what does LSP Fix do?

JB

Hey guys, I got an email from a friend of the family with spyware problems. They ran spybot and AVG and are now clean, but can't access the internet. I know LSP Fix is suppose to fix this, but what exactly does it do? I was reading the readme and it says:

If a module is missing, it is placed on the "Remove" list for removal.

hmm..seems kind of counter productive to me? So if the windows machine missing a module LSP Fix removes it? Does it ever fix the broken/missing module, or do i have to install a winsocks update or something? thanks for the help guys.

Dexter

Let's have a look at more of the README file:

LSP-FIX - Winsock 2 repair utility
==================================

This program attempts to correct Internet connection problems resulting from buggy or improperly-removed Layered Service Provider (LSP) software. When you start LSP-Fix, it will read the list of LSP modules from the Windows registry and verify that each module is present. If a module is missing, it is placed on the "Remove" list for removal. Advanced users can override suggested removals in the "Advanced" area. When "Finish" is pressed, the undesired entries are removed, and the remaining entries in the registry are renumbered to make them consecutive. The total module counts are then updated. Finally, the program will display a summary of the changes that were made.

FOR THE CHANGES TO TAKE EFFECT, IT MAY BE NECESSARY TO RESTART YOUR COMPUTER. After restarting, connect to the Internet normally and try accessing a Web domain such as http://www.google.com to check that your connection is working properly. If you still cannot access Web sites, see the "Recovering From Disaster" section below for other possible fixes.

Since some errors result from misnumbered LSP entries rather than missing modules, the "Remove" list may be empty. Don't worry if this is the case; the misnumbered entries will be corrected when you press "Finish".

Please do not check the "I know what I'm doing" box unless you really know what you're doing. This option is for advanced users only and is not necessary to repair your system.

Notes

---

No changes will be made until you press the 'Finish' button. To exit without making any changes, simply close the program instead of pressing Finish.

It makes no difference which order the module entries appear in. LSP-Fix will retain the entries in the order that they appear in the Registry. (In other words, shuffling them around on the Keep/Remove lists has no effect.)

LSP-Fix is not a malware removal utility and does not target specific products. LSP-Fix does not delete any files.


Recovering From Disaster

---

I make the assumption that your system actually does use Winsock 2 (all Win98 and higher do). If you are running Windows 95 and are not sure if Winsock 2 has been installed on your system, it should be re-installed. The file is available from the Microsoft Web site or (probably) windowsupdate.microsoft.com .

If the Winsock2 Registry keys are missing entirely (LSP-Fix returns an error) or damaged beyond repair, it will be necessary to restore them. A brief walkthrough of this procedure is available at http://cexx.org/winsock.htm .

Some LSP products may overwrite system files such as 'wsock32.dll'. If this has occurred, or you still cannot access Web sites, it may be necessary to re-install Winsock 2 (or Windows) to restore the original files.

Basically, an LSP is a "layered service provider." LSP's allow applications to pass data in special ways through your TCP/IP protocols. Basically, they are allowing an app to sending data directly to another system without using your Internet browser to do it. This is good for certain applications, but can also be exploited by malicious software to do things like track your internet activity, send you pop-ups, etc.

The problem with LSP's is they way they are installed. Think of them like light bulbs in an old style Christmas tree strand which are wired in series. If any one light burns out, the whole strand does not work. So, if you run an anti-spyware app, and it detects a malicious LSP, it disables the file (light bulb burns out.) However, in doing so, it can break the whole TCP/IP strand, and takes out your connection.

So, back to the quote you pasted above. A missing module would be the burnt out light bulb, which was disabled by the anti-spyware app. It detects this missing module, and removes that light bulb from the strand. Now, my analogy goes a little awry here, because LSP Fix does not actually put a new light bulb in it's place. It just "splices" the strand back together. The end result is that the broken part of your TCP/IP handler is put back together, and your internet connection will be restored.

Dexter...

JB

gotcha! thanks for the info Dexter!