Post-virus problems 1

[Crundy]

Hello,
A friend of mine contracted the Klez.h worm from an e-mail and asked me to help him clean it off. I did so using the command-line McAfee tools.

Problem is, now it seems that DNS lookups on his machine arn't working: The browser cannot find e.g.

http://www.microsoft.com

or any other site by name, but it can get to servers using their IP address.

The same is true of his mail program (as he has his mail servers set up to mail.isp.com etc) and they report that they cannot find the mail servers.

Does anyone know what's up? Is it perhaps something to do with wsock32.dll? C:\DOS:>
C:\DOS:>RUN
RUN DOS RUN!!

 

[darranagl]

You can do a WINIPCFG (Start, Run, type WINIPCFG) and see if the DNS addresses are present. If they are not, you can enter them in the TCP/IP properites of Networking (Control Panle).

The above is more of a work around, I would do the following...

Have you tried removing the Dialup Networking (Dialup Adaptor) and the connections to the ISP?

Go into the Dialup Networking and delete all the connections to ISP's (remember to note down the phone numbers etc). Open the Control Panel and go into Add/Remove Programs. Click the Windows Setup tab then open Communication from the list. Untick Dialup Networking and OK the windows.

Open Networking and make sure the Dialup Adaptor, TCP/IP and Client for MS Networks are gone (delete them if they still appear). Reboot the PC.

Now put the Dialup Networking back (in the Add/Remove Programs / Windows Setup / Communication) and setup the connections to the ISP.

If this doesn't work try updating your DUN (download from Microsoft).


New Zealand, a great place to live.

http://www.southland.org.nz

tokala@orcon.net.nz

 

[Neo81]

yeah the KLEZ virus really mucks up all networking ..... you really need to unistall all networking stuff and reinstall it cause Mcafee does not clean the files that are infected it just deletes them..... therfore if there were any infected networking files they are dead..... have you got rid of the registry edits that KLEZ puts in the registry of course where else would it put a registry edit !! Doh anyways try that ......


Later
NEo81 >:O>

 

[Neo81]

p.s might also be a good idea to reload Mcafee, Klez mucks around with that too.....


Later
NEo81 >:O>

 

[rattlemouth]

I would uninstall mcafee and try downloading a demo of norton2002 I just ran into basicly the same prob. and found that my mcafee had been disabled by the virus and wasn't doing anything .norton removed the virus and I got the computer back up and running , I'm not claming one to be better than the other it just worked for me.
Rattlemouth.

 

[Crundy]

I've already removed it though, so I can't undo the damage McAfee did using Norton unfortunately. I'll remember that in the future though. C:\DOS:>
C:\DOS:>RUN
RUN DOS RUN!!