1

My apologies if this is the wrong place. I've been looking for a solution to this problem and it seems that this is a website that gives a lot of great technical advice.

This morning I noticed that my system was a lot slower than usual, so I ran Iobit's virus scan and removed 3 trojans. After removing the trojans, I found I was no longer able to load any pages in Firefox, Chrome, or IE; which was odd, since I was able to connect to the Internet just fine. I was able to access other programs like Steam and my SVN client that depend on Internet connectivity. In my browsers, I simply could not load any pages, not even any scripts I was testing on my localhost.

I checked the networking options in each browser and verified that it's not connecting through a proxy. I'm using Windows 7 and also verified that in my connection settings only the 'automatically detect' option is checked.

Oh yeah, I also ran two more anti-virus programs, Malwarebytes and Avast, and both confirmed that my system is now virus free.

I'm really at a loss for what to do now.

Improve this question
1
  • What errors do you get?
    – soandos
    Jul 22, 2011 at 2:36

4 Answers 4

Reset to default
1

If the malware is a rootkit, running a scan with an AV or other tool after boot may not help. Can you remove the drive and connect it to a system known clean and with good AV tools. Direct connect or in an external USB (or similar) would be good. There are also a number of boot disk tools that would work

Also look at system restore. Many malware programs "hide" in system restore and re-install on reboot after you think you are clean. Turn off system restore before running your various tools.

Improve this answer
6
  • Turning off System Restore is a double-edged sword, and while sometimes that is necessary, I would only turn off System Restore as a last option. Fewer viruses hide there, than do damage that can only (for most people) be undone using System Restore.
    – KCotreau
    Jul 22, 2011 at 2:53
  • Do you have some stats on that? Many AV vendors list turning off system restore as the first step in removal. I have seen many cases of this and missing that step cost the user additional grief.
    – Dave M
    Jul 22, 2011 at 12:02
  • I do not have stats, just anecdotal evidence. I remove viruses successfully all the time, and I have NOT ONCE had to turn off System Restore. I would consider it after a successful removal to clear out any potentially bad shadows. By contrast, if you read this forum daily, you read about people, who have cleaned a virus, but this or that does not work any more. Often those problems can present a HUGE difficulty to anyone one incredibly technical. System Restore may be the only way for them to successfully recover. I would also say that if you have really removed the virus files,...
    – KCotreau
    Jul 22, 2011 at 12:41
  • even if you restore the registry using System Restore, and it did actually still contain viral entries, it may indeed re-introduce registry keys that try to load the virus, but the reality is that if you deleted the virus' executable, you are probably OK. A subsequent scan or registry cleaning using CCleaner can take care of that. It all comes down to this: In computers, we fix problems by doing easy things first (not really applicable to viruses), but then we go with what is most probable. My experience just says that you are more likely to need System Restore to fix things than it is...
    – KCotreau
    Jul 22, 2011 at 12:45
  • likely to restore your virus. This is especially true if you go back far enough with your System Restore. There may be people, who disagree, but this is my experience and opinion.
    – KCotreau
    Jul 22, 2011 at 12:47
0

Now that you are clean, I would try a system restore to a point that you know was clean.

Also, you might want to check your HOSTS file to make sure there is nothing funny in there.

This will not fix it, but I would uncheck that "Automatically detect settings" in the IE proxy area. 99.9% of all people don't need any of them checked, and it just slows things down.

Improve this answer
6
  • 2
    Some rootkits and other malware tamper with system restore. System restore should probably therefore be purged of restore points - no such thing as known clean after an infection.
    – Stephanie
    Jul 22, 2011 at 4:14
  • @Stephanie That is possible, but happens less often than it just screws up settings that are hard to fix. Read my comment to Dave M's post. Your comment "no such thing as known clean after an infection" is just wrong. Most viruses I clean are indeed clean and gone when I am done. Sorry, but I disagree.
    – KCotreau
    Jul 22, 2011 at 4:29
  • @KCotreau You have a poor grasp of System restore. A System Restore could get him reinfected but with browser access. That may not be a bad thing 'cos he may be able to remove the malware without losing browser access. A System Restore at best can only be expected to just disable the malware. This line you wrote doesn't even make much sense "Now that you are clean, I would try a system restore to a point that you know was clean." System Restore is a first thing I'd try. Ultimately it should be turned off and on though, to clear thus truly clean System restore.
    – barlop
    Jul 22, 2011 at 16:24
  • @KCotreau You think you know more than you do. You don't know a computer is clean after some malware got on it..unless you reformat.. or perhaps just remove windows. You could say it's clean enough. But to suggest that pushing back system restore to a point that was ok, that CLEANs the system. No it obviously doesn't.
    – barlop
    Jul 22, 2011 at 16:27
  • @barlop "You think you know more than you do." Funny, I was going to say the same about you. Like I said before: Feel free to leave an answer, but leave me alone.
    – KCotreau
    Jul 22, 2011 at 23:23
0

Try a utility like this one:

http://techchand.org/559/repair-windows-xp-network-errors-with-winsock-tcp-repair-utility

I don't know if that particular one works or not. But I recall about a year ago, I had a similar problem following a malware infection. I solved it by running a program like the one I referenced above.

Improve this answer
0

In addition to the other solutions, there may still be entries for a layered service provider (LSP). LSPs are basically a way for applications to insert themselves into the networking stack before normal applications, so that they can modify or snoop traffic.

netsh winsock reset from an elevated (administrator) command prompt may fix it if this is the case.

Improve this answer

You must log in to answer this question.