HELP!!! i can't stop stuff from dling into my hdd

[beserker15]

Recently, one of my computers got a crapload of adware/spyware..etc...downloaded on it. i use ad-aware and pestcan's online scanner to identify everything. and then what ad-aware couldn't get rid of, i manually deleted (files and registry settings). i guess i might've deleted something wrong, because now that computer cannot connect to the internet (via cable or dial up). calling comcast, they told me it might be a socket error in the OS and that i have to find someone who knows about fixing it. my local network thing reports "limited or no connectivity". please help me find a way to fix this issue. (FIXED -thanks redbeard1)
Now I need help getting rid of this annoying trojan downloader...

 

[redbeard1]

IF your sockets are hosed this will usually fix it. Though it says winsockxpfix, it works on 98, me, and 2000

Winsock fix

 

[beserker15]

hey thanks, i'm back online now...only problem is that a crap load of stuff gets dled on to my hard drive after a while... after running ad-ware, spybot s&d, nod32....i was able to get rid of all the detected malware except for the one that nod32 reports as being in the operating memory and cannot do anything about it. is there a way to get rid of this? nod32 reports it as TrojanDownloader.Qoologic.B

 

[mechBgon]

What do you have for:

1. antivirus software (be specific, like "Norton Antivirus 2004 with the 9/30/2004 defs" and not just "Norton"). If you don't have any at all, say so.
2. operating system (WinXP, Win2000, ???) and what state of patching it's in (behind, current)
3. firewall software (WinXP firewall, ZoneAlarm free, Norton, whatever)
4. firewall hardware (router such as the popular Linksys BEFSR series or whatever, or none)

Also, do you have a known-healthy computer available that you can use to download stuff safely?

 

[redbeard1]

If you know the file that you need to remove, you can boot into safe mode and try and delete it.

 

[beserker15]

my antivirus is NOD32, OS is Winxp SP2, firewall is the one that came withh SP2, and i'm directly connected (no routers or hubs). i dont know the specific file...but whatever it is...it is able to bypass ad-aware, nod32, a2 guard, sybot s&d and a couple of online scanners. it would download stuff like My Daily Horroscope, or ebay and amazon links. and it shows pop ups every 1-2minutes. and sometimes....it would install the annoying internet optimzer and web rebates...

 

[redbeard1]

Check Shadenfroh's guide to spyware removal in the software and applications forum. You might post something there too.

 

[mechBgon]

Sounds nasty 🙂 If it were mine, I would blow away the whole WindowsXP installation and start from the top using best practices the whole way down. I suggested some good practices here, starting with the getting-started-the-first-time stuff and then the Ongoing prevention section, and it's not likely you're going to catch anything if you really do set it up like that, with a Limited account for your regular usage and so on. Notice the instructions on how to enable Data Execution Prevention for all software there, by the way.

If you want to stand and fight, then be aware that there's stuff that you cannot get rid of while Windows System Restore is active. You may want to look at the virus-removal suggestions that are below the Ongoing prevention stuff, for some useful links on disabling System restore and so on. And there's a link to Schadenfroh's advanced virus/adware removal & prevention guide there too.

 

[redbeard1]

Another thing to try would be to download Antivir anti virus. Save it and then reboot into safe mode. Install it in safe mode, but do not let it reboot, and enable scan all files. After the scan is done, uninstall it so you don't run two anti virus programs when you boot into normal mode.

 

[beserker15]

hmm...i might try those. i've ran all my stuff in safe mode and i guess it all still missed something because occasionally, some stuff still tries to dl into my computer. for now, i'm just using the computer normally...just with task manager open so when some dl starts...i can end task right away.