Re: IE Links don't work

From: Jim Byrd (jrbyrd_at_spamlessadelphia.net)
Date: 11/21/04 

Date: Sat, 20 Nov 2004 23:00:52 -0800

Hi Weeble - First, activate XP's firewall (for inbound protection while
you're testing) and then disable (or even better, uninstall) everything by
Symantec, especially your firewall and AV. Symantec stuff is notorious for
interfering with both the installation and operation of other software,
particularly system software. See what that does for you.

Next, do the following in order:

#########IMPORTANT#########
Before you try to remove spyware using any of the programs below, download
both a copy of LSPFIX here:

http://www.cexx.org/lspfix.htm

AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257

or here for Win2k/XP http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm

The process of removing certain malware may kill your internet connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
to regain your connection.

NOTE: It is reported that in XP SP2, the Run command netsh winsock reset
will fix this problem without the need for these programs. (You can also
try this if you're on XP SP1. There has also been one, as yet unconfirmed,
report that this also works there.) Also, one MS technician suggested the
following sequence:

netsh int reset all
ipconfig /flushdns

See also: http://windowsxp.mvps.org/winsock.htm for additional XPSP2
info/approaches using the netsh command.

#########IMPORTANT#########

#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is fixed
after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

Clean Boot: 1. Start|Run enter msconfig.
2. In the Startup tab, click the "Disable All" button.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.
#########IMPORTANT#########

Sometimes the tools below will find files which they are unable to delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
"replacing, moving, renaming or deleting one or many files which are
currently in use (e.g. system files like comctl32.dll, or virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem

Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from the link
on this page: http://vil.nai.com/vil/stinger/ ME/XP users be sure to read:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, here: http://www.trendmicro.com/download/pattern.asp Be sure to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might also want
to get Art's updater, SYS-UP.Zip, here for future updating of these:
http://home.epix.net/~artnpeg/). (If you download and use the updater from
the beginning, it will automatically handle downloading the other files.)
Place them in a dedicated folder after appropriate unzipping. Show hidden
and system files (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
Disable Restore if you're on XP or ME (directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then boot to
Safe mode (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
Read tscreadme.txt carefully, then do a complete scan of your system
in Safe mode and clean or delete anything it finds. Reboot to normal mode
and re-run the scan again.

This scan may take a long time, as Sysclean is VERY extensive and thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.

If that doesn't fix it, then post back (but leave the Symantec stuff
disabled/uninstalled until you get things straightened out - there are
plenty of very good non-interfering replacements available, many of them
free.) 

-- 
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In news:E80B3BD4-FE4C-409F-86AA-74F7739C047A@microsoft.com,
Weeble <Weeble@discussions.microsoft.com> typed:
> Running WinXP, IE6, cable modem, no router, Norton firewall, NAV. MSN
> home page. When trying to connect to non Microsoft links such as Fox
> Sports, receive general network error. Using instructions from
> Sandi's site, have looked for and removed any Spyware. Used CCleaner
> to clean up temp files. Created a new user profile, but same error.
> Can click "repair" LAN connection which inconsistently fixes problem,
> but problem recurs within a few minutes. Have not deleted hosts file.
> Problem appeared to occur after loading SP2, so uninstalled, but
> problem persists. One virus scan picked up a backdoor.trojan and
> "could not delete". Repeat scan and removal tool did not find it.
> netstat shows about 14 or 15 ports open. Is that normal? Do I have a
> virus? Is my registry corrupt? Is my TCP/IP connection corrupt? Any
> suggestions?
Loading