Best T1 DEAL Networking Questions Fastest Internet

Posts Tagged ‘virus’

It started after I scanned for viruses then I deleted my cookies and it happened that I could not connect to the net I remember seeing that my firewall forbid it and when i tryed to run programmes like regcure it showed “windows sockets initialization failed” and my mcafee could not scan or reinstall so yesterday I downloaded winsock v1.4 my internet was fine regcure could run and cure problems BUT THE PROBLEM IS when i log on an unregistered version of reg. mechnic run and scans i tryed unistalling it PC SHUTS DOWN I insert a flash drive to reinstall my antivirus PC SHUTS DOWN my friend told me he had the same prob and he contracted the virus from the net. i can not do any thing on my pc coz it logs off auto i tryed safe mode still can’t resolve PLEASE HELP!!!!

hope I made as much sense in the briefest way!!

The following files are in the Virus Chest with the Avast free home edition i am currently using…these files are infected with trojans and worms…however i need to download these type files from a source because they are pertinent to the function of the System 32…the files that are in the chest will be destroyed once their replaced…..the following files are there :

Kernel32.Dll
Winsock.Dll
Wsock.Dll

Any Suggestions would be greatly appreciated….Thanks

my laptop infected with trojan virus, & i can’t get connection from the internet.
the name of files which infected with virus is winscok.dll but when I check, i have no file with name like that. I have file with name winsock.dll. is it the same or not?
i’ve tried avast but it didnt work and also i can’t go back to the system restore
thank in advance
this is i borrow my my friends laptop so i can get the internet connection

My computer says that my connection is good, but I can’t access the internet… the browsers wont load any pages. I get a message that says Error 678. I am think that I have this ‘winsock’ virus. Does anyone have any advice on how to handle this? What are my options and what will work? Should I just reformattt?
23 hours ago – 3 days left to answer.

I Tried Every Single Rat Program and none of them work. I havent done any port forward donno. Im very glad if somebody helped me via Teamviewer. I think my ports are blocked.

I faced a problem of solving a connection failure because of a change in the DHCP, i think it will change the ip address and refuses connection to the server. How do you think i can solve this problem??

Got the dreaded SecurityCenter virus from facebook. Used malwarebyes and pcdoctor to remove. It seems to be gone, no trace of it in registry or anywhere else. Since acquiring and removing the virus, cannot connect to internet using IE8 or Safari. Tried system restore and resetting winsock settings. I have internet in safe mode with networking but not otherwise. Shows packets sent as 65,000 but only receiving 13. All hardware including netgear usb wireless adapter is good…any suggestions?? Thanks in advance…

kernel32.dll
winsock.dll
winsock32.dll

Can I delete them or are they important files?

When i go to network connections itg is not there. What do i do? I have already tryed winsock. I still cant go on the internet. I really dont want to reboot my computer and lose all my files. Can someone help me.

Ps. I am using my other computer to post this message and i use a brodband internet

I had some PC problems and now cannot connect. Tried resetting the winsock etc and still cannot get a good ip address.

Can the bug destroy the network card??
I have replaced the drivers already. This one has me stumped. Thanks.

I have a tricky problem. I think my ISP (Internet service provider) Comcast is giving my computer a virus.

Let me explain. About a month ago, I noticed that Smartscreen filter (which monitors downloads in Internet Explorer) was “unavailable” (and still is). Worried about this, I went looking to download more malware/virus protection from sites such as Spybot: Search and Destroy and AVG Free. For Spybot, it says “Server not found” and the text on the AVG site is so scrambled and layered on top of itself, I can barely read it.

I then noticed that Windows could not update, including Windows Defender. My old anti-virus, Webroot, was being blocked from updating as well. I was also getting very realistic pop-up warnings titled “Windows Internet Security” warning me that “Your browser is run in unsafe mode” (That’s a direct quote, the poor English is not mine) and that it wants my permission to download “Online Protection Tool.” Even if I click “Don’t allow” it starts the download, which I think is the rogue security program Internet Security 2010.

I found a site that showed me how to remove Internet Security 2010 without getting blocked using Malwarebytes, ( http://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010 ) . After running a scan, I come up with two infections, names copied from the log below:

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.161.105 93.188.166.105 1.2.3.4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{fb6d127e-1638-46aa-be60-19496e8dbad3}\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.161.105 93.188.166.105 1.2.3.4

Of course, I chose to have them removed and restarted my cpu. If I don’t connect to the internet, I don’t see them in follow-up scans. BUT, if I do connect to the internet, even for a few moments, the same infections show up in scans.

I called Comcast, and a tech helped me uninstall Webroot and install Norton (which Comcast offers for free), which is somehow not blocked from updating despite Windows still being unable to. Norton does not find any infections in its scans, but I still get the fake warnings and I am still misdirected to sites that are not what I clicked on.

The comcast tech said that there’s no way I have a virus. Malwarebytes still finds the same infections every time. What should I do? Please help! My email is splendorsecond@yahoo.com if you have questions or need to IM a solution.

Also, I can’t really change ISP, since Comcast is the only one that offers in my area…

I run xp service pack 3 I had a virus call backdoor.tidserv!inf gen6. It told me I had a file tcpip.sys infected so I removed the system file immediately. Now my laptop turns on and says it is connected but I can’t open Internet explorer. HELP!
I can open Internet explorer it just says can’t display webpage.

i got this code from scribd.com which if is typed in Npad and saved as.reg,will increase my DSL speed.wonder if it is a hack or virus or what?if anyone used this code or knows what it is,please answer me.becuase i need to be sure that my laptop will be safe,the code is:
{HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters}
“GlobalMaxTcpWindowSize”=dword:0000ffff

hi guys this is how to remove this new type of trojan. Info on virus: Since this virus is so new your antivirus software will not work. if the virus gets to the later stages and opens a tonne of websites disconnect from the netand use a different browser. it will continue to open up the sites but they wont load. so if it open stuff on internet explorer use firefox to get into your router. the virus changes your DNS settings it will try to open about 20 different 18+ sites. it infects your entire network so any computes connected to your router will be infected. IMPORTANT print out your settings before you reset your routers settings! other ways fix = reset your router to factory defaults.. BUT SET ROUTER PASSWORD TO NON DEFAULT not ( password := admin ) or 1. Click Start, click Control Panel, click Network and Internet Connections, and then click Network Connections. 2. Right-click the network connection that you want to configure, and then click Properties. 3. On the General tab (for a local area connection), or the Networking tab (for all other connections), click Internet Protocol (TCP/IP), and then click Properties. 4. If you want to obtain DNS server addresses from a DHCP server, click Obtain DNS server address automatically. 5. If you want to manually configure DNS server addresses, click Use the following DNS server addresses, and then type the preferred DNS server and alternate DNS server IP addresses in the Preferred DNS server and Alternate DNS server boxes …

This is my hijack report! Iam getting pop ups i tried every antivirus known to man delted cookies etc etc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:24 PM, on 4/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\USER\Desktop\hijackthis.exe

O2 – BHO: Java(tm) Plug-In 2 SSV Helper – {DBC80044-A445-435b-BC74-9C25C1C588A9} – C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 – BHO: JQSIEStartDetectorImpl – {E7E6F031-17CE-4C07-BC86-EABFE594F69C} – C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 – HKLM\..\Run: [WinampAgent] “C:\Program Files\Winamp\winampa.exe”
O4 – HKLM\..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre6\bin\jusched.exe”
O4 – HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 – HKCU\..\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 – Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O17 – HKLM\System\CCS\Services\Tcpip\..\{358175E9-9203-4823-BF3D-0E2DF0109BF7}: NameServer = 85.255.112.115,85.255.112.205
O17 – HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.115,85.255.112.205
O17 – HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.115,85.255.112.205
O17 – HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.115,85.255.112.205
O23 – Service: ASP.NET State Service (aspnet_state) – Unknown owner – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 – Service: Java Quick Starter (JavaQuickStarterService) – Sun Microsystems, Inc. – C:\Program Files\Java\jre6\bin\jqs.exe

–

I’ve got that svchost.exe virus, i managed to stop it using up all the CPU but it keeps putting trojans in my C:\WINDOWS\Temp folder. AVG keeps popping up every 5 minutes with a new one and i dont know how to stop it! I’ve ran Malaware, Spybot S&D, AVG and ESET that only find the viruses in the temp folder not the source of it.. can anyone helpppp?x

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 23:00:42, on 24/03/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Documents and Settings\william robinson\Application Data\Microsoft\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.e…

F2 – REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.ex…
O2 – BHO: (no name) – {02478D38-C3F9-4efb-9B51-7695ECA05670} – (no file)
O8 – Extra context menu item: &Search – ?p=ZJfox000
O9 – Extra button: (no name) – {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} – C:\WINDOWS\system32\shdocvw.dll
O9 – Extra ‘Tools’ menuitem: Spybot – Search & Destroy Configuration – {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} – C:\WINDOWS\system32\shdocvw.dll
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) – http://www.blizzard.com/support/includes/cabs/si.cab
O17 – HKLM\System\CCS\Services\Tcpip\..\{A6AB5… NameServer = 93.188.162.20,93.188.166.38
O17 – HKLM\System\CS1\Services\Tcpip\Parameter… NameServer = 93.188.162.20,93.188.166.38
O17 – HKLM\System\CS4\Services\Tcpip\Parameter… NameServer = 93.188.162.20,93.188.166.38
O17 – HKLM\System\CCS\Services\Tcpip\Parameter… NameServer = 93.188.162.20,93.188.166.38
O20 – Winlogon Notify: avgrsstarter – avgrsstx.dll (file missing)
O20 – Winlogon Notify: awtrRJax – awtrRJax.dll (file missing)
O23 – Service: Ati HotKey Poller – ATI Technologies Inc. – C:\WINDOWS\system32\Ati2evxx.exe
O23 – Service: AVG Free E-mail Scanner (avg9emc) – AVG Technologies CZ, s.r.o. – C:\Program Files\AVG\AVG9\avgemc.exe
O23 – Service: AVG Free WatchDog (avg9wd) – AVG Technologies CZ, s.r.o. – C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 – Service: Bonjour Service – Apple Inc. – C:\Program Files\Bonjour\mDNSResponder.exe
O23 – Service: Eset HTTP Server (EhttpSrv) – ESET – C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 – Service: Eset Service (ekrn) – ESET – C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 – Service: Windows Live Family Safety Service fsssvcSpooler (fsssvcSpooler) – Unknown owner – C:\WINDOWS\system32\adsmsexti.exe (file missing)
O23 – Service: iPod Service – Apple Inc. – C:\Program Files\iPod\bin\iPodService.exe
O23 – Service: MSCSPTISRV – Sony Corporation – C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\system32\nvsvc32.exe
O23 – Service: Sony SPTI Service (SPTISRV) – Sony Corporation – C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

I thought I’d solved the problem but it turned out I hadn’t. I got a couple of trojan viruses on my computer the other day, even with NOD32 and Malwarebytes’ AntiMalware, Ad-aware, and Spybot Search and Destroy, which I know are all very good. I scanned with Malwarebytes,and it found two trojans. Here’s the log:

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I deleted the two trojans, so everything was working again (I wasn’t being redirected to other sites on the internet anymore). However, this morning, the same problem has come back. I’m assuming that there is a rootkit installed somewhere, but nothing can find it. I’ve also scanned with VundoFix and RogueRemover, which didn’t find anything either. I scanned with SmitFraudFix, and the log after that came up with a HUGE list of random websites, and then this (sorry for the long question):

Run from C:\Documents and Settings\User\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] – Windows_NT
The filesystem type is
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler’s .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

”’(The list of lots of websites fits in here)”’

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri’s WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible) – Packet Scheduler Miniport
DNS Server Search Order: 10.0.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A94E023C-3A73-4B59-B35B-7AB609AC87BD}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A94E023C-3A73-4B59-B35B-7AB609AC87BD}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A94E023C-3A73-4B59-B35B-7AB609AC87BD}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler’s .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

I’ve tried deleting what SmitFraudFix has found, but it doesn’t seem to work. If I do the scan again on SFF straight afterwards, it finds the same things, but doesn’t delete them.

So, what else is there to do? Haven’t I tried everything? Please don’t recommend programs like AVG, Norton, McAffee and Avast because they are not as good as the ones I am using, and are unlikely to find the rootkit if they better antiviruses can’t.

Thanks!

i got this code from scribd.com which if is typed in Npad and saved as.reg,will increase my DSL speed.wonder if it is a hack or virus or what?if anyone used this code or knows what it is,please answer me.becuase i need to be sure that my laptop will be safe,the code is:
{HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters}
“GlobalMaxTcpWindowSize”=dword:0000ffff

One day i checked my email and saw an email my friend sent me. I clicked on it and it had an attachement. The name of the attached file and the message were all in chinese and my conputer could not read it so all i saw were little boxes instead of the chinese characters. I then clicked on the attachment. I was using yahoo’s beta mail and it scanned the message and said it was safe to open. So i clicked download. Then a window popped up with info about the attachement and it said virus detected. I panicked and clicked cancel. Then I lost internet connection [im using my labtop]. I diagnosed the connection problem and it said there was a problem with the (LSP):MSAFD Tcpip[RAW/IP] and it asked me if i wanted to remove the LSP. What should i do and what is a LSP?

Fix / Repair Internet Connection After Virus or Spyware or Malware Infection by britec.co.uk Follow these basic steps to Fix your Internet Connection Theses Repairs let you fix the following issues 1. Diagnose and fix the most common internet connection issues 2. Fix all the connectivity problems caused due to malware, spyware, adware and other network problems 3. repair the registry and Winsock settings for XP and Vista Downloads: Internet Connection Repair www.briteccomputers.co.uk LSP Fix www.briteccomputers.co.uk winsockfix2 www.briteccomputers.co.uk Delete Restricted & Trusted Zone www.briteccomputers.co.uk ————————– www.britec.org.uk http