Connection not working properly after scan

[Guest]

Hello.

My computer recently got a virus or something on it when I accidentally
downloaded this important-details.htm zip file from an e-mail that said my
account was going to be canceled. My friend recommended downloading and
using this program, so I did. After the scan, the results showed that there
was some spyware on my computer. I don't remember the exact ones, but I do
recall one being from the Gator Corporation.

Anyway, I selected to remove these infections. But now, I can't seem to
connect to the internet. I am connected through an LAN, and I never had any
troubles before until I downloaded that bad file from the e-mail and then
used this program.

I'm not exactly sure what's wrong, but every time I try to visit a web site,
I get the "Page cannot be displayed" window, even when my connection settings
show I'm connected to my LAN. Sometimes, it will actually load about 2 or 3
sites for me, but then I get the "Page cannot be displayed" page after that,
and I cannot access any more sites.

I'm afraid either this thing I downloaded from that spam e-mail has done
something to my computer, and the program just wasn't able to remove it, or
the program changed some of my settings or removed something that my internet
connection was depending on. I'm not exactly a computer genius, but those
are the only things I can think of.

I am very frustrated, and I'm considering just doing a whole reinstall. I
am just curious if anyone else has had this problem, and if they were able to
fix it.

Thanks in advance for your help!

 

[Bill Sanderson]

There is a characteristic broken LSP problem that can be caused by removing
spyware.

Unfortunately, your description doesn't match that issue--it involves a
complete break in connectivity.

If you still have that zip file available, consider submitting it here:

http://www.virustotal.com

to get a proper name for the virus which it definitely is.

Microsoft Antispyware is not an antivirus application, although there's an
overlap, and it may be helpful.

I would strongly recommend a scan from an up to date antivirus. If you
don't have one installed, you can use any of a number of online scanners.

Here's the new kid on the block:

http://safety.live.com/site/en-US/default.htm

or an old standby:

http://housecall.trendmicro.com

Now--about things to try to restore your connectivity:

It matters what version of Windows you are running--presumably this is
either XP or Windows 2000 Professional, from your statements here.

1) do the winsock fix, even though that doesn't seem to be your issue:

XP:

http://support.microsoft.com/kb/811259

2000 (or, perhaps, XP SP1)

http://www.cit.cornell.edu/computer/security/spyware/lspfix/


2) If you try the first URL above, and don't succeed, you might want to try
the second one anyway, and it's link to a succeeding page for what to do if
the first fix fails.

The other thing to try is reinitializing or reinstalling TCP/IP

XP:

(the party line)
http://support.microsoft.com/default.aspx?scid=kb;en-us;299357

The radical fringe
http://www.answers.vt.edu/ask4help/desktop/vtkb2433.htm

Windows 2000:

http://www.petri.co.il/reinstall_tcp_ip_on_windows_2000.htm

It won't hurt (if you are technically inclined) to read all those URL's,
even if you don't choose to follow a given prescription.

If you do both those things (reset Winsock and TCP/IP) then I'd also wonder
about Internet Explorer, if you are still having problems. Installing an
alternative browser as a test would be a good thing to do.

I don't think I have a solid link to give you for how to best repair
Internet Explorer--I believe the last thing I read prescribed reinstalling
SP2 via the network admins download version--hope that isn't needed.



--

 

[Guest]

This sounds very similar to the Mytob Worm so worth checking your hosts file
incase the Worm is blocking access to sites, The easiest way to check this is
open Microsoft Antispyware > Goto Advance Tools > Choose System Explorers >
Under Networking left click Windows Hosts File > Unless you have Protection
hosts files like MVPS Hosts or IESpyad installed then the default hosts file
will only have one entry which is 127.0.0.1 localhost, Let us know if you see
anything else in here except for the localhost line.

If you can get to the Symantec site then download this Fixtool for the Mytob
worm as it will remove the files if it is this worm and repair the hosts
file. If you cannot get this fixtool and have alot of entries in the hosts
file then download Hoster and press Restore Defaults first then try download
the fixtool again.

Download the MyTob Remover

http://securityresponse.symantec.com/avcenter/FixMytob.exe

Save the file to a convenient location, such as your desktop.

Close all the running programs. Locate the file that you just downloaded.
Double-click the FixMytob.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.
When the tool has finished running, you will see a message indicating
whether the worm was on your computer.

If it was then restart the computer & run the removal tool again to ensure
that the system is clean.


If you have alot of sites entered into the hosts file and you cannot access
the fixtool from symantec then download Hoster from Here

http://www.funkytoad.com/download/hoster.zip

Save to desktop or c:\drive and extract and run Hoster, From the menu on the
right press "Restore Original Hosts" to reset it to Microsofts Default hosts
file, You may need to press the Button at the top right first which is "Make
Hosts Writable" before pressing restore defaults, If the Worm has changed it
then it may of also set it as Read Only,

I think you have this Worm or a variant of it.

Win32.Mytob.JT

http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=47588


Regards

Andy

 

[Guest]

If you are using a router, simply pull the power cord from the router and
then plug it back in.

At times, routers get hung-up at times. I've had to do this in the past to
get an Internet connection. If you ae also using a cable modem, you might
want to pulg the power cord from that first and see if that fixes the problem
BEFORE doing anything with the router.

Alan