Wednesday, October 17, 2007

Cannot connect to the internet after removing trojan

A colleague receive an MSN message with a linkage to the site: www. blogo .tw (intentionally add the space to avoid the auto hyperlinkage). Once clicked, a trojan is installed to the PC. (Actually, 2 files added, 1 is the C:\WINDOWS\system32\od3mdi.dll and the other is C:\DOCUMENT AND SETTINGS\USER's PROFILE\LOCAL SETTINGS\Temp\RarSFX0\z.exe). Both files are detected by the anti-virus program and were quarantineed.

However, the headache does not finish. the user's PC cannot connect to the internet.
The other symptom is when trying to use the "ping" command, it replies with a ? and a loud "bit" sound.
Pinging ? with 32 bytes of data:
Reply from 192.168.1.89: bytes=32 time=15ms TTL=247

Finally, it is found that something wrong with the Winsock. TCP/IP stack is corrupted. When the trojon melware installed, it changed some Registry Keys. Antivirus programs, adaware or spybot removed the melware but not correcting the registry keys.

Solution: fix the winsock with winsockxpfix.

The tool works fine for the PC. The problem solved after launching the tool and reboot the PC!

Reference: http://www.iup.edu/house/resnet/winfix.shtm
http://272586.blogspot.com/2007/07/winsockxpfixie.html