8 replies to this topic

[BradHubbell]

Is it possible to get a copy of the newest rules on one computer, put it on a jump drive, and then move it onto the infected computer so I can get rid of Spyware Guard 2008?

Any effort to update on the infected computer gets blocked.

My version is: 1456.

I need database version: 1526

Help!

Thanks,
Brad

[GT500]

Yes, you can find rules.ref in the following directories:

Windows XP:

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\

Windows Vista:

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\

Simply update MBAM on a clean computer, and you can use your flash drive to transfer the files to your infected computer. Make sure to run a virus scan on your flash drive afterwards though.

[BradHubbell]

Thanks for your help.

I got the most recent rules and moved them to the infected computer.

The scan was able to remove obvious signs of Spyware Guard 2008, but now I have no Internet connection.

I think I'll repost under a new topic for this issue.

Brad

[IT Expert]

BradHubbell, on Dec 20 2008, 04:11 PM, said:

Thanks for your help.

I got the most recent rules and moved them to the infected computer.

The scan was able to remove obvious signs of Spyware Guard 2008, but now I have no Internet connection.

I think I'll repost under a new topic for this issue.

Brad

Sounds like removing the infection may have damaged the winsocket. I recommend using the WinsockxpFix.exe from here:
http://www.snapfiles...nsockxpfix.html

You will need to DL it from another computer and stick it on a flash drive. If that doesnt help you also may need to repair with LSPFix.exe
Hope the first tool fixes it, also it wouldnt hurt to check and make sure your NIC drivers are still installed and your set to us DHCP. Some infections can force a static IP and when removed can default the falues to 0.0.0.0

Hope this helps

[IT Expert]

IT Expert, on Dec 20 2008, 11:39 PM, said:

Sounds like removing the infection may have damaged the winsocket. I recommend using the WinsockxpFix.exe from here:
http://www.snapfiles...nsockxpfix.html

You will need to DL it from another computer and stick it on a flash drive. If that doesnt help you also may need to repair with LSPFix.exe
Hope the first tool fixes it, also it wouldnt hurt to check and make sure your NIC drivers are still installed and your set to us DHCP. Some infections can force a static IP and when removed can default the falues to 0.0.0.0

Hope this helps

BTW I forgot to say this tool only works on XP, so hope your not running vista

[GT500]

IT Expert, on Dec 21 2008, 01:39 AM, said:

Sounds like removing the infection may have damaged the winsocket. I recommend using the WinsockxpFix.exe from here:
http://www.snapfiles...nsockxpfix.html

LSP Fix may be better. It should tell you if there's a winsock problem, and if so it will give you the option to fix it.

[BradHubbell]

IT Expert, on Dec 21 2008, 01:39 AM, said:

Sounds like removing the infection may have damaged the winsocket. I recommend using the WinsockxpFix.exe from here:
http://www.snapfiles...nsockxpfix.html

You will need to DL it from another computer and stick it on a flash drive. If that doesnt help you also may need to repair with LSPFix.exe
Hope the first tool fixes it, also it wouldnt hurt to check and make sure your NIC drivers are still installed and your set to us DHCP. Some infections can force a static IP and when removed can default the falues to 0.0.0.0

Hope this helps

I tried LSPFix first. No problems reported. I tried WinsockXPFix next. It said it fixed things and I should reboot.

Still cannot get connected to sites.

I have a wireless internal and a Verizon wireless card. The card says it is connected, but the ip address is not what I expect (192.168.15.x). It is set to the default gateway ip address (the phone).

Do you have any suggestions?

Thanks for your help,
Brad

[BradHubbell]

This is now resolved. Somehow, McAfee's Lockdown switch got flipped to lockdown mode.

I am now connected and happy.

Thanks to this forum for all their support,
Brad

[GT500]

BradHubbell, on Dec 21 2008, 10:15 AM, said:

I am now connected and happy.

Thanks to this forum for all their support,
Brad

Glad we could help.