:\Windows\inf, and then click OK.
6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.
7. Restart the computer.

Originally posted by Myst
Alright. I really thought that with SP2, using browsers like maxthon, popup blockers and what not, that getting shit installed on your computer from websites was a thing of the past. Nope, i was wrong, a couple of days ago, some asshole on gfy posted some links (cant remember what they were). I went there, see popups, and immideately theres program after program being executed (task manager).

I grab adaware/spybot/kaspersky/hijack this, reboot in safe mode, kill all the shit (some manually), and restart.

All the stuffs gone, my computer appears to be clean but my internet is severely fucked.



theres a nice little summary of whats going on. Apparantly, winsock is buggered up, or something in the registry is not quite right (note, this is AFTER removing all viruses, doing a repair with my xp cd). My ip appears to be local 127.0.0.1, and not the 129.128 one its supposed to be. 10.0.0.1 is a network ip that i have to connect to via SSH for access to the internet.

In IE, evreything shows up as 'page cannot be displayed'. Firefox shows a blank page. Clearly requests arent being properly at all it seems.

I dont know what the fuck to do, im all out. I dont use system restore or registry backups cause im an idiot. A decade of computing and nothing has raped me like this before. Any suggestions on what to do?

[XpressMedia]

I use a program I got on download.com called Spyway Doctor, it removed 20-30 spyware programs on my pc and really picked things up as far as speed wise.

[coolfuck]

i think u need to re-install the windows

[RawAlex]

Alex's hints for the day:

If you are still surfing with IE, delete that piece of crap and use Firefox instead.

If you are still accepting emails with attachments, set a rule that deletes ALL emails with attachments. Get a hotmail account, have people who really need to send you a file send it there instead.

If you are still accessing the internet without a firewall, get one.

If you run a program and pay these scumware / adware / scumbags for traffic, please take yourself out to the back of your house and put a bullet through your head. You paid to get everyone's computer fucked up.

Alex