Hijacker removed, now can't browse

[BG250]

I used Spybot S&D to remove, as it calls it, "common hijacker", now I can't
browse from user's computer. I get usual page not found message when trying
any website. I can ping the DNS. Other computers on the LAN are fine.

The only oddity I could find is in the host file. there must have been a 100
lines resolving various Google sites to 66.180.173.39

All I can find is that the hijacker screws up the ports used by Winsock and
I have to reinstall Windows. I'm hoping someone else has information I may
be able to use before going to these drastic measures.

Thanks, bg

 

[Jan Il]

Hi BG250

The removal of some types of scumware can leave damaged Winsock keys in the
Registry. Some types of warez use the Layered Service Providers (LSP),
which are little bits of software that can be added or inserted into the
Winsocks. Outward bound data from your computer to a legitimate destination
on the Internet can be intercepted by an LSP and sent somewhere other than
where it is supposed to go.

In order to correct the mis-direction, you should download and run the
programs below that apply to your OS, which should resolve the connection
problem. If you are unable to download these programs from the affected
machine, you can download them from another machine and copy them to a
floppy disk or CD, copy them to the hard drive of your machine, then install
and run them.

LSPFix
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

and….

Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip
WinsockXP Fix for XP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm

also…..

Additional LPS Information:
http://searchwin2000.techtarget.com/sDefinition/0,,sid1_gci213375,00.html
http://searchwin2000.techtarget.com/sDefinition/0,,sid1_gci213376,00.html
http://computercops.biz/LSPs.html
(scroll down the list to the lsp.dll files here)

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Guest]

Jan

I have the same prob but IE works ok for about 5mins then fails what do you
suggest?

Thanks in advance


Buck

 

[Jan Il]

Hi Uncle Buck

Jan

I have the same prob but IE works ok for about 5mins then fails what do
you
suggest?

Thanks in advance

If the damage is serious enough, you may need to do a repair of the system
in order to replace the missing or damaged files.

You don't mention the version of Windows or IE you are using, so I'll
provide the instructions W2k or XP. If you have ME, post back and I'll post
those instructions if needed.

How To Repair Windows 2000

Windows 2000 step by step repair instructions:
http://www.windowsreinstall.com/install/win2k/repairw2k/page1.htm
How to perform an "in place upgrade" or system repair.
http://www.techspot.com/vb/showthread.php?threadid=8356
How to perform an in place upgrade or 2000 system repair.
http://www.techspot.com/vb/showthread.php?threadid=8356
You only need to uninstall those Service Packs that were installed *after*
installing IE6. You will have to go to the Windows Update and reinstall all
the necessary updates after the reinstall.

For XP:

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows
XP
http://support.microsoft.com/kb/318378/EN-US/

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Guest]

Thanks Jan

I will try tonight, I hope it works. I can't understand why disabling IE is
good for Spyware unless I have a fallen into a rare side effect of removing
some.

Once again Thanks


Buck