System Specfics: win2000 pro, sp#3 IE V6.0.200.1106 2wire/sbc lan for the home office 2 pc's in the lan both pc's can ping each other and the router correct DNS server is indicated with ipconfig /all command Spyhunter executes, no malware Ad_Aware executes, shows cookies which are deleted I've re-installed IE v6.0, but have the same problem. I think SAHagent malware has set my IE connection protocol and is causing the problem. Problem Description: =================== I had a massive malware infection and i used spyhunter/ad-aware/cwsshredder & pest patrol to rid myself of the infection. After the disinfection, IE v6.0 can no longer access the internet. All other applications that do not use ie can access the internet, IE cannot. Another odd occurrence: I use to be all to keyin a url address of say tntuservice.com and the IE browser would resolve it as http://tntuservices.com/, not anymore what I get is http:///?%20tntuservices.com ANY HELP WOULD BE APPRECIATED! I have no clue as to why IE is behaving the way it is! Snapshot of the following which I saved and attached: Settings Control Panel Administration Tools: Computer Management System Information Components Network Protocol Name SAHagent MSAFD Tcip [TCP/IP] <=== is this sahagent malwware related Connectless Service False Guarantees Delivery True Guarantees Services True System Information report written at: 02/10/2004 12:09:44 PM [Network] [ Following are sub-categories of this main category ] [Adapter] Item Value Name [00000000] RAS Async Adapter Adapter Type Not Available Product Name RAS Async Adapter Installed True PNP Device ID Not Available Last Reset 2/10/2004 5:53:06 AM Index 0 Service Name AsyncMac IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled False DHCP Server Not Available DHCP Lease Expires Not Available DHCP Lease Obtained Not Available MAC Address Not Available Service Name Not Available Name [00000001] WAN Miniport (L2TP) Adapter Type Not Available Product Name WAN Miniport (L2TP) Installed True PNP Device ID ROOT\MS_L2TPMINIPORT\0000 Last Reset 2/10/2004 5:53:06 AM Index 1 Service Name Rasl2tp IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled False DHCP Server Not Available DHCP Lease Expires Not Available DHCP Lease Obtained Not Available MAC Address Not Available Service Name Rasl2tp Driver c:\winnt\system32\drivers\rasl2tp.sys (52112, 5.00.2195.4052) Name [00000002] WAN Miniport (PPTP) Adapter Type Wide Area Network (WAN) Product Name WAN Miniport (PPTP) Installed True PNP Device ID ROOT\MS_PPTPMINIPORT\0000 Last Reset 2/10/2004 5:53:06 AM Index 2 Service Name PptpMiniport IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled False DHCP Server Not Available DHCP Lease Expires Not Available DHCP Lease Obtained Not Available MAC Address 50:50:54:50:30:30 Service Name PptpMiniport Driver c:\winnt\system32\drivers\raspptp.sys (47888, 5.00.2195.4080) Name [00000003] Direct Parallel Adapter Type Not Available Product Name Direct Parallel Installed True PNP Device ID ROOT\MS_PTIMINIPORT\0000 Last Reset 2/10/2004 5:53:06 AM Index 3 Service Name Raspti IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled False DHCP Server Not Available DHCP Lease Expires Not Available DHCP Lease Obtained Not Available MAC Address Not Available Service Name Raspti Driver c:\winnt\system32\drivers\raspti.sys (16880, 5.00.2146.1) Name [00000004] WAN Miniport (IP) Adapter Type Not Available Product Name WAN Miniport (IP) Installed True PNP Device ID ROOT\MS_NDISWANIP\0000 Last Reset 2/10/2004 5:53:06 AM Index 4 Service Name NdisWan IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled False DHCP Server Not Available DHCP Lease Expires Not Available DHCP Lease Obtained Not Available MAC Address Not Available Service Name NdisWan Driver c:\winnt\system32\drivers\ndiswan.sys (93104, 5.00.2195.5241) Name [00000005] Alcatel SpeedTouch(tm) USB ADSL RFC1483 Adapter Type Not Available Product Name Alcatel SpeedTouch(tm) USB ADSL RFC1483 Installed True PNP Device ID Not Available Last Reset 2/10/2004 5:53:06 AM Index 5 Service Name alcan5ln IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled True DHCP Server Not Available DHCP Lease Expires Not Available DHCP Lease Obtained Not Available MAC Address Not Available Service Name Not Available Name [00000007] NVIDIA nForce MCP Networking Adapter Adapter Type Ethernet 802.3 Product Name NVIDIA nForce MCP Networking Adapter Installed True PNP Device ID PCI\VEN_10DE&DEV_0066&SUBSYS_80A71043&REV_A1\3&13C0B0C5&0&20 Last Reset 2/10/2004 5:53:06 AM Index 7 Service Name NVENET IP Address 172.16.1.33 IP Subnet 255.255.0.0 Default IP Gateway 172.16.0.1 DHCP Enabled True DHCP Server 172.16.0.1 DHCP Lease Expires 2/10/2004 1:53:26 PM DHCP Lease Obtained 2/10/2004 11:53:26 AM MAC Address 00:0C:6E:E4:8D:CF Service Name NVENET IRQ Number 20 I/O Port 0xE000-0xE007 Driver c:\winnt\system32\drivers\nvenet.sys (80896, 4.14.01.0281) Name [00000008] Realtek RTL8139(A)-based PCI Fast Ethernet Adapter Adapter Type Ethernet 802.3 Product Name Realtek RTL8139(A)-based PCI Fast Ethernet Adapter Installed True PNP Device ID PCI\VEN_10EC&DEV_8139&SUBSYS_50323030&REV_10\4&3B1D9AB8&0&3840 Last Reset 2/10/2004 5:53:06 AM Index 8 Service Name RTL8139 IP Address IP Subnet Default IP Gateway Not Available DHCP Enabled True DHCP Server 172.16.0.1 DHCP Lease Expires 12/24/2003 11:52:39 PM DHCP Lease Obtained 12/24/2003 10:52:39 PM MAC Address 00:08:A1:50:2B:12 Service Name rtl8139 IRQ Number 19 I/O Port 0xD000-0xDFFF Driver c:\winnt\system32\drivers\rtl8139.sys (18704, 5.366.0818.1999) [Protocol] Item Value Name SAHagent MSAFD Tcpip [TCP/IP] ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 16 bytes MaximumMessageSize 0 bytes MessageOriented False MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData True SupportsGracefulClosing True SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD Tcpip [UDP/IP] ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 16 bytes MaximumMessageSize 65467 bytes MessageOriented True MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting True Name SAHagent RSVP UDP Service Provider ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 16 bytes MaximumMessageSize 65467 bytes MessageOriented True MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption True SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting True Name SAHagent RSVP TCP Service Provider ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 16 bytes MaximumMessageSize 0 bytes MessageOriented False MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption True SupportsExpeditedData True SupportsGracefulClosing True SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{9A46BF82-D74D-417E-911C-5ABE466B9457}] SEQPACKET 0 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{9A46BF82-D74D-417E-911C-5ABE466B9457}] DATAGRAM 0 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{780F0488-C933-4516-8A1D-CC12FB8B1052}] SEQPACKET 4 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{780F0488-C933-4516-8A1D-CC12FB8B1052}] DATAGRAM 4 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{972AAC36-A2ED-431B-BAC6-CDAC0BE73A22}] SEQPACKET 5 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{972AAC36-A2ED-431B-BAC6-CDAC0BE73A22}] DATAGRAM 5 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{97D294E2-A561-4571-9DE7-50FF3AA50A2A}] SEQPACKET 1 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{97D294E2-A561-4571-9DE7-50FF3AA50A2A}] DATAGRAM 1 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{671D85B3-BC0B-41DB-92DA-EB658C1768C0}] SEQPACKET 2 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name SAHagent MSAFD NetBIOS [\Device\NetBT_Tcpip_{671D85B3-BC0B-41DB-92DA-EB658C1768C0}] DATAGRAM 2 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD Tcpip [TCP/IP] ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 16 bytes MaximumMessageSize 0 bytes MessageOriented False MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData True SupportsGracefulClosing True SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD Tcpip [UDP/IP] ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 16 bytes MaximumMessageSize 65467 bytes MessageOriented True MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting True Name RSVP UDP Service Provider ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 16 bytes MaximumMessageSize 65467 bytes MessageOriented True MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption True SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting True Name RSVP TCP Service Provider ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 16 bytes MaximumMessageSize 0 bytes MessageOriented False MinimumAddressSize 16 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption True SupportsExpeditedData True SupportsGracefulClosing True SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{9A46BF82-D74D-417E-911C-5ABE466B9457}] SEQPACKET 0 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{9A46BF82-D74D-417E-911C-5ABE466B9457}] DATAGRAM 0 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{780F0488-C933-4516-8A1D-CC12FB8B1052}] SEQPACKET 4 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{780F0488-C933-4516-8A1D-CC12FB8B1052}] DATAGRAM 4 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{972AAC36-A2ED-431B-BAC6-CDAC0BE73A22}] SEQPACKET 5 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{972AAC36-A2ED-431B-BAC6-CDAC0BE73A22}] DATAGRAM 5 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{97D294E2-A561-4571-9DE7-50FF3AA50A2A}] SEQPACKET 1 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{97D294E2-A561-4571-9DE7-50FF3AA50A2A}] DATAGRAM 1 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{671D85B3-BC0B-41DB-92DA-EB658C1768C0}] SEQPACKET 2 ConnectionlessService False GuaranteesDelivery True GuaranteesSequencing True MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting False SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False Name MSAFD NetBIOS [\Device\NetBT_Tcpip_{671D85B3-BC0B-41DB-92DA-EB658C1768C0}] DATAGRAM 2 ConnectionlessService True GuaranteesDelivery False GuaranteesSequencing False MaximumAddressSize 20 bytes MaximumMessageSize 64000 bytes MessageOriented True MinimumAddressSize 20 bytes PseudoStreamOriented False SupportsBroadcasting True SupportsConnectData False SupportsDisconnectData False SupportsEncryption False SupportsExpeditedData False SupportsGracefulClosing False SupportsGuaranteedBandwidth False SupportsMulticasting False [WinSock] Item Value File c:\winnt\system32\winsock.dll Version 3.10 Size 2.80 KB (2,864 bytes) File c:\winnt\system32\wsock32.dll Version 5.00.2195.4874 Size 21.27 KB (21,776 bytes)

ADDITIONAL INFO CONCERNING THE PROBLEM: ====================================== In Adminstrator Tools Computer Management System Tools System Information Internet Explorer File Versions the following dll's are not found enhsig.dll iemigrat.dll msoss.dll rsasig.dll shdoc401.dll wsock.vxd wsock32n.dll Does this have anything to do with IE not being able to connect to the internet???

ADDITONAL SYSTEM INFO concerning IE connection: ============================================== WIN2000 Local Area Connection NVIDIA nForce MCP Networking Adapter Internet Protocol (TCP/IP) Obtain IP address automatically Obtain DNS SErver address automatically Internet Options Connections LAN Settings nothing is checked

Interesting followup note: ========================= I can ping websites ok, be it by name or ip address. I have full internet access with all applications ex cept IE. How do I fix IE? What's the problem with IE?

Final Followup: ============== SAHagent installed its own set of network protocol connections. I did a new install of win2000. The install reset my connections to what they needed to be. After the fact, I found out there is a winsockfix utility available for free for most/all MS operating systems. The next time SAHagent invades, I will try this option first.