Strange entrie in LSP fix.

Discussion in 'other security issues & news' started by ThunderZ, Jul 14, 2006.

Thread Status:
Not open for further replies.
  1. ThunderZ

    ThunderZ Registered Member

    Joined:
    May 1, 2006
    Posts:
    2,459
    Location:
    North central Ohio, U.S.A.
    I have the entry "mr20.dll", among others, showing up in the LSP window described as a Tcpip entry. When doing a Google it comes back as a Trojan\Backdoor. However when I removed it I lost the Internet. I used Winsockfix to restore my connection....it also restored mr20.dll. Scans with A-Squared, AdAware, Sptbot S&D, and NOD32 show clean. Also a search with hidden and protected files showing turns up nothing. Suggestions?
     
  2. Smokey

    Smokey Registered Member

    Joined:
    Apr 1, 2002
    Posts:
    1,513
    Location:
    Annie's Pub
    Is it in windows startup?
     
  3. ThunderZ

    ThunderZ Registered Member

    Joined:
    May 1, 2006
    Posts:
    2,459
    Location:
    North central Ohio, U.S.A.

    Nope. That is whats so strange. It shows up no where else. Did a files and folders search with all showing. All so did a registry search. As well as scanned with the above mentioned apps. Even dowmloaded\updated and ran Prevx. Everything came up blank.
     
  4. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    If at some point you can find mr20.dll, and anything else that's possibly dodgy, and copy them into a new folder, i would be very interested in having a look at them. If so please PM me and let me know. Make sure you exclude the folder from any scans though.

    Right now i would try a few online scans and see if they turn up anything

    http://www.kaspersky.com/kos/english/kavwebscan.html

    http://www.bitdefender.com/scan8/ie.html

    http://www.ewido.net/en/

    Also worth having, if only for the many useful tools/plug-ins, is Adaware. One in particular that's applicable to your situation, and could prove to be helpful as it gives you a huge list of almost, if not everything in there, is LSP Explorer. Of course you will need to install Adaware first !
    _________________________

    http://www.lavasoftusa.com/software/addons/lspexplorer.shtml

    In case you ever need it, here's another good repair utility.

    LSP-Fix

    Repairs Winsock 2 settings, caused by buggy or improperly-removed Internet software, that result in loss of Internet access.

    http://www.cexx.org/lspfix.htm


    StevieO
     
    Last edited by a moderator: Jul 15, 2006
  5. ThunderZ

    ThunderZ Registered Member

    Joined:
    May 1, 2006
    Posts:
    2,459
    Location:
    North central Ohio, U.S.A.
    If I can find it you are welcome to it.

    All scans come up negative.

    Already have it installed with all plugins. Checking out some of the entries now.

    Have it already as well. That is how I found the item in question. When I had LSP remove it I lost the Internet. Ran Winsock fix to get it back. Unfortunately mr29.dll returned as well.
     
  6. ThunderZ

    ThunderZ Registered Member

    Joined:
    May 1, 2006
    Posts:
    2,459
    Location:
    North central Ohio, U.S.A.
    Is`t my face red......

    Did some tracking down with LSP explorer. Guess it is time for stronger glasses. It turns out to be "rnr20.dll" not "mr20.dll". :oops: "rnr.dll" is a legit MS TCP\IP entry. Feel good my defenses have not been compromised, feel like an a$$ for the mistake. Thanks for the assist just the same. :D
     
Loading...
Thread Status:
Not open for further replies.