Hijackthis & LSPFIX

[dvk01]

This is a copy of an email I have sent to the developer of Hijackthis, I thought it might also be worth doiscussing here


I am having a slight problem with HJT

I have recently started using NOD32 as my antivirus, which changes the winsock entries and puts it's own version of imon.dll

HJT detects this as a broken internet access and will not allow it to be put into ignore list (actually it puts it there but still wants to fix that
entry)

With NOD becoming more popular, is there some way to update HJT to add this version of imon.dll to the white list otherwise many newbies will unwittingly remove the imon.dll with hjt and remove the email antivirus protection along with it.

I have copied this to Pieter & Tony for their comments, as I might have got this all wrong, but it happened to me when I first ran HJT as a check after installing NOD, so I had to reinstall to be safe

We also need to warn people NOT to fix imon.dll with LSPfix either because that also wants to remove the NOD version of Imon.dll as it sees it as an unwanted entry

Derek

subject changed accordingly -paul

[Pieter_Arntz]

Hi Derek, :)

Some related threads:
http://www.wilderssecurity.com/showthread.php?t=9811
http://www.wilderssecurity.com/showthread.php?t=18610

Regards,

Pieter

[dvk01]

Thanks Pieter it makes it a bit clearer

Just with NOD becoming more popular and I can see on many forums, the less experienced helpers, removing imon.dll and I think in the process, removing the email antivirus protection

[dvk01]

Aparantly it's not just nod it's also norman antivirus with nmtracer.dll as well

[Pieter_Arntz]

Hi Derek,

Add SpamSubstract to that list. ;)

Regards,

Pieter

[dvk01]

and antiy labs ghostbusters

Do you think we need a sticky in one of the forums with a complete list of all the "good" O10 entries that shouldn't be fixed with HJt or lspfix

[Pieter_Arntz]

Hi Derek,

I've moved this thread to the Privacy forum. I think that is a good idea.
Let's gather them here and I will make a sticky in the "news, general information and FAQs"

For starters:

SpamSubtract :
O10 - Broken Internet access because of LSP provider 'spsublsp.dll' missing

NOD32:
O10 - Broken Internet access because of LSP provider 'imon.dll' missing

Regards,

Pieter

[dvk01]

Antiy ghostbusters:
O10 - Unknown file in Winsock LSP: d:\\antiy labs\agb4\agbfilt.dll

Norman Antivirus :
O10 - Broken Internet access because of LSP provider 'nmtracer.dll' missing

Windows ME infra red port:
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\wspirda.dll' missing

McCaffee antivirus:
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cslsp.dll' missing

[Pieter_Arntz]

ZoneLabs IM Secure:

O10 - Broken Internet access because of LSP provider 'imslsp.dll' missing