OT but important

[BillR]

I have seen many posts in here about network problems. I recently had a few and decided to refrain from the pron few moments and do some other reading.

What I found was interesting. If you are experiencing weird disconnects or your computer, suddenly can’t see your network, or you get the “Network cable unplugged” message, there is a cure.

It would seem that some ad-ware and spy crap actually modifies your “WinSock”. As well they screw with your TCIP Stack. I know everyone here runs some sort of spy ware program every day with out fail, but even though they remove the problem they leave in its place a “shim” or null code which can still cause issues.

Microsoft has several articles in the knowledge base on how to delete tons of registry settings and rebuild your WinSock and TCIP Stack, and they work. On the other hand I found this program (seems everyone but me knows about this) that simply fixes the problem for you.

“Winsock XP fix”

Try Mr. Google, there are a bunch of download sites.

1-Shut down anything that’s open
2-Back up your registry (the program will do this for you)
3-If your running static addresses on your network you will have to rebuild each one you run this program for (remember, it rebuilds your TCIP stack.
4-Once the program is done it will re-boot your machine
5-The damn thing actually works.

Hope this helps someone. Sure helped me.

 

[RedShred]

gonna trust ya on this.

 

[Fujiwara Takumi]

im so sick of this crap. in what world is adaware a good thing? especially when it ruins your computer so much that you cant even deliver ads to them.

 

[i3lacKnyte]

my computer was viciously attacked by a program that was installed on my computer while i was browsing this morning. im sitting there reading and i see the little install icon in my taskbar, i tried clicking on it but it didnt display anything, my computer's hard drive started clicking away, and when it was done i rebooted. holy cow, i got a million pop ups, errors, around three or four programs launched that i never even heard of before, my computer was virtually unusable. it uninstalled google toolbar out of ie and replaced it with its own, spybot, adaware and ccleaner couldnt remove it, it got past my hardware firewall, windows firewall, and my aggressive nvidia firewall on my nforce3 250gb, and the firewall in my router. i never stray from trusted sites like hardocp, so i dont know where it came from. i ended manually removing it which took about 2 hours of frustration, but its completely gone now. my best folder was being raped, but i think she's okay now.

i just went to hardfolding.com (which is down) and saw that whatever this thing is replaced my default microsoft search result page with its own (i think this thing is called searchforit) god damnit i cant kill it, anybody know what i can do?

 

[Strikemaster]

Welcome to the dark side, chair's in the corner...

Since about 2002, it's been my lot in life to clean this crap from customer's computers. It's a challenge at best, it's a damned trial by fire at worst. The tools I use, in no specific order:

Lavasoft's Ad-Aware SE Personal v. 1.05
Spybot Search & Destroy 1.3
HijackThis! 1.97.1
WinsockFix
CWShredder
LSPFix
Regedit
McAfee's Stinger utility http://vil.nai.com/vil/stinger
Trendware's Housecall online virus scanner http://housecall.trendmicro.com

DOS command skills help, as the best work is done with SpyBot's built-in tools, Regedit and Ad-Aware while in XP's Safe Mode - Command Prompt Only. Use HijackThis! to ascertain what the enemy is, rip out the files from the command prompt, then run SpyBot and Ad-Aware in succession to clear out the poison left behind.

One hard-won nugget of information: if you've got more than three "users" on a XP box, back up your data and nuke the friggin' thing to bare metal. It's just not worth chasing this crap back and forth across the users for hours at a time. Depending on the speed of the comp, you'll spend as much as three hours per "user" trying to remove something nasty like Spider-Search or Windowws.cc from the boxen.

One of the few saving graces about XP SP2 is IE now gives you fair warning that something's trying to screw your computer over. If you're not using SP2, dump the Big Blue E and get Mozilla, Opera, or Firebird running ASAP! The VAST majority of this spyware plague is written to attack Intarweb Exploder and ActiveX; deny it the toehold, and it can't get in. (I've used Opera since 5.1, never regretted the money)

 

[BillR]

Strikemaster is right of course, I was just trying to keep it simple lol. Rebuilding a WinSock from scratch sucks for the faint of heart and it less fun for the knowledgeable.
The more you know the worse it gets.

I used to rely on Norton before the advent of Win-XP but it seems up until now Symantec forgot XP had been released so other then their antivirus the utilities were worthless. Norton System Works 2005 has been released and wow, what a change.

I installed it on this machine with much trepidation and little hope of improvement but I was wrong. The first thing it does is scan your system and replace the firewall from SP-2 with one that works. No, I mean really works. I fed every test virus and worm I could find into the system through IE and MS OutLook. It caught everything and killed it before it got anywhere. There is a one button scan (it used to be a joke) which now has replaced SpyBot and Ad-Aware on this machine. I also use Zone Alarm pro in conjunction with System Works 2005; the pair seems to be a really good combo. I have not tried Nortons firewall 2005 yet, but it has had its usual good reviews.

As a final test I installed 2005 on a computer that has a huge quarantine file I keep just for fun, and turned it loose. The computer didn’t miss a beat. NAV caught it all and cleaned it up in seconds.

Anywho, System Works 2005 seems a good investment. It works this time and has tons of tricks and options to improve XP. Give it a shot.

 

[pageian]

One program that I rely on is SpywareBlaster. It's free, has almost no footprint, doesn't involve running scans and is pretty effective. It's basically an immunization program, download updates every week or so and enable protection... it keeps the crap from getting on your machine in the first place which is better than having to figure out how to remove it later. Use it in conjuction with some of the other programs mentioned above and spyware isn't that big of a problem.

 

[neevo]

If we are talking about removing spyware thanks to this test http://spywarewarrior.com/asw-test-results-1.htm I have tried Giant antispyware (using the 15 day unlimited demo) and am impressed, so impressed that I may well cough up for it when it runs out on my gaming machine.

I had to clean a couple of machines - from 2 cousins of one customer - last week and I started to get looks from the gaffers 'cos they thought I was tossing it off for taking so long. As strike said, one had 4 users on it and it was a right pain killing the stuff.

One recommendation I have, before using the scanning tools clean out all the temp files wherever they are on that system and also delete temp internet files. This is where some reside but on an infected machine any scanner checks all the files, if you can deleted 10,000 temp files then the scanner runs a little quicker!

 

[i3lacKnyte]

wow, thank you all for the awesome info. when i am at work and not using my machines, i want every spare cycle folding [H]ard, but unfortunately with todays internet thats just not the case. i think i am going to backup, use install service pack 2, and probably purchase norton systemworks 2005 (i havent bought that since 2003). all of the other programs i use except i dont have hijackthis installed on this machine, and i can't even begin to tell you how many times regedit has saved me bum.

 

[Strikemaster]

Anywho, System Works 2005 seems a good investment. It works this time and has tons of tricks and options to improve XP. Give it a shot.

I might get a copy and try it out, but I don't hold much hope.

We've seen a LOT of these things come through (I work at an ISP, and we offer the removal service because we like to suffer ), and our experience with Symantec's offerings to date has been abysmal. SystemWorks 2004's response to spyware reminds me of a prissy housewife seeing that the dog has crapped in the kitchen; a lot of finger pointing at the objects, a hissy fit about it's not going to touch it, and a demand that someone take it away now. Much manual removal of files ensues. McAfee AV 8 works better, but it's getting to the point with McAfee that I'm leaning towards relic's viewpoint re. power sanders and my own genitalia .

The true first step in getting rid of spyware, is to capture about a dozen of the authors and the people who pay for their services, string them up in a public greens and abuse them on CNN like pinatas at Cinco de Mayo. String up Sanford Wallace an a few of his spammer buddies, gimme a baseball bat, and point me towards the commons.

 

[ByteDown[H]ard]

I have used most of these tools at one time or another and they have done a good job for the most part. I spent 3 hours at work removing dozens of spyware/adware browser hijackers from 1 users machine! My arsenal includes ad-aware, pest patrol, spybot s&d and the new giant anti-spyware. This new crap that has been going around is terrible nasty to remove, especially on xp systems. I clean out temp files, temp i-net files empty the recycle bin and shut down restore and this stuff just keeps coming back. Had to use the system restore disc on 1 machine it was so bad.. Death to spyware/adware maggots! or at least torture

 

[Ch1m3r4]

I worship the WinSockFix

I have a little shrine set up in the corner of my room, and everyday before I go to work I pray to the WinSockFix god that it might heal the ills I will encounter throughout my arduous journey, that it might keep me safe from the evils of adware, spyware, and malware, and that it will allow me to save the poor souls afflicted by these demons.

rough translation:
it fixes just about everything on any windows based OS and I love it.

 

[RedShred]

I have a customers machine that I sent back after 2 hours of digging... I gave it back to them with a follow up appointment in their residence to backup their files and do a rebuild.

I like the extra money, but this is getting crazy. The machine was completely hijacked... I mean completely.

I'm not as savy as some of you software guys, but I can hold my own... but this machine was like none I've ever seen.


I've just downloaded mozilla... gonna try it out on this machine. I've a fresh install of XP with all but SP2.

 

[dr_dirtnap]

Want to know something funny?

I was installing Win2k on a machine at home, and by mistake I set it up on the IP that I have setup for my DMZ.

Before I logged in the first time the computer was hijacked. Nothing worked, I opened IE and it had some kind of Casino webpage set as the homepage. I was like 'HOLY COW' that didn't take long.

Open ports are bad, I shut down that DMZ real fast. Don't know why it was open in the first place.

Anyway, that was the first time I was ever hijacked before I logged on for the first time.

So I reformatted and started over.....

I just couldn't believe that even since I slip streamed SP4 into the Win2k installation the puter was that vulnerable.

 

[RedShred]

I'd love to see some legislation on this.

I too think there is too much already, but if we can get some legal standing ground against this stuff, the net would be a safer place. Hell, I cannot let my kids surf without being called into their rooms every few minutes on a popup.

 

[Mayhem33]

A tool I like to use is called Window Washer by Webroot Software. You can set it to wash the slack file space and overwrite all files that were deleted. There are settings as to how many overwrite passes you want it to make. This is also great for security, if you do your banking and such online. You run this proggy then the spyware ones and the spyware doesn’t have as easy of a time replicating itself. I personally use a hardware firewall in conjunction with SP2’s firewall. As for Norton I am not a believer. I use Grisofts AVG free version for home virus scanner. You can just sign up and receive all the updates and even automate the whole thing. I even use explorer and have had no trouble since I found this set up.

 

[Impulse]

Norton's anti-spyware component is not as strong as standalone utils yet afaik, the AV is amongst the toughest tho, from the tests I've seen. I stick with Norton Internet Security 2k4-5 (AV + Firewall, I don't much like the bloatware in Systemworks), Spybot S&D, and occasional Ad-Aware scans; seems to work good enough... Oh and Firefox. <3 Firefox

Only crap I've caught lately is monitoring cookies from sites I wasn't interested in being monitored by and the usual e-mail crap from friends/relatives which Norton stops dead. Can't say Norton's given me any problems, it's auto adjusted/recognized everything legit I've run 'cept Steam and all I had to do was tell it to allow it on initial install.

When I go work on someone's computer I take AVG, Spybot, Ad-Aware, and Mozilla along with a bunch of updates on a USB key. I install it all ('cept Mozilla which I ask if they want installed first to avoid trouble, I explain the advantages obviously tho).

I'm thinkimg I should probably start packing WinSockFix as well, might save me from a few format routines when servicing systems...

 

[ByteDown[H]ard]

I have tried to use AVG on 2 seperate machines. Each time I received 2 diff errors and it locked up the install. Either I have a bad install on disc or those machines were persuaded to "Just Say No" to AVG.. Anyone else run into this???

 

[unhappy_mage]

I got hijacked over 56k without even realizing it. I thought it was a hardware bug. The machine would randomly get this popup box saying the machine would shut down in 60 seconds, and then it would. When I figured it out, I nuked it back to bare metal and didn't connect to the Internet until I had a firewall and antivirus on it.

So, a big YOU SUCK to any virus writers out there. What, you can't think of anything better to do?

 

[dualblade]

lol, perhaps i'm the only one, but i'm going to be sorry when sp2 takes hold en masse. i like the money from fixing people spyware problems

 

[pageian]

I have tried to use AVG on 2 seperate machines. Each time I received 2 diff errors and it locked up the install. Either I have a bad install on disc or those machines were persuaded to "Just Say No" to AVG.. Anyone else run into this???

I've used AVG free version on quite a few machines without any issues. It seems to do it's job pretty well, the only complaint I have about it is it seems to want to report viruses more than clean them.

I can't recall getting any errors during install, other than maybe not rebooting before runing updates.

 

[sharp]

AVG on my box, and several others, no install or operational issues to report.

 

[BillR]

Norton's anti-spyware component is not as strong as standalone utils yet afaik, the AV is amongst the toughest tho, from the tests I've seen. I stick with Norton Internet Security 2k4-5 (AV + Firewall, I don't much like the bloatware in Systemworks), Spybot S&D, and occasional Ad-Aware scans; seems to work good enough... Oh and Firefox. <3 Firefox

Only crap I've caught lately is monitoring cookies from sites I wasn't interested in being monitored by and the usual e-mail crap from friends/relatives which Norton stops dead. Can't say Norton's given me any problems, it's auto adjusted/recognized everything legit I've run 'cept Steam and all I had to do was tell it to allow it on initial install.

When I go work on someone's computer I take AVG, Spybot, Ad-Aware, and Mozilla along with a bunch of updates on a USB key. I install it all ('cept Mozilla which I ask if they want installed first to avoid trouble, I explain the advantages obviously tho).

I'm thinkimg I should probably start packing WinSockFix as well, might save me from a few format routines when servicing systems...

]

Yup unitl System Works 2005 I would have to agree totally. Some one at that company woke up and actually fixed it. Spybot and Ad-Aware can't find a thing anymore since I started useing 2005. About a week after I got my hands on a copy PC-Mag did a review and they confirmed what I had found, it really works this time. Disk Dr now knows what an NTFS file system is, speed disk does too. I know it's scary, but I'm sure impressed.