Prev: Fake/Rogue AV causes Internet connection failure for infected prof
Next: Virii
From: Etal on 3 Feb 2010 23:09
E-Double wrote:

> A machine recently was infected with that fake/rogue AV virus/spyware
> program. The machine has been cleaned manually and by using numerous AV and
> spyware programs including Avast, Symantec, Spybot S&D, SuperAntispyware,
> Malwarebytes, Ad-Aware, Windows Defender, etc... (most in Safe Mode as well
> when possible) and was also checked for rootkits. The machine runs great for
> other users/profiles, and all of the AV/spyware scans are coming-up clean.
>
> But when the user who was using the computer when it got infected logs on
> with their profile the machine is unable to make any connections to the
> Internet with any applications. It is not just WWW port 80 traffic but all
> Internet connect traffic including POP2, SMTP, etc...
>
> It appears as if some remnant of the virus is hijacking the Internet
> connections or something (not sure if it is just Internet traffic or all
> local traffic as well). Is there any way to solve this issue w/o deleting
> that user's profile and recreating it ? The reason I say that is that there
> have been similar problems with machines that are offsite so it is harder to
> either reinstall Windows or recreate the profiles for these machines.
> Cleaning the machine is the best (and sometimes only) option we have in these
> cases. TIA ...

And the OS and OS-version is?


(Some of the tools you used may include a WinSock repair command.)


Else if WinXP >= SP2
Start : Run... :
Cmd.exe
(In the Command Window Type:)
(NetSh.exe /?) <- This if you want to see a description
NetSh.exe WinSock Reset

Reference: <http://support.microsoft.com/kb/299357>
How to Reset Internet Protocol (TCP/IP) in WinXP



If WinXP >= SP3 there is also:
%WinDir%\Network Diagnostic\xpNetDiag.exe



And there is also testing what effect disabling any Software
Firewall running under whatever OS the machine has.


--
Nah-ah. I'm staying out of this. ... Now, here's my opinion.

Please followup in the newsgroup.
E-mail address is invalid due to spam-control.
 | 
Pages: 1
Prev: Fake/Rogue AV causes Internet connection failure for infected prof
Next: Virii