Scan and Clean Corrupts TCP/IP Stack

[Patrick]

I had this problem with AdAware 6 (Lite) so tried the
Microsoft version. It detected a horrifying 8 spyware
programs and cleaned them. After a restart, the TCP/IP
stack was corrupted causing all sorts of issues. No
workaround got it working properly again - wasn't it
lucky I had a system restore to go back to.

One of the spyware programs was LSP which I understand to
ss about with WinSock. Could this cause the issue when
cleaned?

This seems to be a known issue with AdAware if you do a
google with AdAware and TCP/IP stack corrupted, so I
guess this is having the same issue. Please help as I
want to clean my computer. Microsoft reply
preferred...

 

[Guest]

Forgot to mention (doh!)

Windows XP Professional (genuine)
AMD Athalon 2.4Ghz Equiv
512Mb RAM
Fully up to date incl all updates and SP2 etc.

 

[mo]

I had this problem with AdAware 6 (Lite) so tried the
Microsoft version. It detected a horrifying 8 spyware
programs and cleaned them. After a restart, the TCP/IP
stack was corrupted causing all sorts of issues. No
workaround got it working properly again - wasn't it
lucky I had a system restore to go back to.

One of the spyware programs was LSP which I understand to
ss about with WinSock. Could this cause the issue when
cleaned?

This seems to be a known issue with AdAware if you do a
google with AdAware and TCP/IP stack corrupted, so I
guess this is having the same issue. Please help as I
want to clean my computer. Microsoft reply
preferred...

is a good idea before removing any spyware to have on hand LSPfix
or other Winsock repair utility. lspfix is free and easy to use.if you
follow
the windows xp news groups at all you will see that is one of the most
common pieces of advice given. some malware hooks into the tcp/ip
and removing the malware leaves tcp/ip in a nonfunctioning state

 

[Bryn]

Yes, you need to unplug the Layered Service Provider the
spyware plugged into Internet Explorer in order to monitor
your browsing.

A quick google for lsp turns up
http://www.cexx.org/lspfix.htm as the first hit. I have
used this tool to fix IE.

Download the LSP fix tool and save it somewhere. Remove
the spyware. Use the fix tool to look at what LSPs you
have installed, remove any that are suspicious like
"lsp.dll". On my machine I have "mswsock.dll",
"winrnr.dll", "rsvpsp.dll"; these are normal for win2k/XP,
I also have "wshbth.dll" which is related to bluetooth (I
have a bluetooth adapter, so that makes sense).

List of known LSPs: http://computercops.biz/LSPs.html,
remember to have that available when your computer is
broken .

Adware removal tools really need to start getting wise to
LSPs as they can really ruin your day if not removed properly.

 

[Bill Sanderson]

This is rather easily fixed in SP2, should you wish to get your machine
clean.

At a command prompt:

netsh winsock reset

Hit enter
restart.

Reinstall any legit application which have added themselves to the Winsock
stack.

One question in your case is whether what knocked you out was, in fact,
malware, or a false positive.

You might re-run the scan and look carefully at what is found--in particular
look for SPORDER.DLL and see whether it appears to be a file associated with
an application you've knowingly installed--as well it may be.