Help on WinSock XP Fix 1.2

Discussion in 'Malware Help (A Specialist Will Reply)' started by rup, Jul 14, 2005.

  1. rup

    rup Private E-2

    I downloaded WinSock XP Fix 1.2 and it fixed my problem but, evrytime I start my comp, this program has to be run before I can use the net. Please tell me why the changes being made bt this program is only temporary. Do I have to conitnue running it evrytime I reboot?
     
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Lets get a look at a HJT log before we do anything.

    http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

    http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

    http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

    http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

    http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting
     
  3. rup

    rup Private E-2

    I followed all the instructions. Ran all the scans in order. I couldn't run the online scans in 'safe mode with networking' since my pppoe broadband connection didn't work in this mode. In normal mode they ran successfully.
    (In course of the scans a number of problems were detected and removed)
    But nothing has changed. I still have the problem I mentioned in this thread.So I ran Hijack This and am attaching the log file.
     

    Attached Files:

  4. rup

    rup Private E-2

    I uploaded the log to an analyser and fixed two 'malicious' threats: R3 and O21. But again my connection problem remains. Infact if I ping using the url, say, 'google.com' it reports an error but if i ping the IP address '216.239.39.99' for google.com everything works fine. The same happens if I enter the IP address in the browser.
    Now Winsock XP program I downloaded from this site fixes the problem but as I said, the fix is temporary and I need to run the program everytime I switch on the comp.
     
  5. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your Operating System and Internet Explorer versions are WAY out of date and represent a major security risk. After we fix your current problems, you must get updated. You need to install Service Pack 2 for security purposes.


    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

    R3 - Default URLSearchHook is missing

    F3 - REG:win.ini: load= C:\TCWIN45\PIPELINE\remind.exe

    O4 - HKLM\..\Run: [MSN PLUS XP] wspad.exe
    O4 - HKLM\..\RunServices: [MSN PLUS XP] wspad.exe

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
    O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab

    O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Navigate to and DELETE the following if they should remain:

    C:\WINDOWS\System32\wspad.exe

    C:\WINDOWS\System32\vbsys2.dll

    C:\ex.cab

    NEXT:
    Run CCleaner to clean up cookies and temp files.

    Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
    Note: Remember to get all updates before doing the scans.

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.


    Reboot to Normal Windows , Scan with HijackThis and attach the new log.
     
  6. rup

    rup Private E-2

    I followed your intructions. Nothing has changed, I still need to run Winsockxpfix before i can connect to the internet. I'm attaching the new logfile.
     

    Attached Files:

  7. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your HJT log is now clean!

    Now you must surf in to Windows Updates and get updated. You need to install Service Pack 2 for security purposes. Without this critical update you will have problems.

    Once you have installed SP2 and all critical updates reboot and see if the problem remains.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds