What To Do When Spyware Attacks Q&A: Resolving Malware Infestations Ron Pacchiano
Q.
I have been battling with my PC to rid it of numerous adware and spyware infestations. The most difficult of these problems came in the form of a browser hijacker, which managed to bury itself deep into my system.
After hours and hours of work, it looked like I had finally succeeded in removing this parasite from my system. However, removing it did not come without a price. Since removing the hijacker I have no longer been able to browse the web using Internet Explorer. I can, however, still ping IP addresses outside of my gateway — I just can't browse them.
At this point, it appears that the only choice I have left is to wipe out the operating system and reinstall it. The problem is that after putting in all that time and effort, I just can't bring myself to wipe out the machine before exploring every other possibility. I was wondering if you have any suggestions that might help me avoid what I'm starting to think is inevitable. My PC is a Dell Dimension XPS running Windows XP Professional and is connected to a D-link router and cable modem. I hope you can help. Thanks!
A.
It sounds like you have a good knowledge of PCs, so what I'm about to say isn't going to surprise you. As you are now well aware, the number of PCs infected by adware and spyware is on the rise, and some of these applications can be incredibly difficult to get rid of. They entrench themselves deep into your system's registry, and when parts of them are removed, they automatically restore themselves.
My brother recently had a problem with a browser hijacker that just completely took over his system. Every time I thought I had removed all of its components, BAM! ... there it was again. I finally had no choice but to back up his data and reinstall the operating system.
And as much as I hate to be the bearer of bad news, I have a feeling that this will be your situation as well. However, since you can ping IP addresses outside of your gateway, maybe there is some hope. The only thing I can suggest is that you try running a utility I came across called WinSock XP Fix.
This freeware utility can sometimes be helpful in repairing the Windows XP network and Winsock settings that can often be damaged when attempting to remove adware or spyware from your system. It can also create a registry backup of your current settings, so it is fairly safe to use. You can find more information and download WinSock XP Fix here.
If that fails, I would suggest you just bite the bullet and redo the PC. I know it's a hassle, but you'll probably spend less time redoing the PC than you would trying to repair the damage caused by the hijacker.
The last thing I'd like to suggest is that after you get everything working correctly you check out this Q&A column. I wrote a few months ago on adware/spyware detection and removal. It contains a bunch of links to various utilities that can help you prevent this from happening again in the future. Good luck!
Q.
I have managed to network two home computers, both running Windows 98 Second Edition. However, I'm running a Symantec firewall, and I can't access the other computer unless I disable the firewall. How can I configure the firewall to let me use the network?
A.
The quickest and simplest approach would be to configure your firewall to not block any traffic from computers on your internal network. This would give you full and unfettered access to the other machine.
Alternately, you could open up the specific ports that you need in order to access the other machine. Of course, access is a generic term that could mean a lot of things, but chances are you're most concerned with accessing shared folders on the other machine.
If this is the case, you'll need to make sure that TCP and UDP ports 135, 137, 138, 139, and 445 are open. (Please be sure you enable these ports only for machines on the local network. You don't want these ports exposed to the Internet.)
Keep in mind that if you're running a firewall program on both machines, you'll need to configure both of them accordingly.
Q.
I have two routers — an SMC 7004BR and an SMC 7004VWBR. When I connect my cable modem to the 7004BR and then connect the 7004VWBR to the 7004BR via a crossover cable, the speed on the network is great. If I do the opposite and connect the 7004VWBR to the cable modem and then connect the 7004BR to the 70004VWBR, the speed is very slow. I want to keep the 7004VWBR directly connected to the cable modem because it has more features in the setup. Is there a reason why this configuration provides slower speed than the other method?
A.
The two pieces of hardware you're using, the SMC 7004BR and SMC 7004VWBR, are both broadband routers. They have nearly identical features, except that the latter includes wireless capability and has three LAN ports instead of four.
You're trying to use two devices that are essentially redundant. The difference in speed you're seeing is really a red herring, since you need only one or the other. I don't know how you're measuring the speed, but connecting two routers like this is bound to cause some problems.
If you remove the unneeded equipment from the equation, everything should work just fine. You should choose one device or the other, depending on what you're trying to accomplish. If you don't need wireless access, use the 7004BR. If you want wireless access, stick with the 7004VWBR. You could also use the 7004BR with a wireless access point — access points are made to compliment routers like this.
