A virus in Winsock LSP

system · 2007-10-04T23:16:01.000Z

Hi everyone,

I was browsing around and found an interesting website and started
reading. All of a sudden my AVG anti-virus warned of a virus which I
moved to vault right away. Again two more virus warnings and I moved them to vault and boom! I got disconnected from the Internet.
I ran HijackThis and it showed on 010 C:\windows\system32\laf1.dll
with unknown file.
It said there is an unknown file in Winsock LSP.
It says that removing references to missing files and repairing chain will restore Internet access and it sends me to a website to fix LSP.
I don’t know how to remove references to missing files or repair chain.
Besides, the computer have no access to the Internet so I can’t get to the website suggested.
What should I do?
I’m using other computer to post this.
Please, help me. Thanks a lot.

DavidR · 2007-10-04T23:25:13.000Z

Well I have no knowledge of AVG, after all this is the avast forum ;D ;D
Why are you using AVG (I hope your not using two resident AVs) ?

Some malware like newdotnet hooks into your internet connection settings and if it isn’t removed correctly it can cause you to lose your internet connection. So I have no idea what AVG did or if it didn’t remove the LSP hooks causing the connection to fail.

You could visit the web site with the computer your using now and download the lspfix tool and using a floppy/cd/or usb drive copy it to your other system.

For XP SP2, try Windows Start button, Run - type ‘netsh winsock reset’ without the quotes - this may be enough to fix the issue.
Check out this topic http://forum.avast.com/index.php?topic=21608.0, for non-XP SP2 systems http://cexx.org/lspfix.htm download the file and transfer to your system and run it there.

system · 2007-10-05T01:02:07.000Z

Thank you so much DavidR
I will try that tomorrow God willing.
I’ll let you know the results.
Thanks again, God bless you.

DavidR · 2007-10-05T01:03:12.000Z

Your welcome.

system · 2007-10-05T08:15:38.000Z

Please note that Avast provides the option to automaticly repair the winsock, and thats only one benefit of Avast over AVG.

If you are still intersted please let me know as I have a program that might be able to fix it.

Al968

igor0 · 2007-10-05T08:21:24.000Z

Well, avast! doesn’t repair winsock entries if they are already corrupted. But yes, if avast! is removing an LSP entry (because it detected the underlying file as malicious), it tries to fix the corresponding registry entries as well.

system · 2007-10-05T10:33:12.000Z

igor post:6:

Well, avast! doesn’t repair winsock entries if they are already corrupted. But yes, if avast! is removing an LSP entry (because it detected the underlying file as malicious), it tries to fix the corresponding registry entries as well.

Yes that’s what I meant
Avast makes a copy of healthy winsock entries and restores them anytime the winsock entries are corrupted so in order to work Avast needs to have working winsock entries to start with.

Al968

system · 2007-10-05T11:03:41.000Z

if you have superantispyware free it has a winsock fix

go to preferences then repairs

FreewheelinFrank · 2007-10-05T13:16:43.000Z

Getting infected by a drive-by download means you must have an out-of-date and vulnerable piece of software somewhere on your system.

Scan for out-of-date and insecure software using Secunia Software Inspector and update any vulnerable software: this will help to prevent future infections.

system · 2007-10-05T15:41:33.000Z

Well I have no knowledge of AVG, after all this is the avast forum Why are you using AVG (I hope your not using two resident AVs) ?

DavidR, you're gonna kill me. I had Avast in the computer and I read something about Avast ( I don't remember the whole information) and I deleted it from that computer but no from the other two computers in the house. Well you see I downloaded AVG and even though I sent the virus to Vault it caused the damage in winsock. Avast never let any virus unattended. I regret uninstalling Avast from that computer. Well the damage is done now. I tried what you said in "run" typing netsh winsock rest and it appeared the cmd black box and it disappeared . I then tried to get access to the internet and nothing yet. I tried repairing the network connection and it can't repair the ISP. Anything else I can do? Thanks a lot

DavidR · 2007-10-05T16:38:13.000Z

Although that command should be able to run from the Run window, you could type cmd in the Run window and once you have the command window open, type what I previously suggested (netsh winsock reset) I notice that you posted ‘netsh winsock rest’ with a missing ‘e’ reset not rest.

If you first open a cmd window and type the command the cmd windows doesn’t close after running the command, so if there are any errors/results then you will see them.

So if you entered that it would fail as it is an incorrect command.

If that doesn’t work, the only other option is to download the file lspfix.exe and transfer and run it on the effected system, but that should do the same as the command did.

Lisandro · 2007-10-05T17:11:26.000Z

haydee post:10:

I sent the virus to Vault it caused the damage in winsock.
I tried repairing the network connection and it can’t repair the ISP.

Click Start. In the Start Search dialog box, type: cmd, and right-click cmd.
Click Run as administrator.
Type: netsh winsock reset, and then press the ENTER key.
Type: Exit and press ENTER.

Or use: http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml
5. Restart the computer

system · 2007-10-05T17:51:06.000Z

Thanks a lot to both of you.
I will try to do that now. I have to disconnect this computer and connect the
sick one and try to fix it. I wrote down your instructions. I’ll be back.

essexboy · 2007-10-05T18:24:47.000Z

You could use LSP fix

If a malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

[*]Please download LSPFix from here.
[*]Run the LSPFix.exe that you have just finished downloading.
[*]Check the I know what I’m doing box.
[*]In the Keep box you should see one or more instances of laf1.dll.
[*]Select every instance of laf1.dll and move each one to the Remove box by clicking the >> button.
[*]When you are done click Finish>>.

system · 2007-10-05T19:43:47.000Z

Hi essexboy
I already did what DavidR and Tech told me and I got it. It said that winsock catalog was reset. I then unplugged the modem, reset the connection, plugged the
cable back and I finally got the Internet back.
Should I follow your instructions anyway ?

should I go to http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml as suggested by Tech, anyway ?

Thanks a lot.

system · 2007-10-05T20:14:50.000Z

Essexboy

You could use LSP fix

I did it. It didn’t find problems. That means
It got corrected.
I will keep it in the computer in case I get a similar problem
in the future.

I unistalled AVG but before that I went to Vault and
clicked in the 4 files with laf1.dll and clicked
“heal” and then clicked “restore”. I don’t know if that did
something. I know that after that the computer was still
not getting access to the Internet.
After I followed Tech and DavidR instructions and then reset the
modem I got the connection back. Wow, thank God!

I will download Avast back.

THANKS A LOT TO ALL OF YOU,
Receive my admiration.

DavidR · 2007-10-05T20:32:19.000Z

It you have got your internet connection back, the adage, “if it isn’t broken don’t fix it applies” so I would say you don’t need to do that.

That location that Tech gave is just another tool to similar to the lspfix.exe tool again if things are working I would say leave well alone. However it does other things than just repair the internet connections, so a visit wouldn’t hurt and if there is something you feel might be a bonus then the decision is yours.

essexboy · 2007-10-05T22:20:11.000Z

haydee post:15:

Hi essexboy
I already did what DavidR and Tech told me and I got it. It said that winsock catalog was reset. I then unplugged the modem, reset the connection, plugged the
cable back and I finally got the Internet back.
Should I follow your instructions anyway ?

should I go to http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml as suggested by Tech, anyway ?

Thanks a lot.

No if it works don’t touch it ;D

Lisandro · 2007-10-06T00:59:31.000Z

haydee post:15:

should I go to http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml as suggested by Tech, anyway ?

It’s not necessary… don’t mess 8)

Announcements