fixed winsock2 registry key reverts back on reboot/login

[rey]

I go thru all the steps to fix winsock2 registry key.
Before I reboot after change, everything seemed fixed.
Once I reboot, or even logout then login back in, key
reverts back to the state before the fix. I've exported and
compared the two (fixed and corrupt) key and there is a difference.
All I have to do now is merge fixed .reg file and everythings OK...
until I reboot/logout.

Why won't the key stay fixed???!!!!!

Help.
Rey

 

[Hans-Georg Michna]

I go thru all the steps to fix winsock2 registry key.
Before I reboot after change, everything seemed fixed.
Once I reboot, or even logout then login back in, key
reverts back to the state before the fix. I've exported and
compared the two (fixed and corrupt) key and there is a difference.
All I have to do now is merge fixed .reg file and everythings OK...
until I reboot/logout.

Why won't the key stay fixed???!!!!!

Rey,

because your computer is either infected with spyware or because
you have some program installed that changes things around. This
could be a third party network configuration utility or
something that thinks it's a firewall, i.e. some program that
thinks it creates security.

Hans-Georg

 

[Carey Holzman]

Read here:

http://tinyurl.com/5so4d

Carey

 

[Guest]

If you are referring to the unsupported removal of winsock and winsock2 key
removals, then I suggest that you are dong so from within CurrentControlSet
(not 001, 002, 003, etc.). What may prove to be a better tool for you is
adaware from www.lavasoftusa.com. Get their free version with plugins, it
has a tool there to prune unwanted winsock values.

 

[rey]

If you are referring to the unsupported removal of winsock and winsock2 key
removals, then I suggest that you are dong so from within CurrentControlSet
(not 001, 002, 003, etc.). What may prove to be a better tool for you is
adaware from www.lavasoftusa.com. Get their free version with plugins, it
has a tool there to prune unwanted winsock values.

Thanks all.
I have yet to try any of the adaware/spybot destory.
I am removing keys from within CurrentControlSet.

When I compare the two winsock2 keys (open each .reg file in notepad),
the non-working version is MUCH shorter that the working one.
So, I would think "prune unwanted winsock values" is contrary
to what the .reg files show.

Rey

 

[Malke]

Thanks all.
I have yet to try any of the adaware/spybot destory.
I am removing keys from within CurrentControlSet.

When I compare the two winsock2 keys (open each .reg file in notepad),
the non-working version is MUCH shorter that the working one.
So, I would think "prune unwanted winsock values" is contrary
to what the .reg files show.

Rey

You will get *much* better results removing malware with tools designed
to do so. All the ones I reference below are free:

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions;

2) remove spyware with Spybot Search & Destroy
(www.safer-networking.org) and Ad-aware (www.lavasoftusa.com). These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from
http://www.intermute.com/spysubtract/cwshredder_download.html. I would
not install the other Intermute programs, however. Alternately, there
are CoolWebSearch malware removal steps at
http://www.silentrunners.org/sr_cwsremoval.html. A combination of
HijackThis and About:Buster (http://www.majorgeeks.com) works well in
removing homepage hijackers. Always read the instructions before
running a spyware removal tool. Be sure to update these programs before
running, and it is a good idea to do virus/spyware scans in Safe Mode.
Make sure you are able to see all hidden files and extensions (View tab
in Folder Options);

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Run>cleanmgr).

4) make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update;

5) run a firewall.

Malke