1

Few days ago I noticed a new software in my computer named "lavasoft webcompanion". I have no idea from where it came. I have never installed anything from lavasoft. So, I uninstall the program.

Today I notice few ads at the beginning of my Google search result. These ads are not from google. So, I open Firefox with procexp. I find a dll named lavasofttcpservice.dll loaded into firefox which is located in C:\\Windows\SysWOW64\ directory. This dll seems suspicious to me because I have removed a program from the same company few days ago and it is loaded in almost every program running in my system. I try to remove it but system prevents me as other programs are using it. I try to rename it and it successfully renamed into new name. Then I restart the program and remove the dll from the computer. I also notice another dll in C:\\Windows\system32\ with name lavasofttcpservice64.dll (cann't remember the name exactly). I delete it in same process.

But next time I restart my computer, open Firefox and try to browse a website, but it does not work. When I type a web address and hit Enter it does nothing but clear the address bar. I can't even login to Skype. Icon in my task bar was showing I have Internet access.

I have Internet access but no application can access the Internet. Any thought on troubleshooting will be appreciated. I am having this problem on a Win7 x64 machine.

  • I am sorry for posting it in the wrong place. Should I duplicate this question in superuser? – army007 Sep 9 '15 at 17:17
  • You have 2 options: you copy/past this one there and come back to delete this one. Or wait until 5 users vote to close and immigrate your question there. This last option is bad if you can/do not want to wait. – user414649 Sep 9 '15 at 17:18
  • The product you had installed was "watching" your secure http connections, which means, you were/are using a proxy. If the product is no longer installed, that means, the proxy no longer exists thus the internet would appear to be down. The program you installed wouldn't have been installed without user confirmation by the way. – Ramhound Sep 9 '15 at 17:26
  • 1
    @ardaozkal - Lavasoft Webcompanion isn't malware. It is a commercial product that would have only been installed with a confirmation by an actual user. – Ramhound Sep 9 '15 at 17:33
  • 1
    @Ramhound - I have not consciously installed Webcompanion, but I have uninstalled the program consciously. I am somewhat confused here - why a software would leave some dll in my system directory after being uninstalled ? – army007 Sep 9 '15 at 17:57
4

@army007 The dll was a part of Lavasoft Ad-Aware Antivirus or related product of Lavasoft LTD( http://www.lavasoft.com/ )

Make sure you don't have Ad-Aware installed in your machine. If yes, its probably missing a dll file now.

The issue of unable to connect to internet via any applications is because removing manually the lavasofttcpservice.dll from those folders corrupted your winsock LSP entries.

To restore follow execute the following commands: Click the 'Start' orb on taskbar > Start > All Programs > Accessories , right-click Command Prompt , click Run as administrator > Allow if UAC prompt comes up > Enter password if asked. Now enter the following in the black command prompt window:

netsh winsock reset

and restart the computer.

Remarks: Resets Winsock Catalog to a clean state. All Winsock Layered Service Providers which were previously installed must be reinstalled. Some firewalls and programs add entries to winsock.. So if you face trouble with such programs after resetting, you should reinstall them. Only windows related entries will be restored after reset.

Inorder to prevent ads in your browser, use addons like ublocker, adblockplus, noscript etc.


PS: This is my first ever post in the community, so if there is any issue with post contents, kindly warn me...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.