Link to home
Start Free TrialLog in
Avatar of jaerob
jaerobFlag for United States of America

asked on

Browser hijacked?

Hello all. I believe I have a browser hijack/spyware problem. I get this in the address bar of IE when it comes up: "res://C:\WINDOWS\System32\shdoclc.dll/navcancl.htm". How do I fix this?
Avatar of SheharyaarSaahil
SheharyaarSaahil
Flag of United Arab Emirates image

Hello jaerob =)

If its WinXP\Win2k, then Try running this Winsock Repair:
http://www.spychecker.com/program/winsockxpfix.html
And for Win98\ME systems, run this one,
Try running this Winsock Repair Utility for Win98\ME:
http://downloads.subratam.org/WinsockFix.zip

You can also try LSPFix >> http://www.spychecker.com/program/lspfix.html
coz looks like the winsock is corrupted due to a malware file... running one of the above tools can correct it to the default files :)
If still you get the problem, then use Hijackthis to know about the culprit one :)
get HijackThis from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe

Then Post that log at this site >> http://www.hijackthis.de
and it will automatically analyse it for u,,, Fix the entries which it labels as Nasty :)
To Fix, check the lines in Hijackthis scan and click on Fix Checked !!

HJT Log Tutoriol >> http://aumha.org/a/hjttutor.php

CAUTION: Before fixing the entries in hijackthis, make sure that they are really Nasty and can be deleted, better u first research for it on Google and then when u will confirm that they shud be deleted, Fix them. And whenever u run Hijackthis, run it from a New folder on ur desktop, so that in case of any problem, u can take advantages of its created backups of fixed items. And in case if u still face problems in dealing with it, just analyse ur log at the above site, and then scroll down where u will see a Save Analyse button, hit it and it will save ur Log Analysation, then copy the link of that page and paste it here, and we will check it for u :)
Avatar of jaerob

ASKER

Hi there. I downloaded and ran the Winsock repair, but the problem still exists.
try to use hijackthis now..... if you cannot get the idea about it, then please post here the link when you will save the log on the analyser website..... i will check it out :)

and btw have you already run adaware, spybot and cwshredder scans on the system to make sure they come as clean ??
Avatar of jaerob

ASKER

Ok, I ran the analysis at http://www.hijackthis.de. The link to the saved analysis is: http://www.hijackthis.de/logfiles/13b5c5887b8cdb73750c728314122e79.html. Would you mind checking it for me?
Avatar of jaerob

ASKER

Oh btw, I have not downloaded or run adaware, spybot or cwshredder yet.
ASKER CERTIFIED SOLUTION
Avatar of SheharyaarSaahil
SheharyaarSaahil
Flag of United Arab Emirates image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
>> Oh btw, I have not downloaded or run adaware, spybot or cwshredder yet.
that's bad, please download, install and run them one by one in safemode :)

AdAware ==> http://www.spychecker.com/program/adaware.html
SpyBot  ==> http://www.spychecker.com/program/spybot.html
CoolWebShredder ==> http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
Avatar of jaerob

ASKER

Awesome! Problem solved! I am now downloading the three utilities you recommended above. I will install them, and run them one by one in safe mode.
great.... keep me informed about the further progress :)
Avatar of jaerob

ASKER

Hello again. Here's the scoop...
1. CWShredder was not found.   :)
2. SpyBot found four issues. One is called "Alexa Related" and is located at: c:\windows\Web\related.htm. The other three are listed under the topic "DSO Exploit". They appear to be registry keys. Should I go ahead and allow SpyBot to fix these?
3. As for AdAware, should I send you the log file?
Fix the DSO Exploit..... and if they reappear everytime..... then install this fix,
Spybot - Search and Destroy DSO Exploit Fix 1.3.1 TX
http://www.majorgeeks.com/download4392.html

For adaware..... the log is too long, please fix the entries which it reports infected! :)
Avatar of jaerob

ASKER

All done! I can't thank you enough for your expert advice! How often should I run these three scans in the future?
well once in a 15 days in good enough! :)

and now as the problem has solved, you can close this question, as you can see the Accept button infront of each comment which you got, you have to hit the button for that comment which solved your problem, and then assign a grade according to the quality of help you got,,, that's all :)
for more info. on how to close a Question, plzz refer here >> https://www.experts-exchange.com/help.jsp#hs5
Cheers & Thanks :)
Avatar of jaerob

ASKER

Thanks so much SheharyaarSaahil! You are THE MAN!
you are always welcome jaerob... and thanx for the appreciation! ^_^