Member Avatar for ultimatebuster

I recently got infected by a virus, somehow.

I have determined all the files associated to this virus that launches multiple background iexplore instances, and deleted all of them

However, the key dll file that's powering the virus is very resiliant.

It made itself the MSAFD Tcpip [RAW/IP], MSAFD Tcpip [UDP/IP], MSAFD Tcpip [TCP/IP], RSVP TCP Service Provider, and RSVP UDP Service Provider under the Layered Service Provider.

If i try to delete the file or the entry in LSP, it will simply disable all network related functions in windows.

The operating system is Windows XP SP3
The key DLL file is wspio.dll

Can anyone please look up their entry for the 5 above LSP entry and tell me the DLL file they point to? So i can restore them please?

Thank you.

  • 2 Contributors
  • 2 Replies
  • 197 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by ultimatebuster

Dani AI

Generated

This thread shows a classic Winsock/LSP provider infection: many files removed but the provider DLL remained attached to the Winsock stack, so deleting the file alone can break networking. As later indicated the problem resolved, and as advised, following the forum cleanup checklist and gathering logs is the right first move. The remainder below gives a safe, low-risk workflow and troubleshooting notes for LSP-backed malware removal that remain useful years later.

First steps: make a full system image and export any Winsock-related registry keys before touching the system. Physically disconnect the machine from the network (or disable the adapter) to prevent reinfection. Prefer an offline cleanup (boot to Safe Mode, Windows PE, or a rescue disk) and run up-to-date anti-malware and rootkit scanners. Only after the infection is neutralized should the Winsock catalog be repaired and the offending file removed.

Common repair commands (run from an elevated prompt; reboot after these):

netsh winsock show catalog
netsh winsock reset
netsh int ip reset
ipconfig /flushdns
ipconfig /release
ipconfig /renew

Use the catalog display to confirm provider entries before and after the reset.

If the catalog stays corrupted, inspect Winsock providers with a trusted tool such as Microsoft Sysinternals Autoruns (export the registry first) or perform an offline registry edit. Avoid deleting a provider DLL while it is still registered. If repairs fail, restore a known-good system restore point, perform a repair install, or do a clean reinstall.

Because Windows XP is no longer supported (end of support April 8, 2014), migration to a supported OS and keeping AV and definitions current are strongly recommended for long-term safety.

Recommended Answers

All 2 Replies

Member Avatar for jholland1964

Those requesting assistance should begin by following all the steps given here;
http://www.daniweb.com/forums/thread134865.html
and then post back in your thread with all the requested logs. Then somebody will be happy to offer assistance.

Member Avatar for ultimatebuster

nvm i figured it out

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.