Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Internet Connection Problem. Possibly caused by malware? [RESOLVED]


  • This topic is locked This topic is locked

#31
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
Actually, my modem is a router as well.

As for WinsockFix, what do you mean by "internet connection settings" and "manual configuration"? Do you mean things like passwords?

Attached Files


Edited by AccidentalClick, 21 July 2008 - 12:17 PM.

  • 0

Advertisements


#32
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4

[-HKEY_CLASSES_ROOT\.magnet]

[HKEY_CLASSES_ROOT\Magnet]
@="URL:Magnet Protocol"
"URL Protocol"=""

[HKEY_CLASSES_ROOT\Magnet\Content Type]
@=""

[HKEY_CLASSES_ROOT\Magnet\DefaultIcon]
@=""

[HKEY_CLASSES_ROOT\Magnet\shell]
@="open"

[HKEY_CLASSES_ROOT\Magnet\shell\open]

[HKEY_CLASSES_ROOT\Magnet\shell\open\command]
@=""


Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

Restart the computer and see if your scanner is still picking anything up.
  • 0

#33
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
Done. I'm running the scan now.

Something has happened though. For some reason, my modem's wireless and internet lights are continuously flashing even when I'm not using the internet. And when I am, the internet from this end is extremely slow. Could some program be secretly using my internet connection and downloading stuff onto my computer? Should I post a new HijackThis log in case?

EDIT: Grokster's still there.

Edited by AccidentalClick, 23 July 2008 - 02:15 PM.

  • 0

#34
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
See if you can find those two magnet entries again in the registry....if so, export them and attach them here.

Confirm that the lights are still flashing by turning off all your computers. If it is, I suggest changing your SSID name and password. You might also want to change you WEP/WPA passwords (which I hope you're using) and enable MAC address filtering. You need to refer to your router's manual on how to do this if you are unsure. This is more for the Networking board if you need more help with it.

If someone is accessing your internet without your knowledge, they can do harmful things to your other computers on the same network. This is especially true if your computers are not password protected properly.
  • 0

#35
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
I can't find any "magnet" entries in the registry at all.

As for the networking thing, I'll get on it.
  • 0

#36
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
So where is the scanner picking up the Grokster entry now?
  • 0

#37
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
It's actually in the same place. hkey_classes_root \magnet
  • 0

#38
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Leave that key alone. Ignore the message found by your scanner. Uninstall Limewire and you should be set to go.
  • 0

#39
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
Well... I never had Limewire. I only had Azureus.

OK, now, regarding a previous question. After running smitRem, I now have to press Control + Alt + Delete before logging in. Why is that?
  • 0

#40
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Go to Start->Settings->Control Panel and click on User Accounts. Then click on the option that says Change the way users log on or off. Make sure the Use Welcome Screen option is checked.
  • 0

Advertisements


#41
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
Um, are you sure that's for Vista? I can't find it.

As for Grokster, could there have been another program that could have got it?
  • 0

#42
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Sorry about that....forgot you had Vista.

Go to Start->Run and type in control userpasswords2 and hit OK. Then click on Continue if you get a warning message. Go to the Advanced tab and make sure the bottom box there is unchecked so it doesn't require you to hit ctrl+alt+del before you can log in.
  • 0

#43
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
Ah, thanks.

Do you know exactly what the Grokster spyware does though, since we can't seem to get rid of it?
  • 0

#44
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I'm wondering if it is Grokster at all now since there is a legitimate magnet key in that location as well. It could just be a false positive. Keep the anti-spyware programs running in real-time and you should be fine.

If you want, run the following registry script also:

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.magnet]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Magnet]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Magnet\Content Type]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Magnet\DefaultIcon]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Magnet\shell]


Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

I wouldn't worry about it much.
  • 0

#45
AccidentalClick

AccidentalClick

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 132 posts
Well, OK, then.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP