AdAware removed something important . . .

[Golgo13]

I recently installed Audiogalaxy Sattelite (pretty sure it's the culprit), and along with it came the WebHancer spyware. I used AdAware last night to remove WebHancer from my computer, and now I can't access the internet from my computer at home, and here I am at school trying to figure this out .

Programs that try to access the internet now give me a "can't create socket" error, and IE gives me a DNS/"page cannot be displayed" error when I try to load web pages. I'm really kicking myself for not making a log of what AdAware deleted, because now I'm stuck as to what file(s) I removed. I've already checked for vtcp.386 and wsock32.dll , and they're still there. I also had a back-up registry file from a few days ago (before I installed Audiogalaxy), but that didn't fix the problem. If anyone has any ideas as to what files I might need to restore, that would be great.

My next solutions I have in mind are reinstalling Audiogalaxy satellite, and retracing my steps, or to remove TCP/IP Dial-Up adapter from my network settings and reinstall it. After doing all that, and it still doesn't work, looks like I'll have to reinstall Windows.

It's not like reinstalling Windows is a big deal, I'd just not in the mood to spend my entire afternon and evening fooling with it. I'm sure there's just one or two essential files that got deleted by AdAware, and if someone could help me figure those out, that would be extremely helpful. Thanks very much in advance!

 

[djfromla]

There is a system file checker that comes with Windows...
First go to Start>Programs>Accesories>System Tools
Select: System Information
Select: Tools
Select: System File Checker
Select: Settings

Make sure you check the boxes at the bottom
-Check for changed Files
-Check for deleted Files

Make sure you have your Windows CD just in case you need to replace any files... it will ask where to get the missing file from and you need to direct it to the location in the CD where the "cab" files are, usually in x:\win98 directory... x being your CD-Rom drive letter...

 

[Golgo13]

It comes with Win98 SE, correct?

 

[Golgo13]

Nevermind, dumb question. Thanx for ur help

 

[Jestr1]

Ok, I found it! I discovered I came upon the same situation as the person leading this thread. After tons of screwing with Windows apps such as the one mentioned above (thank you for the advice, though - it always helps to have new tools) I found that there was really no finding the source of the problem. If it had taken more than a day or two, I would have probably reformatted since I had just installed W98 from scratch over the weekend. But, as things went, I wanted to figure it out... First, I ran this program "Adaware" to get rid of the Kazaa spyware. I'm not really sure I trust it, but then again I would have to do more self-sacrificial experimentation to be sure. Anyway, after running the program, I tried to run it a second time only the dialect was GERMAN... Weird... Anyway, I couldn't read the German so I was forced to try alternate methods. I kept getting 2 errors:

1.) Windows socket error: API call "current"
2.) Windows socket error: API call ASynclookup ...(10049)

or something pretty close to those...
I tried removing keys and values from my registry for all things matching "Cydoor", "Kazaa", and "Brilliant Digital", tried going back to Internet Explorer 5.5, tried uninstalling Internet Explorer 6.0. I reinstalled IE 6.0.
I Uninstalled Kazaaa and Adaware. Nope, nothing. So it was time to break out the guns. I finally used Norton Antivirus after updating with the 05-20-02 update and rebooted. No more message, no more problems... because I deleted a virus that it found by the name of "Hacktool.Flooder" I love you Norton! Immediately after I deleted it, I got an error message about a missing link to a file called "modulate.exe". Who knows what that file is for, but it's sounding awfully suspicious to me. I have a router and I think that the program that it found that was the virus might have been trying to access a port that it couldn't use because of the router. I would love to hear from someone that is an expert on routers to tell me if this would be a possiblity... I'm just so happy to be rid of all of those annoying windows!!!

 

[Sinner]

OMG that is hilarious... HAHA!!! ummm next time dont use ad aware...

 

[TheOldMan346]

I don't think it was AdAware that caused the problem. Webhancer, Morpheus, Kazaa and such are loaded with spyware and the spyware is like opening the door to hackers. AdAware does an excellent job of detecting most of these pests but you can not always just let it rip. You have to look at the results and sometimes take additional actions. If you've gotten a virus on top of that, the situation is complicated significantly. Generally, when you are having problems, it is the best approach to do a full scan with updated virus defs and then use AdAware.

Here are the removal instructions for Webhancer.

http://www.mvps.org/inetexplorer/Darnit.htm#Webhancer

 

[Kento]

Golgo13, try extracting a new wsock32.dll using system file checker.

http://users.erols.com/dj-paulen/ss/

 

[Kento]

I just noticed the date on the original post. I'm sure this problem has been fixed by now.