Перейти к содержимому


Фото
- - - - -

"lsp Hook Not Found."


  • Please log in to reply
17 ответов в этой теме

#1 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 17 Апрель 2010 - 00:24

After clearing out a lot of infections, my Dr. Web installation doesn't seem to be booting properly. On Windows boot, I get "SpIDer Mail Error: LSP Hood not found. SpIDer Mail can work only in "manual" mode."

Also, SpIDer Guard shows a red shield. What is the best way to get the system working properly again?

Thanks,

Maria.

#2 drumut

drumut

    Member

  • Moderators
  • 325 Сообщений:

Отправлено 17 Апрель 2010 - 03:00

Hello,

Could you please upload a HJT log here please?
OS : Debian Sid , all i have all i need!

#3 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 18 Апрель 2010 - 01:52

It's very messed up again, with millions of popups and so on. I can boot to safe mode but when I get there I can't run any .exe files (they've all been reclassified as "sec files"). I've been a week trying to fix these two machines and though the backdoor tdss.565 is gone, there are a host of new ones, seemingly.

#4 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 18 Апрель 2010 - 02:52

I managed to run ComboFix (HJT would not work) and then ran HJT after that. Log is attached. HJT gave error message stating could not write to Hosts file, with instructions for replacing Hosts file, but that did not work either.

For the moment machine is running okay with no popups.

Thanks in advance for your help.

Прикрепленные файлы:



#5 account has been deleted

account has been deleted

    Massive Poster

  • Posters
  • 2 837 Сообщений:

Отправлено 18 Апрель 2010 - 03:14

You have a very ancient system. Download and install SP3 and all recommended updates for Windows XP.
www.surfpatrol.ru

#6 drumut

drumut

    Member

  • Moderators
  • 325 Сообщений:

Отправлено 18 Апрель 2010 - 03:33

Hello,

There is one thing i need to be sure. Except this your log seems ok.

Please upload "C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe" file to virustotal and paste your results.

Also you need to know for your future entries, hjt should be last version which is 2.0.2 and it should be installed to your system.

Download and install SP3 and all recommended updates for Windows XP.


+1
OS : Debian Sid , all i have all i need!

#7 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 18 Апрель 2010 - 06:19

Thanks very much for your help. I know, this is an old machine!! It has a lot of old programs and files that I still want very much.

I installed SP3 and also the latest HJT, log attached. No more LSP Hook error, but now the Dr. Web icon has disappeared entirely and when I tried to reinstall, it was interrupted with "failure to disable self-protection" error. How can I reinstall the Dr. Web anti-virus software?

Thank you again,

Maria.

p.s. virustotal shows file has already been analysed with result 0/42, is that okay?

Прикрепленные файлы:



#8 drumut

drumut

    Member

  • Moderators
  • 325 Сообщений:

Отправлено 18 Апрель 2010 - 10:01

No more LSP Hook error

Because somehow winsock LSP hook removed, please see your first log and O10 entry.

virustotal shows file has already been analysed with result 0/42, is that okay?

That is ok.

How can I reinstall the Dr. Web anti-virus software?

First you need to uninstall it completely you should use dr.web remover.
OS : Debian Sid , all i have all i need!

#9 account has been deleted

account has been deleted

    Massive Poster

  • Posters
  • 2 837 Сообщений:

Отправлено 18 Апрель 2010 - 16:02

I know, this is an old machine!! It has a lot of old programs and files that I still want very much.

The age of your computer, for us a little exciting circumstance.
But the system (OS) should always be relevant. Please use the council drumut and do not forget to save your license key before removing the dead version of DrWeb.
Upgrade your system to the current state, download a fresh DrWeb according to your license and install the DrWeb.
Do not forget to write how everything went. :)
--------------
remover for DrWeb x86
Dr.Web commercial programs and free utilities
www.surfpatrol.ru

#10 mrbelyash

mrbelyash

    Беляш

  • Helpers
  • 25 897 Сообщений:

Отправлено 18 Апрель 2010 - 16:18

if need reinstall drweb lsp hook

Start-run,paste
rundll32.exe "C:\Program Files\DrWeb\drwebsp.dll" uninstall
OK
Reboot
Start-run,paste
rundll32.exe "C:\Program Files\DrWeb\drwebsp.dll" install
OK

Reboot

Tadaaa...

wiki https://drw.sh/endjcv | Утилиты https://drw.sh/dgweku | Лечить удаленно https://drw.sh/wmzdcl | Скрытые процессы https://drw.sh/tmulje | Логи https://drw.sh/ruy | Песочница https://drw.sh/exhbro


#11 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 19 Апрель 2010 - 23:46

Thank you so much for all your help with this.  I ran the uninstaller, which prompted for a reboot, and then installed a clean version.  However I am still having the same problem--install goes all the way through several screens and then returns failure to turn off self-protection.

If there's a registry entry that needs changing, I am not scared of that.

Thanks again, so much!

Maria.

#12 drumut

drumut

    Member

  • Moderators
  • 325 Сообщений:

Отправлено 20 Апрель 2010 - 00:10

Hello,

Could you please attach dr.web logs? You can find them in directories listed below.

C:\Program Files\DrWeb
C:\Users\username\DoctorWeb


Do you have same issue with other security applications? Did their setups corrupted? For instance you can try to install spybot search and destroy which is freeware.

From your hjt logs i can say that you have some orphans and they can be removed or not, it is up to you.
OS : Debian Sid , all i have all i need!

#13 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 20 Апрель 2010 - 02:42

Dear drumut

Thank you for your kind note.  I attach the only dr.web log I could find (was written to a rather odd spot, actually, not in the directories you named; is this to do with my old OS?)

As for HJT cleanup, I totally trust you guys and am willing to try anything you think might help. For the moment this machine is running just beautifully, faster than ever, in fact.

Best regards and thanks again

Maria.

p.s.  I will give the spybot installation a try, and report back.







Hello,

Could you please attach dr.web logs? You can find them in directories listed below.

C:\Program Files\DrWeb
C:\Users\username\DoctorWeb


Do you have same issue with other security applications? Did their setups corrupted? For instance you can try to install spybot search and destroy which is freeware.

From your hjt logs i can say that you have some orphans and they can be removed or not, it is up to you.

Прикрепленные файлы:



#14 Maria Bustillos

Maria Bustillos

    Newbie

  • Posters
  • 10 Сообщений:

Отправлено 20 Апрель 2010 - 04:12

 Spybot SD installed and ran fine, but installation for dr.web still stops in the same place.

#15 drumut

drumut

    Member

  • Moderators
  • 325 Сообщений:

Отправлено 20 Апрель 2010 - 08:52

Hello,

Please follow these steps

Before doing this i recommend you to download erunt and backup your registry.

1-) Start -> Run -> Regedit
2-) Search for this key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Inprogress"
3-) If you find a key in this location, you can delete it and restart your computer.
OS : Debian Sid , all i have all i need!

#16 Baron

Baron

    Newbie

  • Posters
  • 17 Сообщений:

Отправлено 20 Апрель 2010 - 14:41

Spybot SD installed and ran fine, but installation for dr.web still stops in the same place.


Hi Maria,

I know from previous posts you have an old system. Did you update it to SP3 yet? One thing you could try is install the latest Microsoft Windows Installer package which is not distributed through Windows Update but you can download it from here:

http://www.microsoft.com/downloads/details...;displaylang=en

There is a list of downloads and the one for XP is the last one listed. It's worth doing this as it could solve your installation problem and even if it doesn't it will do no harm to be up to date. You need to be at least at SP2 level to do this upgrade so if you are at SP1 then forget it.

Regards
Paul

#17 mrbelyash

mrbelyash

    Беляш

  • Helpers
  • 25 897 Сообщений:

Отправлено 23 Апрель 2010 - 20:27

Hello,

Could you please attach dr.web logs? You can find them in directories listed below.

C:\Program Files\DrWeb
C:\Users\username\DoctorWeb


Do you have same issue with other security applications? Did their setups corrupted? For instance you can try to install spybot search and destroy which is freeware.

From your hjt logs i can say that you have some orphans and they can be removed or not, it is up to you.


Tool for search drweb logs

wiki https://drw.sh/endjcv | Утилиты https://drw.sh/dgweku | Лечить удаленно https://drw.sh/wmzdcl | Скрытые процессы https://drw.sh/tmulje | Логи https://drw.sh/ruy | Песочница https://drw.sh/exhbro


#18 drumut

drumut

    Member

  • Moderators
  • 325 Сообщений:

Отправлено 23 Апрель 2010 - 22:42

Hello Mrbelyash,

I think we need to open a new thread for this. Please continue from here. :)
OS : Debian Sid , all i have all i need!


Читают тему: 1

0 пользователей, 1 гостей, 0 скрытых