PC Review


Reply
Thread Tools Rate Thread

Browser Hijack?

 
 
=?Utf-8?B?SFdoaXRl?=
Guest
Posts: n/a
 
      18th Feb 2005
I'm working with a Gateway laptop running XP Pro that was infested with
Spyware/Adware. It also had a couple viruses. Everything seems to be clean
now, after running Spybot, AdAware, Microsoft's Spyware Beta, and 2 or 3
other programs. All scans come back clean. I also did an XP boot to
CD/repair on this drive and the browser worked fine when still in SP1 mode.
As soon as I updated to SP2, the browser problems came back.

The problem specifically is that if I type in www.yahoo.com, the browser
will automatically put www in front and either .org or .net behind... so it
would make it www.www.yahoo.com.net or .org. I also cannot browse network
shares when this happens.

I would appreciate anybody's help on this.

Thanks.
 
Reply With Quote
 
 
 
 
Jon Kennedy
Guest
Posts: n/a
 
      18th Feb 2005
Go to Start...Run, type in regedit, click okay.
Navigate to the following:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
"Append Completion"="no"

"AutoSuggest"="no"

Then click File....Exit
--

Jon R. Kennedy
Charlotte, NC, USA
(E-Mail Removed)

"HWhite" <(E-Mail Removed)> wrote in message
news:2C5189DC-3622-4830-A28E-(E-Mail Removed)...
> I'm working with a Gateway laptop running XP Pro that was infested with
> Spyware/Adware. It also had a couple viruses. Everything seems to be
> clean
> now, after running Spybot, AdAware, Microsoft's Spyware Beta, and 2 or 3
> other programs. All scans come back clean. I also did an XP boot to
> CD/repair on this drive and the browser worked fine when still in SP1
> mode.
> As soon as I updated to SP2, the browser problems came back.
>
> The problem specifically is that if I type in www.yahoo.com, the browser
> will automatically put www in front and either .org or .net behind... so
> it
> would make it www.www.yahoo.com.net or .org. I also cannot browse network
> shares when this happens.
>
> I would appreciate anybody's help on this.
>
> Thanks.


 
Reply With Quote
 
=?Utf-8?B?SFdoaXRl?=
Guest
Posts: n/a
 
      18th Feb 2005
Thanks Jon. Those were set to YES, so I changed them to NO. Now however, I
just get a "Page Cannot Be Displayed". It is very intermittent, with it not
working much more than working. I'm going to run down the list Jan Il has
provided on this board and will report back. It'll be difficult with an
intermittent connection, but we'll see if I can do it.

"Jon Kennedy" wrote:

> Go to Start...Run, type in regedit, click okay.
> Navigate to the following:
> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
> "Append Completion"="no"
>
> "AutoSuggest"="no"
>
> Then click File....Exit
> --
>
> Jon R. Kennedy
> Charlotte, NC, USA
> (E-Mail Removed)
>
> "HWhite" <(E-Mail Removed)> wrote in message
> news:2C5189DC-3622-4830-A28E-(E-Mail Removed)...
> > I'm working with a Gateway laptop running XP Pro that was infested with
> > Spyware/Adware. It also had a couple viruses. Everything seems to be
> > clean
> > now, after running Spybot, AdAware, Microsoft's Spyware Beta, and 2 or 3
> > other programs. All scans come back clean. I also did an XP boot to
> > CD/repair on this drive and the browser worked fine when still in SP1
> > mode.
> > As soon as I updated to SP2, the browser problems came back.
> >
> > The problem specifically is that if I type in www.yahoo.com, the browser
> > will automatically put www in front and either .org or .net behind... so
> > it
> > would make it www.www.yahoo.com.net or .org. I also cannot browse network
> > shares when this happens.
> >
> > I would appreciate anybody's help on this.
> >
> > Thanks.

>
>

 
Reply With Quote
 
Robert Aldwinckle
Guest
Posts: n/a
 
      19th Feb 2005
> The problem specifically is that if I type in www.yahoo.com, the browser
> will automatically put www in front and either .org or .net behind


That's a symptom that your DNS is failing while IE's AutoSearch
is enabled.

You can bypass AutoSearch simply by using a proper protocol
prefix on the URLs you enter. E.g. if you have AutoSuggest enabled
and you start typing and you see a match in the dropdown list
then selecting a full URL (or a Favorite which links to a full URL)
should avoid the symptom.

Then your problem will be making your DNS work better.
That could be a sign of residual corruption (or continuing control
by malware) of your protocol stack.

XPsp2 has a new command which helps refresh part of the registry
which is involved with that:

E.g. enter in a command window:

netsh winsock reset

BTW there is also a show catalog command;
so before doing a reset it might be interesting
to save the old catalog display and then compare
it with the new one, just to convince yourself that
this was worth doing. The complete set of commands
for doing that would be:

netsh winsock show catalog >oldcat.txt
netsh winsock reset
netsh winsock show catalog >newcat.txt
fc oldcat.txt newcat.txt >diffcat.txt
notepad diffcat.txt

If diffcat.txt shows any differences I for one would
be interested in seeing such a report.


Here's an excerpt from a previous reply about the same issue
where I mentioned some other diagnostic and repair possibilities.
Please notice in particular my last caveat. This is slightly off-topic
for this newsgroup.

<excerpt>
FYI for XPsp2 there is a new repair command for the latter possibility:

netsh winsock reset

Otherwise there is

netsh interface ip reset

You might try checking for abnormalities beforehand by

netsh winsock show catalog type=LSP

ipseccmd show filters

(ipseccmd is on the XP Pro Support Tools)


BTW you may get better suggestions in a newsgroup
which specializes in networking for your OS.
</excerpt>


Good luck

Robert Aldwinckle
---


"HWhite" <(E-Mail Removed)> wrote in message
news:2C5189DC-3622-4830-A28E-(E-Mail Removed)...
> I'm working with a Gateway laptop running XP Pro that was infested with
> Spyware/Adware. It also had a couple viruses. Everything seems to be clean
> now, after running Spybot, AdAware, Microsoft's Spyware Beta, and 2 or 3
> other programs. All scans come back clean. I also did an XP boot to
> CD/repair on this drive and the browser worked fine when still in SP1 mode.
> As soon as I updated to SP2, the browser problems came back.
>
> The problem specifically is that if I type in www.yahoo.com, the browser
> will automatically put www in front and either .org or .net behind... so it
> would make it www.www.yahoo.com.net or .org. I also cannot browse network
> shares when this happens.
>
> I would appreciate anybody's help on this.
>
> Thanks.





 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
browser hijack/browser modifier raya Security Signatures 3 12th Aug 2005 05:09 AM
Possible browser Hijack (Browser modifier) chedozeau.b@wanadoo.fr Spyware Discussion 2 22nd Jul 2005 02:48 PM
Possible Browser Hijack (Browser Modifier) ... =?Utf-8?B?UHJpbWEuQWxmcmVkbw==?= Windows XP Security 2 4th Apr 2005 02:31 PM
Possible browser hijack[browser modifier] victim777 Security and Anti-Spyware Community 0 7th Mar 2005 12:03 AM
Possible Browser Hijack Browser Hijacker Peter Spyware Discussion 7 24th Jan 2005 11:43 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 12:23 PM.