Spyware hijacked TCP and UDP on WinME - help?

General Questions
#1

OK, so I was helping my girlfriend clean off the spyware from her Windows ME computer this weekend… found something like 900 individual spyware components using Ad-aware. So, without thinking, we just deleted all of it. Bad move. We used the permanent delete, because, you know, who would ever want to bring the spyware back? Right? Wrong.

After a look through the list of exactly which spyware programs were found, I think the problem was in a certain spyware from “New.net”, which installed TCP and UDP “filters”. After its removal, 99% of the Internet now doesn’t work. (AOL works, for some reason, but no web pages - does it have its own non-TCP protocol?)

Some of the solutions I’ve tried are the WinME System Restore feature, uninstalling and reinstalling all Windows networking components, reinstalling and upgrading AOL, and searching the registry and verifying nothing in there makes any reference to the New.net files. Nothing worked. So, I find myself in a bit of a pickle here - just when I thought I would catch up with the deluge of spyware, I ran into problems that resisted all the effort I mustered. I don’t really relish the prospect of reinstalling Windows, which is the logical next step. Does anyone know how to get the TCP/IP stack back in working order without resorting to that?

#2

Perhaps uninstalling and re-installing the TCP/IP stack will solve this. I’d like to give you intructions on how to do this, but I only know how with Win 98 (and it’s been so long I’d hesitate to try to remember them anyway). Perhaps a Google search will find instructions how to do it win Win ME.

#3

As far as uninstalling/reinstalling the TCP/IP stack: I went into the Network properties control panel, and uninstalled and reinstalled Client for Microsoft Networks, the Dial-Up Adapter, and all installed TCP/IP items. It didn’t help. Is what I did right, or is there another, correct way to reinstall TCP/IP?

Thanks for your help!

#4

New.net is a real bastard to uninstall properly and so far I’ve had to bail out a friend, my brother, and his friend after Ad-aware screwed up the uninstall.

Go here to find a winsock util called LSP-Fix that will, hopefully, solve your problem. The page also contains instructions on what to do if Ad-aware has already made a mess of things.

Good luck.

#5

Make sure you are using the latest version of AdAware, which is ver. 6.181. Version 6.160 had a known problem that could damage your winsock. This has been corrected in the current version.

http://www.broadbandreports.com/forum/remark,7270391~root=security,1~mode=flat

#6

You might want to go into Windows Setup under Add/Remove in Ctl Panel and uncheck Communications… reboot… go back in and recheck it (preferably I would just check hyperterminal and dial up networking within it), reboot again.