Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 201
  • Last Modified:

After cleaning some sites get weird string added to URL

Urgent!

Hi there, a client of mine is Needing to access some websites but /?%20 is getting added to the URL like this:

http:///?%20www.websitename.com

This comes after scans and cleaning with spybot, ad-adware, hi-jackthis, housecall and does NOT happen with all sites, only some particular sites (which show up fine for me and for clients other computer)

Please respond if you know of how to solve this.
0
shantelechy
Asked:
shantelechy
  • 3
  • 2
  • 2
  • +2
1 Solution
 
billmercerCommented:
%20 is a way of representing the space character in a URL. It looks like some sort of failed attempt to modify the URL, which makes me think spyware. I'd guess it's some sort of redirection thing that has gotten screwed up.  

But it's also possible this could be caused by a legitimate BHO that has gotten damaged or corrupted. Try disabling all BHOs, regardless of what they are for.  You can use Hijack This to do that.

You might also want to look at which web sites this happens with, and see if there's a pattern.
0
 
blue_zeeCommented:

And to scan for spyware and malware:

First of all, download NOW this Winsock fix (FREE):
http://downloads.subratam.org/WinsockFix.zip
If you lose internet access after the cleanup, run this tool.

After that, download the fully functional trial version of Spy Sweeper:
http://www.webroot.com/downloads/?WRSID=595f27d74dd2795a56af83b763c321e1
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once ('in use').

Download Ad-Aware (FREE) from here:
http://lavasoft.element5.com/support/download/
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once ('in use').

Also excellent is SpyBot Search & Destroy (FREE) available here:
http://www.spychecker.com/download/download_spybot.html
Install, UPDATE and run.
You may need to reboot and run again to clean all the nasties that cannot be deleted at once ('in use').
You should also apply the 'immunize' function, since it blocks roughly 1900 known 'bad' runs/apis/apps.

Even if Ad-Aware and SpyBot S&D are similar, they do clean different things. You should have both of them and use REGULARLY.

You can also install 'preventive' software that will help you control these nasties:

SpywareBlaster (FREE):
http://www.javacoolsoftware.com/spywareblaster.html
Prevents the installation of Active-X based spyware, malware, dialers, etc
Currently protects you against 3500+ nasties.
Advantage: no system resources used!!!
Just download, install and UPDATE.

All of them extremely useful but you must keep them UPDATED.

Suggestion: Make sure you can see all files and folders and run Ad-aware and Spybot S&D in Safe Mode.

Zee
0
 
billmercerCommented:
blue_zee, the asker already specified having scanned with Ad-Aware and Spybot, as well as Hijack This.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
FalconHawkCommented:
As billmercer already sayd, %?20 is just a character. I had it to several times, Even with trusted sites like altavista. If i type www.altavista a.com the browser makes that http:///www.altavista%20a.com. The question mark is probally a redirect.

How to fix it? well... most probally its a website problem, and not a problem on his PC. Try cleaning the internet cache and try it again then. If it keeps failing, See if you can contact the owner, and tell him about this.
0
 
blue_zeeCommented:

Maybe this registry patch helps:

http://mvps.org/winhelp2002/RepairDefaultPrefix.reg
Repairs the corrupted or altered (spyware) HTTP prefixes

Download, right-click and select merge.

Reboot and test.

Zee
0
 
kneHCommented:
Have had the same once...
A simple update at update.microsoft.com solved it.

if you add the http prefix yourself it doesn't occur.. if you type www.whatever.tlc it does right?

0
 
shantelechyAuthor Commented:
Thanks everyone, I'll be able to contact my client and run your answers through the paces :)

As a reminder, yes we've run said scans and he has spy sweeper too... the success of these scans seems to have led to this new issue.
... and it's not a web site problem ("does NOT happen with all sites, only some particular sites (which show up fine for me and for clients other computer")
0
 
FalconHawkCommented:
"does NOT happen with all sites, only some particular sites (which show up fine for me and for clients other computer"

ups, i translater the "site" to "website" and not to place or whereabouts. translation error i guess ^^
0
 
shantelechyAuthor Commented:
Thanks for everything. I was not able to get back to my client... he deserted ;) so the most helpful answer is the reg patch which I will add to my arsenal. Cheers.
0
 
blue_zeeCommented:

Oh well...

Happy you found it useful.
;-)

Thanks,

Zee
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 3
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now