Help please

Question

My internet isn't working, somehow I must of accidently deleted a file I shouldn't have. When I log into windows and my internet programs load and attempt to access the internet it gives me an error message saying it can not find the program "Sporder.DLL", so I have no connection to the internet on that computer. Other things Ive noticed is when I put in a cd sometimes I cant view that cd it just locks up. I've tried reinstalling windows but that didn't work. I don't know what to do, so can someone please help!!! I would rather not format my computer but it looks like that might be the only option. If formating it is the only solution can someone please tell me exactly what to do? Thankyou all for your help and I hope I can get this fixed.

Thankyou,
-TriggerHappyXT

ky331 · Answer

Jim,

I completely agree. That's why my response was rather 'tentative', saying things like:

"Investigate further to determine any pest presence.... Although potentially related to spyware, it's also related to normal software."

since the person didn't indicate where the file was located (i.e, under \windows, or under \webhancer), we simply don't know yet... unless/until we see the likes of a HJT log with more details.

Message Edited by ky331 on 03-27-2005 03:53 PM

jwatt · Answer

sporder.dll is a DLL used to investigate the LSP (Layered Service Provider) chain order

That's true, but there's apparently a Trojan of it that's found if "WebHancer" is installed. That one will not be in one of the subdirectories under "windows", but in places like \webhancer\programs\sporder.dll.

Jim

ky331 · Answer

Here's what I've obtained via some web searching --- unfortunately, much is too 'technical' for me (and presumably you) to interpret... but maybe someone else here can understand and help you:

sporder.dll is a DLL used to investigate the LSP (Layered Service Provider) chain order. Its presence doesn't necessarily indicate a virus/spyware/trojan/adware presence. Any regular LSP makes use of sporder.dll during its setup. Investigate further to determine any pest presence. You should not delete this dll, in fact deleting it could disable the correct install or uninstall of LSPs. Although potentially related to spyware, it's also related to normal software.

The following is taken from Microsoft's site:

Service Provider Ordering (S P Order)

The order in which transport service providers are initially installed governs the order in which they are enumerated through WSCEnumProtocols at the service provider interface, or through WSAEnumProtocols at the application interface. More importantly, this order also governs the order in which protocols and service providers are considered when a client requests creation of a socket based on its address family, type, and protocol identifier.

Windows Sockets 2 includes an applet called Sporder.exe that allows the catalog of installed protocols to be reordered interactively after protocols have already been installed. Winsock also includes an auxiliary DLL, Sporder.dll, that exports a procedural interface for reordering protocols. This procedural interface consists of a single procedure called WSCWriteProviderOrder.

The interface definition may be imported into a C or C++ program by means of the include file Sporder.h. The entry point may be linked by means of the lib file Sporder.lib.

Message Edited by ky331 on 03-27-2005 03:52 PM

ky331 · Answer

I'd recommend you hold off on reformatting as long as possible... that should be your last resort.

Unfortunately, since it's a holiday weekend, many of the experts are away. Try to be patient. I believe there are some programs, perhaps one called LSPFIX, or perhaps one called WinSock2Fix... but I have no definitive, first-hand knowledge of either --- meaning I can NOT recommend you try either one. There are several experts around... including MidNightStar, who may be able to help you out, if you're patient.

in fact, to expedite matters, i'd suggest the following:

Apparently you have access to the internet from SOME PC (though not the one having the internet problem)... go to the GOOD PC, and download the latest version of HiJackThis(1.99.1) from

http://majorgeeks.com/download3155.html

copy it to a floppy (either before or after UNzipping it, as noted below), and then, transfer it to the BAD PC.

you must create a separate folder on the BAD PC and place it there.... people commonly use C:\HJT

The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer).

After Unzipping, double click on HiJackThis.EXE

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

save the NotePad file to your floppy... remember the file name you use.

transfer the notepad file, from floppy, to the GOOD PC.

Open NotePad on the good PC, open the file you've transferred over, and Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then come back to the Dell Forums, and PASTE the results in the new/dedicated forum for HiJackThis analysis (NOT in this forum)

One of the experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.

Message Edited by ky331 on 03-27-2005 04:46 PM

Message Edited by ky331 on 03-27-2005 04:57 PM

Triggerhappyxt · Answer

Yes and I thankyou for your help but more and more its looking towards reformating it :( O well :( I'll wait tell after tomorrow to do that though.

Triggerhappyxt · Answer

Ummm, I dont know exactly where it was located, my spyware removal program removed it.... but Im not interested for the most part of what it is, I just want to know how to fix this The only solution I can think of is reformating my computer which Id rather not do but if thats the only solution how would I go about doing this? Thank you all for your help this is really apreciated!

ky331 · Answer

i just edited my last post... just want to make sure you go back and read the revised/expanded version

Flipside2 · Answer

Maybe a silly question, but have you checked your spy removal program to see if it can undo the removal.  Some either quarantine or back up before removing.  This may get you back to where you were.  Possibly, you have tried this already. Ron

Triggerhappyxt · Answer

thankyou for your help, i fixed my problem by reinstalling windows a 2nd time, but now I have another problem, im going to check to make sure someone hasnt had the same one befor i post about it.

Triggerhappyxt · Answer

Ok I posted my new problem here http://forums.us.dell.com/supportforums/board/message?board.id=dim_modem&message.id=30188 in the apropreate board

Virus & Spyware

Help please

Was this post helpful?