Faulty Webhancer Removal

I ran the spyware beta and it killed my network
connection (now browser) and disabled my McAfee security
center. After trying a variety of fixes I did a System
Restore to get back online.

The problem appears to be the way the beta deals with a
rather nasty piece of spyware called Webhancer. As I
learned from reading about it online, Webhancer can knock
out your internet connection and cause a variety of other
problems if it is uninstalled improperly. It appears
Microsoft's approach has a problem. I used Spybot to get
rid of it and had no further problem.

Webhancer is a widespread piece of spyware. I suspect
Microsoft will fix this problem soon (they had better!).

About Webhancer:
http://www.cexx.org/webhancer.htm
http://www.doxdesk.com/parasite/webHancer.html
http://simplythebest.net/info/spywa...ncer_spyware.ht
ml

Same problem!

How do you run a full system restore, without losing saved
documents?


The problem started after my scan. I removed one
threat, "webhancer" located at c:\windows\system32
\sporder.dll. This threat level was judged to be severe.
I am at my wits end.
>-----Original Message-----
>I got the same error. However, it was after I removed
>the spyware "Webharvester". The location of the file was
>shown to be windows\system32\sporder.dll. In restoring
>the computer and running a search I found two
>applications of sporder.dll. The second one was in the
>windows\temp\mcu9.tmp\.
>I could not find the file on the Windows XP install disk.
>
>So the question becomes how to reinstall that file?
>>-----Original Message-----
>>I downloaded, and installed the beta spyware software.
>>Upon successful installation I am now unable to access
>any
>>internet functions. I get the following
>>error, "Application failed to start b/c SPORDER.dll was
>>not found. Re-installing Application may fix this
>>problem." What do I do?





>-----Original Message-----
>I ran the spyware beta and it killed my network
>connection (now browser) and disabled my McAfee security
>center. After trying a variety of fixes I did a System
>Restore to get back online.
>
>The problem appears to be the way the beta deals with a
>rather nasty piece of spyware called Webhancer. As I
>learned from reading about it online, Webhancer can knock
>out your internet connection and cause a variety of other
>problems if it is uninstalled improperly. It appears
>Microsoft's approach has a problem. I used Spybot to get
>rid of it and had no further problem.
>
>Webhancer is a widespread piece of spyware. I suspect
>Microsoft will fix this problem soon (they had better!).
>
>About Webhancer:
>http://www.cexx.org/webhancer.htm
>http://www.doxdesk.com/parasite/webHancer.html
>http://simplythebest.net/info/spywa...ncer_spyware.ht
>ml
>.
>

Please see the following articles "How to restore the
operating system to a previous state in Windows XP".

http://support.microsoft.com/kb/306084

>-----Original Message-----
>Same problem!
>
>How do you run a full system restore, without losing
saved
>documents?
>
>
>The problem started after my scan. I removed one
>threat, "webhancer" located at c:\windows\system32
>\sporder.dll. This threat level was judged to be
severe.
>I am at my wits end.
>>-----Original Message-----
>>I got the same error. However, it was after I removed
>>the spyware "Webharvester". The location of the file
was
>>shown to be windows\system32\sporder.dll. In restoring
>>the computer and running a search I found two
>>applications of sporder.dll. The second one was in the
>>windows\temp\mcu9.tmp\.
>>I could not find the file on the Windows XP install disk.
>>
>>So the question becomes how to reinstall that file?
>>>-----Original Message-----
>>>I downloaded, and installed the beta spyware software.
>>>Upon successful installation I am now unable to access
>>any
>>>internet functions. I get the following
>>>error, "Application failed to start b/c SPORDER.dll was
>>>not found. Re-installing Application may fix this
>>>problem." What do I do?
>
>
>
>
>
>>-----Original Message-----
>>I ran the spyware beta and it killed my network
>>connection (now browser) and disabled my McAfee security
>>center. After trying a variety of fixes I did a System
>>Restore to get back online.
>>
>>The problem appears to be the way the beta deals with a
>>rather nasty piece of spyware called Webhancer. As I
>>learned from reading about it online, Webhancer can
knock
>>out your internet connection and cause a variety of
other
>>problems if it is uninstalled improperly. It appears
>>Microsoft's approach has a problem. I used Spybot to get
>>rid of it and had no further problem.
>>
>>Webhancer is a widespread piece of spyware. I suspect
>>Microsoft will fix this problem soon (they had better!).
>>
>>About Webhancer:
>>http://www.cexx.org/webhancer.htm
>>http://www.doxdesk.com/parasite/webHancer.html
>>http://simplythebest.net/info/spywa...ancer_spyware.h
t
>>ml
>>.
>>
>.
>

System Restore has no interest in most user data files such as those with
a doc, txt, wri, xls, ppt, jpg, avi, mp3 extensions (and many many more)
nor does it monitor the contents of the My Documents object. Therefore
using system restore should leave such files intact.
--
Mike Maltby MS-MVP
mike.maltby@gmail.com


Reggie <anonymous@discussions.microsoft.com> wrote:

> Same problem!
>
> How do you run a full system restore, without losing saved
> documents?
>
>
> The problem started after my scan. I removed one
> threat, "webhancer" located at c:\windows\system32
> \sporder.dll. This threat level was judged to be severe.
> I am at my wits end.

It appears to me that this issue results from a legitimate (in fact,
Microsoft authored!) dll being mistaken for a piece of Webhancer of the same
name.

I'm seeing a fair number of posts of this issue in different places--it
might help if you would all post the issue in Networking--that might make it
easier for Microsoft to see the impact this problem is having.

And I agree that winsockxpfix is probably a way to get these systems going
again without System Restore--but I don't have a success response yet to
point to.

"Webhancer Problem" <anonymous@discussions.microsoft.com> wrote in message
news:11f301c4f460$984fc960$a601280a@phx.gbl...
>I ran the spyware beta and it killed my network
> connection (now browser) and disabled my McAfee security
> center. After trying a variety of fixes I did a System
> Restore to get back online.
>
> The problem appears to be the way the beta deals with a
> rather nasty piece of spyware called Webhancer. As I
> learned from reading about it online, Webhancer can knock
> out your internet connection and cause a variety of other
> problems if it is uninstalled improperly. It appears
> Microsoft's approach has a problem. I used Spybot to get
> rid of it and had no further problem.
>
> Webhancer is a widespread piece of spyware. I suspect
> Microsoft will fix this problem soon (they had better!).
>
> About Webhancer:
> http://www.cexx.org/webhancer.htm
> http://www.doxdesk.com/parasite/webHancer.html
> http://simplythebest.net/info/spywa...ncer_spyware.ht
> ml

I find that while removing spyware with other tools
(AdAware SE, Spybot S&D) that spyware that hooks onto
winsock will kill network connections if it's yanked out
of the system.

I'll offer two solutions -
1 - quick fix - find & save winsockxpfix.exe and run it.
It'll reset your winsock (and put the files back)

2 - integrate a winsock repair inside of Microsoft
Antispyware

Cheers,
Dat

>-----Original Message-----
>It appears to me that this issue results from a
legitimate (in fact,
>Microsoft authored!) dll being mistaken for a piece of
Webhancer of the same
>name.
>
>I'm seeing a fair number of posts of this issue in
different places--it
>might help if you would all post the issue in Networking--
that might make it
>easier for Microsoft to see the impact this problem is
having.
>
>And I agree that winsockxpfix is probably a way to get
these systems going
>again without System Restore--but I don't have a success
response yet to
>point to.
>
>"Webhancer Problem" <anonymous@discussions.microsoft.com>
wrote in message
>news:11f301c4f460$984fc960$a601280a@phx.gbl...
>>I ran the spyware beta and it killed my network
>> connection (now browser) and disabled my McAfee security
>> center. After trying a variety of fixes I did a System
>> Restore to get back online.
>>
>> The problem appears to be the way the beta deals with a
>> rather nasty piece of spyware called Webhancer. As I
>> learned from reading about it online, Webhancer can
knock
>> out your internet connection and cause a variety of
other
>> problems if it is uninstalled improperly. It appears
>> Microsoft's approach has a problem. I used Spybot to get
>> rid of it and had no further problem.
>>
>> Webhancer is a widespread piece of spyware. I suspect
>> Microsoft will fix this problem soon (they had better!).
>>
>> About Webhancer:
>> http://www.cexx.org/webhancer.htm
>> http://www.doxdesk.com/parasite/webHancer.html
>>
http://simplythebest.net/info/spywa...ncer_spyware.ht
>> ml
>
>
>.
>

I had the exact same problem last night.The beta install
went well then I ran a scan.The scan found 4 nasty's
including Webhancer.after removing the spyware and
rebooting, my computer said to reinstall Mcafee privacy
service and I was also unable to connect to the internet.I
then removed the beta program via the add/remove program
and then did a system restore.Everything seems ok now.I'll
stick with adaware and spybot s&d untill the beta program
gets the bugs out of it.best regards
>-----Original Message-----
>I ran the spyware beta and it killed my network
>connection (now browser) and disabled my McAfee security
>center. After trying a variety of fixes I did a System
>Restore to get back online.
>
>The problem appears to be the way the beta deals with a
>rather nasty piece of spyware called Webhancer. As I
>learned from reading about it online, Webhancer can knock
>out your internet connection and cause a variety of other
>problems if it is uninstalled improperly. It appears
>Microsoft's approach has a problem. I used Spybot to get
>rid of it and had no further problem.
>
>Webhancer is a widespread piece of spyware. I suspect
>Microsoft will fix this problem soon (they had better!).
>
>About Webhancer:
>http://www.cexx.org/webhancer.htm
>http://www.doxdesk.com/parasite/webHancer.html
>http://simplythebest.net/info/spywa...ncer_spyware.ht
>ml
>.
>

Take a look at tools, advanced tools, system explorers, and note the Winsock
LSPs explorer. I've not run this on a system with a problem with LSP's but
it looks like the framework for this is available.

The other thing to note is that the active agents watch the LSP's, so if you
need to run winsockfix, you should probably turn off Microsoft Antispyware
first--it'll flag the activity, and perhaps prevent it.

"Dat" <datasian@hotmail.com> wrote in message
news:05d601c4f4cd$d1064aa0$a501280a@phx.gbl...
>I find that while removing spyware with other tools
> (AdAware SE, Spybot S&D) that spyware that hooks onto
> winsock will kill network connections if it's yanked out
> of the system.
>
> I'll offer two solutions -
> 1 - quick fix - find & save winsockxpfix.exe and run it.
> It'll reset your winsock (and put the files back)
>
> 2 - integrate a winsock repair inside of Microsoft
> Antispyware
>
> Cheers,
> Dat
>
>>-----Original Message-----
>>It appears to me that this issue results from a
> legitimate (in fact,
>>Microsoft authored!) dll being mistaken for a piece of
> Webhancer of the same
>>name.
>>
>>I'm seeing a fair number of posts of this issue in
> different places--it
>>might help if you would all post the issue in Networking--
> that might make it
>>easier for Microsoft to see the impact this problem is
> having.
>>
>>And I agree that winsockxpfix is probably a way to get
> these systems going
>>again without System Restore--but I don't have a success
> response yet to
>>point to.
>>
>>"Webhancer Problem" <anonymous@discussions.microsoft.com>
> wrote in message
>>news:11f301c4f460$984fc960$a601280a@phx.gbl...
>>>I ran the spyware beta and it killed my network
>>> connection (now browser) and disabled my McAfee security
>>> center. After trying a variety of fixes I did a System
>>> Restore to get back online.
>>>
>>> The problem appears to be the way the beta deals with a
>>> rather nasty piece of spyware called Webhancer. As I
>>> learned from reading about it online, Webhancer can
> knock
>>> out your internet connection and cause a variety of
> other
>>> problems if it is uninstalled improperly. It appears
>>> Microsoft's approach has a problem. I used Spybot to get
>>> rid of it and had no further problem.
>>>
>>> Webhancer is a widespread piece of spyware. I suspect
>>> Microsoft will fix this problem soon (they had better!).
>>>
>>> About Webhancer:
>>> http://www.cexx.org/webhancer.htm
>>> http://www.doxdesk.com/parasite/webHancer.html
>>>
> http://simplythebest.net/info/spywa...ncer_spyware.ht
>>> ml
>>
>>
>>.
>>

Thanks for the report!

Can you tell us the exact name and version of the McAfee product involved?

There seems to be a single false-positive on a particular file that is the
root cause of this issue, and it shouldn't be hard to fix.

<anonymous@discussions.microsoft.com> wrote in message
news:0b3701c4f4ce$ceae0d50$a301280a@phx.gbl...
>I had the exact same problem last night.The beta install
> went well then I ran a scan.The scan found 4 nasty's
> including Webhancer.after removing the spyware and
> rebooting, my computer said to reinstall Mcafee privacy
> service and I was also unable to connect to the internet.I
> then removed the beta program via the add/remove program
> and then did a system restore.Everything seems ok now.I'll
> stick with adaware and spybot s&d untill the beta program
> gets the bugs out of it.best regards
>>-----Original Message-----
>>I ran the spyware beta and it killed my network
>>connection (now browser) and disabled my McAfee security
>>center. After trying a variety of fixes I did a System
>>Restore to get back online.
>>
>>The problem appears to be the way the beta deals with a
>>rather nasty piece of spyware called Webhancer. As I
>>learned from reading about it online, Webhancer can knock
>>out your internet connection and cause a variety of other
>>problems if it is uninstalled improperly. It appears
>>Microsoft's approach has a problem. I used Spybot to get
>>rid of it and had no further problem.
>>
>>Webhancer is a widespread piece of spyware. I suspect
>>Microsoft will fix this problem soon (they had better!).
>>
>>About Webhancer:
>>http://www.cexx.org/webhancer.htm
>>http://www.doxdesk.com/parasite/webHancer.html
>>http://simplythebest.net/info/spywa...ncer_spyware.ht
>>ml
>>.
>>