after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills mem

Hi

I have just been through the malware removal forum and computer is all clear (thread is called "Re: Zeroaccess and cant change windows firewall"). However I in the process 3 problems have come up:

1) I can connect to the network but no Internet access

2 Programs like internet explorer, steam and outlook wont start.

3) svhost.exe(networksrvicenetworkrestricted) is continually restarting and ending filling the memory to 100%. If I disable the wireless network and restart it doesnt happen.

Timw from the malware forum reffered me to this forum.

Netnanny was causing a problem after the clean up so we unistalled it.

Also the computer is overheating relatively easily but I suspect that problem is hardware agravated by the memory usage issue with svhost.

Before I joined the malware forum i did bad and tried to fix the internet problem following someone elses thread (with no understanding of what i was doing) this is what i followed :-o :

"Click Start, and then click Run.
In the Open box, type regedit, and then click OK.
In Registry Editor, locate the following keys, right-click each key, and then click Delete:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2
When you are prompted to confirm the deletion, click Yes.
Close the Registry Editor.

Locate the Nettcpip.inf file in C:\WINDOWS\inf and then open the file in Notepad.
Locate the [MS_TCPIP.PrimaryInstall] section. Change the Characteristics = 0xA0 entry by replacing 0xA0 with 0x80. Save the file. Exit Notepad.
In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
On the General tab, click Install, select Protocol, and then click Add.
In the Select Network Protocols window, click Have Disk.
In the Copy manufacturer's files from text box, type C:\WINDOWS\inf, and then click OK.
Select Internet Protocol (TCP/IP), and then click OK. It will report as unsigned, this is the one we want! Do not choose Microsoft TCP/IP v6!

Note This step returns you to the Local Area Connection Properties screen. However, the Uninstall button is now available.
Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
You will be asked to reboot your PC for the changes to take affect, go ahead and do this now.

Once you have rebooted...
In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
On the General tab, click Install, select Protocol, and then click Add.
In the Select Network Protocols window, click Have Disk.
In the Copy Manufacturer's files from text box, type C:\WINDOWS\inf, and then click OK.
Select Internet Protocol (TCP/IP), and then click OK.
Restart your computer.
Test your Internet connectivity."

I only got as far as deleting the winsock and winsock2.

I couldnt edit the Nettcpip.inf file in C:\WINDOWS\inf as it said I wasnt a trusted installer. So I had to stop at that point.

Thanks in advance, yous guys are awesome for what you do here....

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Hi

I am using windows 7, 64 bit. service pack 1.

I ran winsock reset. It showed 2 last known control sets (controlset001 and 002). And the current control set.
In the missing dlls box it said c:windows\system32\

I was not sure what to run so I ran "proceed without replacement"

After restart there were no yellow triangles in device manager, no internet when activating wireless, however the memory usage problem no longer happens (svhost.exe).

Thanks

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Out of curiosity, click START, then type in cmd (press enter).

A black command windows will appear.

ipconfig /all > info.txt (press enter)
notepad info.txt (press enter)
Save the info to a file and add it here. Or just copy and paste it.

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Hi

I have attached a log for when the wireless adapter was disabled and when it as enabled.

Thanks

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Okay, you may need to re-install your nics/wireless. Can you go to device manager. Click START, then RUN, then type in: devmgmt.msc

Then go to network adapters, delete all network adapters. Then reboot.

Note: This is the brute force method of resetting your networking. The drivers for these devices should already be installed. But, if they are not, you may have to redownload them.

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Hi

when deleting the adapters it gives the option to delete the drivers, should I tick this box.

I tried without ticking the delete drivers box and on reboot the adapters reinstalled but internet still not working.

cheers

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Given that its been 11 days since I last posted on this thread I will assume my last question was deemed stupid.

I will attempt to delete the drivers, I hope some one will be around to help me find and reinstall the correct drivers?? I guess I can start a new thread?

I will wait a day or so before I do just in case you are still reading this thread.

Cheers

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

I am sorry your thread was not responded to sooner. Please be advised that we do not consider any question here stupid, apart from the one that is not asked.

As for your problem, yes, please check the box and try again. I would suggest that you download the latest drivers first as an insurance mechanism.

If you need help finding the correct drivers please post back.

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Thanks for your response.

You guys do a great job here, and much appreciate the help, I cant complain at all.

I have deleted the drivers after which I was hit with a blue screen of death...

On restart device manager showed the drivers were reinstalled and also included Microsoft virtual wifi miniport adapter #3 which had a yellow triangle exclamation mark.

Still no internet, internet explorer wont open etc

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

andrewchap,

This is just a suggestion. It has been around a month since you first posted on this forum not counting the time you spent on the malware forum. Would the time be better spent to save off all your data and reinstall Windows and all your programs? That would take a few hours at most and you would be back on the air. Sometimes repairing all the damage created by viruses and malware is not practical or even possible in some cases.

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Thanks Jconstan I appreciate your suggestion.. however I find it hard to spare a large packet of time to rebuild the computer and am happy to spend half an hour here and there trying to fix it (I have a lot of kids - more than 6).

I have loads of programs and a couple of them would require major hassles to reinstall (do not have the disks, licenced with ids - not pirated).

I have another computer running on the same wireless adapter and have tried to manually set the default gateway address and ip address but it didn't work.

The working laptop had: IP 192.168.33.170 and default gateway of 192.168.33.1 SO I gave manual IP address to the wireless adapter (of the not working laptop) of 192.168.33.169 and used the same default gateway.

I think this problem was caused when I messed with the register winsocks (see first post) or it was a conflict of combofix with netnanny.

I don't think I used winsockrest properly - I ran without replacement?

I suspect steam and ie don't open because I don't have a correct ip address (169....)

Thanks to anyone who has any suggestions...

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Hi

I need to add

I am sure this is a winsock issue...

the registry has a winsock2 entry but no winsock entry?? (under hk local machine/system/currentcontrolset/services and also not present under controlset001 or 002)

I do not think I used winsock reset program I downloaded properly.

I just tried opening the cmd prompt in admin mode and typing: netsh winsock reset --- an error was returned "the system cannot find the file specified."

A second point I remember (after going back over my virus fix up posts) is that when I deleted the winsocks (see first post in this thread) steam and Internet explorer started working, then stopped during the next step in removing the malware.

Looking forward to some help

 

Re: after malwareforum, nointernet, svhost.exe(networkservicenetworkrestricted) fills

Hi All

I tried a couple more things such as reinstalling the protocol... no luck

other winsock resets... no luck

So went back to using the 'winsock reset' program that thefool told me to run.... However I ran "proceed with defaults".

On restart internet was restored, IE opened, steam opened, outlook started working.

I did ask 'thefool' on 28/3 about the correct use of this program... so for him and anyone else reading... the correct use was to press the "proceed with defaults" button in this instance.

I think I will start a new post about the overheating... cheers alll

Thanks to every one who offered help...

thanks to thefool... he had me in the right direction, I just didn't do it right.

This website is awesome!