After The Attack: No E-mail, No Web, Yet On-line

I'm on-line, can even ping a site or two, but see no webpages and can't find a host when trying to download my e-mail with Outlook Express. The ISP tech guy spent about two hours with me and gave up, saying "I've run out of ideas."

Here's the story: Out of the blue a got several spyware, adware, and whatever other pieces of crud attached to my computer.

(They were the n-Case, PAD 180 Solution Search Agent, Shopping at Home or some such thing and several viruses and worms as I found out yesterday after having installed two anti-virus and anti-spyware programs. I know, you think how could you not have had an antivirus program on your computer. Over the years I had had several packages running, back in them days, and found that setting them up, finetuning them and babysitting them took more time than anything else and I never got any viruses detected anyhow. Plus, I've never had a major profile ISP, susceptible to be a prime target, ever since I left Compuserve in about 1996. Well, it's different now ...)

The bottom line is the Windows 98 message I get informing me "Socket Error: 11001, Error Number: 0x800CCC0D".

Of course I have set and reset all the DSN and e-mail accounts settings ad nauseum, followed every piece of advice available on the Internet, including registry item searches and settings, etc. I've reinstalled Windows 98 ... and still, can't get any e-mail or see any html pages on the web, although I'm on-line.

It looks pretty gloomy here after having read other, more knowledgeable guys' descriptions of days spent at a friend's computer and finally just giving up the fight trying to fix the same problem.

Any incling out there of a possible solution or at least direction to where I might find the solution or at least an explanation of what is wrong and why it cannot be fixed?

Thanks for your precious time.

P.S.: I just found this promising piece of advice: URL

dazimon

Sounds like a Winsock error. Sometimes HijackThis is able to fix the problem. Consider posting a log.

Enable everything in MSCONFIG (if you have disabled anything).

Download HijackThis (link below). Make sure you install HijackThis to a permanent folder such as C:\HJT as it creates backups of what we will fix. Run the program, press Scan, press Save log. Notepad will open, copy and paste the entire log into your post. Do not fix anything yet, most of what's in the log is needed!

Tom

Thanks for your attention and advice. I really appreciate it.

Last night I was able to take advantage of the Microsoft site I mentioned in my posting above and take care of the problem. (There are 33 links to that Microsoft page on this site. Thank you all for sharing the results of your researches!)

I had to uninstall Dial-Up Networking and TCP/IP Files, then rename a slew of files. I was supposed to extract them again from the original Windows 98 CD. I was unable to do so, although I don't know why. Then I reasoned and decided that reinstalling Windows 98 from my upgrade CD should accomplish the same thing, i.e. extract the files from the cabinets, a.k.a. *.cab files. It worked.

Wednesday night, i.e. before I found the solution (How to Remove and Reinstall Dial-Up Networking and TCP/IP Files), I had already installed the free edition of AVG Anti-Virus and the Spybot-Search and Destroy program. The AVG found about 1,600 infected files among the 80,000 plus files on the system. I run it automatically every day now at 2:00 AM. It is scheduled to download an updated virus catalogue every two weeks. The Spybot-S&D also did its job removing spy- and ad-ware. Thank God for the white hats on the Internet!

Thanks for sharing your soultion.

Tom

Recently, I had the same problem. I could get online, but could not go anywhere. All I got, from IE, was "Cannot Find Server", and "This Page Cannot Be Displayed". When attempting Outlook Express, I got the same Socket Error that you did.

I also called my ISP Tech Support (3 different times talking to three different people). Nothing we tried would fix this. Finally, I was told to try reinstalling my "Communications Stack". I did, and it fixed the problem!

However, tonight...it happened to me again! Once again, I reinstalled the Communications Stack, but this time it did not fix the problem. I was able to get my IE to work but not my Outlook Express.

I had a theory about the cause of all this.......
Now, let me ask you something....Are you using a program called "Spyware Blaster"? I had recently installed it just prior to my original problem. Tonight, I ran the Spyware Blaster Update. Guess what? That's when my problem returned! On a hunch, I removed Spyware Blaster from my computer, restarted it, and the problem was instantly solved.

I don't mean to be insulting to the Spyware Blaster people, but apparently my computer doesn't like "something" about that program.

Sincerely, Cindy

Hi Montana Lady,

If you have the time, I would like to have you report the error to Javacool (the makers of Spywareblaster). If you do so, please share any info you might learn from them. This is the first complaint I have heard.

http://www.wilderssecurity.com/forumdisplay.php?f=23

Thanks,
Tom

Sorry for the delay in replying.

I followed your link, and posted a message to Javacool:
URL

I'll let you know if I hear anything.......
Cindy

Thanks Cindy,

It will be interesting to see how this pans out. Thanks for the link!

Tom

I officially take back what I said about Spyware Blaster - because a similar type problem happened to me (again) without Spyware Blaster being on my computer.

Yesterday, I discovered I was unable to send any email through Outlook Express. My IE 6 was working fine, and I could receive emails.

This time my error was: "The connection to the server has failed. Account: 'pop.nemontel.net', Server: 'smtp.nemontel.net', Protocol: SMTP, Port: 25, Secure(SSL): No, Socket Error: 10060, Error Number: 0x800CCC0E".

Once again, more calls to my ISP Tech Support. (I think I might know more than they do, and that ain't saying much!)

Anyway, through much trial and error, I discovered that if I unchecked my SSDPSRV in msconfig's startup it caused the Socket Error when trying to send email.

I had previously done some reading up on SSDPSRV, and there are a few reasons I wanted to remove it from the msconfig startup.

I read that SSDPSRV:
1) slows down the computer system
2) leaves port 1900 and 5000 open
3) could be safely removed in msconfig

When I added SSDPSRV back into the msconfig startup, I was instantly able to send my emails.

However, now I have two more problems:
Problem One - With SSDPSRV enabled, my port 1900 is closed - but my port 5000 is wide open.

Problem Two - I purchased, and installed "PestPatrol", and even with SSDPSRV enabled, I cannot send emails when I have PestPatrol running (while online). That's a bummer, because PestPatrol has a feature that automatically deletes "bad cookies" when surfing.

If I can find the answer for "Problem Two", I'm sure it would answer/fix the problem I had with Spyware Blaster.

In the meantime, I'm surely not liking my port 5000 being open!

Any ideas?

Sincerely, Cindy

Hi Cindy,

Have you contacted Pest Patrol regarding this problem? They might have the answer you are looking for.

As for port 5000 being open, Steve Gibson has written a small program to disable Universal Plug n Play (which leaves the highly exploitable port 5000 open). I use it along with his two other programs Shoot the Messenger and the DcomBobulator.

http://grc.com/default.htm

Tom

Here's more info on port 5000:
http://grc.com/port_5000.htm

Thank you so much for mentioning Steve Gibson! I know of him, but had forgotten all about that program to disable Universal Plug & Play (at will). I had already been to his site, long ago, and closed all my ports - but apparently that darn 5000 came open again when I reinstalled my communications stack.

Right now, I have everything functioning "OK". I've tried so many things, to remedy my problem, that I'm not even able to tell you what worked.

I've decided not to contact PestPatrol. For my needs, I do not need to have it running while online. I have another program called "Cookiem" that destroys all incoming cookies.

Sometime, this week, I'm going to reinstall Spyware Blaster, and give it another try. I'll have to let you know how that goes.....

In the meantime, thank you so very much for all your help. You are a very nice person!

Sincerely, Cindy

Hahaha!! I have been down that road too many times

Let us know how Spywareblaster goes!

Tom