Fuck, my internet has been destroyed by adware (winsock, need help) - GoFuckYourself.com - Adult Webmaster Forum

X

Myst

Confirmed User

Join Date: Feb 2004

Posts: 4708
Share

Post
#1

Fuck, my internet has been destroyed by adware (winsock, need help)

12-19-2004, 04:44 AM

Alright. I really thought that with SP2, using browsers like maxthon, popup blockers and what not, that getting shit installed on your computer from websites was a thing of the past. Nope, i was wrong, a couple of days ago, some asshole on gfy posted some links (cant remember what they were). I went there, see popups, and immideately theres program after program being executed (task manager).

I grab adaware/spybot/kaspersky/hijack this, reboot in safe mode, kill all the shit (some manually), and restart.

All the stuffs gone, my computer appears to be clean but my internet is severely fucked.

theres a nice little summary of whats going on. Apparantly, winsock is buggered up, or something in the registry is not quite right (note, this is AFTER removing all viruses, doing a repair with my xp cd). My ip appears to be local 127.0.0.1, and not the 129.128 one its supposed to be. 10.0.0.1 is a network ip that i have to connect to via SSH for access to the internet.

In IE, evreything shows up as 'page cannot be displayed'. Firefox shows a blank page. Clearly requests arent being properly at all it seems.

I dont know what the fuck to do, im all out. I dont use system restore or registry backups cause im an idiot. A decade of computing and nothing has raped me like this before. Any suggestions on what to do?

ICQ: 298-523-037
Tags: None
darkember

Registered User

Join Date: Jul 2004

Posts: 50
Share

Post
#2

12-19-2004, 05:03 AM

try to delete your network card in XP let it rediscover and set it up.

where it says ping statistics for (garbage chars) thats not a good sign

If you did the xp repair install then the correct files should be there (dll wise) but the settings are hosed. If you CAN move the network card to a different slot it should 9/10 times give it a completely different config instead of rewriting the old one. Try the delete/rediscover of the network card, go from there.

PussyCash pays $100 for every ImLive signup
Comment
LiveDose

Show Yer Tits!

Join Date: Feb 2002

Posts: 25792
Share

Post
#3

12-19-2004, 05:18 AM

Jesus christ... This is exactly what I have been dealing with on one of the computers here for the last 3 days.

Fuckin' sucks. I am trying at all cost to avoid wasting time reformatting....

Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal
Comment
NaughtyINC

Confirmed User

Join Date: Jul 2004

Posts: 1288
Share

Post
#4

12-19-2004, 05:21 AM

is your host file changed at all (c:\windows\system32\drivers\etc\host) check it out see whats in it... maybe just something was added into it (some spyware does that to prevent you from being able to hit specific sites)

meh
Comment
Linkster

Confirmed User

Join Date: Feb 2003

Posts: 3216
Share

Post
#5

12-19-2004, 05:22 AM

check your hosts file under windows/system32/etc and delete all entries except the localhost 127.0.0.1(use notepad to view the file) or whatever it has in there - then go to a cmd windown (start - run - type in cmd and hit return) then type in ipconfig /release and return.
Exit the window
Make sure all browsers and mail programs are closed while you do this
Then just do a hard boot (complete power off) and it should find the new IP for you

Porn Links Crak for your bank account - Get Addicted
FREE LIVE CAM SHOWS
Comment
Myst

Confirmed User

Join Date: Feb 2004

Posts: 4708
Share

Post
#6

12-19-2004, 05:29 AM

hosts file is empty

ICQ: 298-523-037
Comment
LiveDose

Show Yer Tits!

Join Date: Feb 2002

Posts: 25792
Share

Post
#7

12-19-2004, 05:30 AM

Didn't check host file yet. Good suggestion, thanks.

Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal
Comment
Myst

Confirmed User

Join Date: Feb 2004

Posts: 4708
Share

Post
#8

12-19-2004, 05:30 AM

also, my ip is not DHCP dynamic, its a specific one so releasing wont help

ICQ: 298-523-037
Comment
quantum-x

Confirmed User

Join Date: Feb 2002

Posts: 6863
Share

Post
#9

12-19-2004, 05:30 AM

just a note here, I've found, after a LOT of frustration, that spybot/adaware etc, really do suck.
They pick up some stuff, but miss others - just too inconsistant.

I run http://webroot.com/products/spysweeper/ and it's great.

Nothing gets through, the cleans are fast and effective, the database is always up to date, and it makes sure things like your bookmarks etc don't get touched.

Instead of running 5 programs that try to cover different areas, run this, and have it cover them all, properly

PrettyInCash.com - BoozedGFs.com - TeenGFs.com - JizzGFs.com- MilfUploads.com -
Comment
NaughtyINC

Confirmed User

Join Date: Jul 2004

Posts: 1288
Share

Post
#10

12-19-2004, 05:31 AM

i dont think it has anything to do with the ip.. i mean it wouldnt hurt to try a release and a renew but i doubt it would make a difference..

you said you have tried some spyware programs etc and nothing resolved.. did you try bulletproof spyware?

also u on xp home or pro?

meh
Comment
NaughtyINC

Confirmed User

Join Date: Jul 2004

Posts: 1288
Share

Post
#11

12-19-2004, 05:32 AM

Originally posted by LiveDose
Didn't check host file yet. Good suggestion, thanks.

no probs

meh
Comment
LiveDose

Show Yer Tits!

Join Date: Feb 2002

Posts: 25792
Share

Post
#12

12-19-2004, 05:37 AM

Quick question... I am able to release and renew ip, login & ping from the router admin screen out to sites but explorer, outlook, wsftp seem blocked. Any programs which need to access the net won't...

Does this give any better indication of what might be happening?

Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal
Comment
NaughtyINC

Confirmed User

Join Date: Jul 2004

Posts: 1288
Share

Post
#13

12-19-2004, 05:40 AM

Originally posted by LiveDose
Quick question... I am able to release and renew ip, login & ping from the router admin screen out to sites but explorer, outlook, wsftp seem blocked. Any programs which need to access the net won't...

Does this give any better indication of what might be happening?

you have the firewall turned on.. u using zone alarm or norton firewall or anything to that level?

meh
Comment
darkember

Registered User

Join Date: Jul 2004

Posts: 50
Share

Post
#14

12-19-2004, 05:41 AM

firewall ?

PussyCash pays $100 for every ImLive signup
Comment
NaughtyINC

Confirmed User

Join Date: Jul 2004

Posts: 1288
Share

Post
#15

12-19-2004, 05:46 AM

also you using a router or anything that may be specific on settings... lots of variations what could be going on...

let me know and i should be able to help ya

meh
Comment
LiveDose

Show Yer Tits!

Join Date: Feb 2002

Posts: 25792
Share

Post
#16

12-19-2004, 05:54 AM

I've tried connecting with all firewall & AV off to test. Also I connected directly to the wall jack to test. Exact same results.

Don't know if it's a coincidence but I had just upgraded aol to 9.0 for someone who is visiting and this happened soon after. I remember about two years ago having this type of problem after a buggy aol install as well.

I haven't made any other recent changes to the system or router.

Myst have you installed anything new right before this happened?

Scammer Alert: acer19 acer [email protected] [email protected] Money stolen using PayPal
Comment
Trixxxia

Confirmed User

Join Date: Aug 2004

Posts: 5600
Share

Post
#17

12-19-2004, 05:57 AM

I've had a similar problem to this - took me awhile to figure it out but for me, on the LAN Settings, it changed my 'Automatic Configuration' settings - from Automatically Detect to Proxy Server 127.0.0.1.

Check if that's the same problem - go to Tools->Internet Options->Connections->Lan Settings->Check if it's set for the Proxy Server or Automatic configuration.

I hope that helps!
Comment
ALiEn_OuT

Confirmed User

Join Date: Apr 2004

Posts: 577
Share

Post
#18

12-19-2004, 06:06 AM

Your suffering from Winsock2 corruption, I get alot of this in longhorn and the new media center windows. Microsoft kabse article : 811259 lists these steps as the resolution :

Step 1: Delete the corrupted registry keys
1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock2
4. When you are prompted to confirm the deletion, click Yes.
Note Restart the computer after you delete the Winsock keys. Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.
Step 2: Install TCP/IP
1. Right-click the network connection, and then click Properties.
2. Click Install.
3. Click Protocol, and then click Add.
4. Click Have Disk.
5. Type C:\Windows\inf, and then click OK.
6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.
7. Restart the computer.

Originally posted by Myst
Alright. I really thought that with SP2, using browsers like maxthon, popup blockers and what not, that getting shit installed on your computer from websites was a thing of the past. Nope, i was wrong, a couple of days ago, some asshole on gfy posted some links (cant remember what they were). I went there, see popups, and immideately theres program after program being executed (task manager).

I grab adaware/spybot/kaspersky/hijack this, reboot in safe mode, kill all the shit (some manually), and restart.

All the stuffs gone, my computer appears to be clean but my internet is severely fucked.

theres a nice little summary of whats going on. Apparantly, winsock is buggered up, or something in the registry is not quite right (note, this is AFTER removing all viruses, doing a repair with my xp cd). My ip appears to be local 127.0.0.1, and not the 129.128 one its supposed to be. 10.0.0.1 is a network ip that i have to connect to via SSH for access to the internet.

In IE, evreything shows up as 'page cannot be displayed'. Firefox shows a blank page. Clearly requests arent being properly at all it seems.

I dont know what the fuck to do, im all out. I dont use system restore or registry backups cause im an idiot. A decade of computing and nothing has raped me like this before. Any suggestions on what to do?
Comment
XpressMedia

Confirmed User

Join Date: Sep 2004

Posts: 690
Share

Post
#19

12-19-2004, 06:24 AM

I use a program I got on download.com called Spyway Doctor, it removed 20-30 spyware programs on my pc and really picked things up as far as speed wise.
Comment
coolfuck

Confirmed User

Join Date: Jun 2004

Posts: 2440
Share

Post
#20

12-19-2004, 06:25 AM

i think u need to re-install the windows

WANT TO PLACE YOUR TEXT/BANNER HERE?
MSG ME:ICQ Number :43-420-088
Comment
RawAlex

So Fucking Banned

Join Date: Oct 2003

Posts: 9465
Share

Post
#21

12-19-2004, 07:54 AM

Alex's hints for the day:

If you are still surfing with IE, delete that piece of crap and use Firefox instead.

If you are still accepting emails with attachments, set a rule that deletes ALL emails with attachments. Get a hotmail account, have people who really need to send you a file send it there instead.

If you are still accessing the internet without a firewall, get one.

If you run a program and pay these scumware / adware / scumbags for traffic, please take yourself out to the back of your house and put a bullet through your head. You paid to get everyone's computer fucked up.

Alex
Comment

Previous template Next

Working...