[pcuser]

I added a new function to EzPcFix lately which fixes broken Winsock and Winsock2 entries in the registry but I need some help with testing it.

Here's what it does:

It loads a good copy of the system hive from the "repair" folder and copies the Winsock and Winsock2 keys (and subkeys) to the registry.

Q) Why is this function needed?

A) Programs like NewDotNet and Xupiter, etc... "Hook" your internet connection by replacing the entries in these registry keys with their own and intercept any internet activity from your machine so they can keep track of your surfing habits/interests (maybe, so they know what types of popups to send you!)

When "Anti-Spyware" programs delete the malware files that are specified in these registry keys and don't fix the registry, you end up with no internet connection at all (this is why the Winsock/Winsock2 function was created).

The problem that I'm having is that the currently released version (1.0.0.9) doesn't wait long enough between loading the "good" hive, coping the keys and unloading the "good" hive. I've now included a small delay in the process which works just fine on my systems but I'd like it tested on other machines before releasing another version stating that it's fixed.

BTW. This doesn't really "delete" anything from the registry if it fails, it simply copies the good one to the current one if it's able to and if it fails, nothing should be changed at all. But it's easy to make a backup (right-click over "services" and select "export" (and select a file name) so you can just double-click on that file later to restore things back to the original state if you want to.

Any help/feedback would be greatly appreciated.

Here's the link to the beta version:

http://ezpcfix.net/beta/EzPcFix.exe

and

http://ezpcfix.net/beta/Plugin.inf

Thanks

Tom

[dirkgently42]

EzPcFix (beta) 1.00.0010
Focus on: winsock/winsock2
Added to pending release plugins and rebuilt.
Tests performed on two clean XP Pro systems, no infected PC with winsock/lsp symptoms at my disposal.

Notes:
1) requirement: app requires administrator priveleges to execute; duh!

2) Version info should be visible in main interface. It might also be an "about" menu entry....

3) Windows executable only = no errors , small popup saying "Done"

4) Plugin behavior; observation of app launched from CD in windows = no errors , small popup saying "Done"

5) Plugin behavior; observation of app when booted to PE = no errors , small popup saying "Done"

Clarification please: please elaborate.
"But it's easy to make a backup (right-click over "services" and select "export" (and select a file name) so you can just double-click on that file later to restore things back to the original state if you want to."
Right clicking on "Services" within ezpcfix seems to be the idea? That doesn't seem to work.

Maybe my right clicker is defective?

Perhaps you meant this?, this?, or this?, or something else?

I trusted your assertion: "This doesn't really "delete" anything from the registry if it fails,..." and proceded with testing.

I hope this feedback is useful.

This post has been edited by dirkgently42: 24 June 2005 - 09:40 PM

[pcuser]

@Dirk

Thanks a BUNCH for taking the time to actually test this!

Quote

2) Version info should be visible in main interface. It might also be an "about" menu entry....

This is a very good idea (and I never would of thought of it), you'll most likely see it in the next version.

Quote

Clarification please: please elaborate.
"But it's easy to make a backup (right-click over "services" and select "export" (and select a file name) so you can just double-click on that file later to restore things back to the original state if you want to."
Right clicking on "Services" within ezpcfix seems to be the idea? That doesn't seem to work.

Maybe my right clicker is defective?

Sorry, I guess that I didn't explain this part very well.

Open "Regedit" and navigate to "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock" and right-click over "Winsock" then select "Export". Type in a descriptive name (like winsock) and save it somewhere on your hard drive. Do the same for Winsock2 (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2)

Quote

I trusted your assertion: "This doesn't really "delete" anything from the registry if it fails,..." and proceded with testing.

Here's what this function does (behind the scenes)... This assumes that your windows is installed to "C:\Windows" and it also assumes that you're running from within windows.

Open Regedit and highlight "HKEY_LOCAL_MACHINE"

Click "File" then click "Load Hive"

Direct the "Open" dialog box to c:\windows\repair then double click on "SYSTEM". A dialog box will open asking what name to give it. Type in "GOOD_SYSTEM" then hit enter. (now you should have HKEY_LOCAL_MACHINE\GOOD_SYSTEM loaded in your registry)

Open a command prompt window and type

reg copy hklm\good_system\controlset001\services\winsock hklm\system\currentcontrolset\services\winsock

Do the same for "Winsock2"

The problem that I had with 1.0.0.9 is that it didn't wait for the hives to be loaded before it tried to copy the winsock and winsock2 keys so it would do nothing at all if it failed (adn just display a "Done" message whether it completed or not).

The way that I've been testing this is backing up the winsock and winsock2 keys then deleting them. If they re-appear in the registry after running the function then it paused long enough after loading the hive from the "repair" folder but I've had different load times that we're required for different machines. I think I might have this fixed in 1.0.0.10 though

Thank you very much for the help/feedback on this.

I got your PM earlier about the two other utilities that can do this (I've actually had both of them in my "toolbox" for quite some time now) but the problem is that they don't work when running from BartPE/UBCD4WIN which is the goal for every function in EzPcFix.

I'm at a "stand still" right now with EzPcFix where I know every aspect of the program and what it can do but I really want to make it more "user friendly". Alot of "techie's" tell me that EzPcFix is really helpfull to them but the average user won't even run it because they have no clue as to what it does. This is what I want to work on... Make it more user friendly.

Thanks Dirk

You may not know it yet but you've really helped me (and EzPcFix) with your single post.

Tom

[dirkgently42]

Glad to help!

It's a shame that there has an apparent lack of support for your application. It's an excellent tool!

The UBCD4Win project and your app requires very little of "beta" testing.
Fixing problems with your program is your domain, but reporting problems should be everyone's responsibilty.

An accurate and truthful report is preferred, but for the most part, the question is "does the application run the same on your computer as it does on mine?" Simple observations of expected, normal feedback based on prior experience with other applications is all that is required.

If a major BSOD occurs, or if major errors crop up then we all want to know as soon as possible. If your HD is suddenly reformatted without your consent, I'm sure everyone would want to know. The sooner the better!

This post has been edited by dirkgently42: 25 June 2005 - 02:08 AM

[DigiWiz]

I'm going to download and test here in a few minutes, but before I do, here's a quick little suggestion - give these files a more descriptive name - perhaps something like EzPcFix.beta1.01.exe or whatever you think is appropriate... I tend to download all my stuff into one folder and don't want to necessarily overwrite previous versions of your stuff, so I end up renaming them anyway to something with a version number...

DW

[Arctic Wolf]

Sorry - I haven't been very active on the forum lately. Anyway, I'll add it to my work build and test it out. We see plenty of machines with Winsock errors.

I really do appreciate your work - it is very useful!

[pcuser]

Digi,

I thought that naming the file as the version number was a good idea until I started building up a bunch of versions on my website that I can't delete or I'll end up with broken links all over the place so I'm not really sure what to do about it at this point.

BTW. The EXE does contain internal version numbers.

Artic Wolf,

I've been working on an easier to use (quicker navigation) interface. You might want to look at THIS one.

Tom