Can't follows links to .zip or .exe files

[Guest]

Hi,

I recently removed the nkvd.us adware from my system
(after becoming infected following a wayward click to
allow an ActiveX control), and now have my homepage,
default homepage, search page, etc. back to normal.
However, when I left-click a (valid) link to a .exe
or .zip file in IE6, the 'The page cannot be displayed'
error page appears, with 'http:///' in the address bar.
Right-clicking a .exe or .zip link then choosing 'Open'
or 'Open in new window' gives the same problem. Links
to .htm, .txt, .pdf, and .doc files work fine. I can also
right-click links to .exe and .zip files and download
them that way with no problem. Mozilla is unaffected.
I've tried Google, the MSKB, an IE MVP site, and a
computing support messageboard, all with no luck. Can
anyone advise how to fix this?

Thanks.

 

[H Leboeuf]

http:/// is indicative of this nasty parasite. Get the removal tool.

CoolWebSearch - CWS http://www.spywareinfo.com/articles/cws/
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/cwshredder.zip
More: Removal tool:
http://www.symantec.com/avcenter/venc/data/vbs.bootconf.html
More: http://www.spywareguide.com/product_show.php?id=640
--

If unable to connect.
Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm


Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm

 

[Guest]

Henri,

Thanks a lot for your comprehensive reply. I had already
used CWShredder to help remove the spyware. The only
problem that appears to remain is the one I described.
CWShredder, AdAware, Spybot, Spyware Blaster, Hijack
This, IE Restrictions, IE Manager, Diagnose Windows, Spy
Sweeper, and BHO Captor all give my system a clean bill
of health as far as I can tell.

I unchecked Tools>Internet
Options>Advanced>Browsing>Enable 3rd party browser
extensions as you suggested, and this did indeed fix the
problem. However, neither AdAware nor Spybot were able to
find anything wrong.

I'd be very grateful if you have any further suggestions
for resolving this problem.

Thanks,

Michael

 

[H Leboeuf]

See if you can find which variant is the culprit. There may be some
instructions how to delete by hand.

Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
======

Here is a post by Mike Burgess, check the registry.

Some program (usually spyware\parasite) may have overridden the URL prefix
setting?
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Includes: Repair the corrupted or altered (spyware) HTTP prefixes
See section: Various Registry Fixes = "RepairDefaultPrefix.reg"
[or - manually]
Open Regedit to the following locations and verify the below default
entries:
Start | Run (type) "regedit" (no quotes)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

Note: edit as needed, *always* Export before editing.
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/

========

If all fails get help from this forum.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/

 

[Guest]

Henri,

Thanks again for your reply.

I followed your suggestion and checked
http://www.spywareinfo.com/~merijn/cwschronicles.html
again, which has been updated since I first looked with
info on CWS.Smartfinder.2. I used Hijack This to remove
the BHO, then renamed C:\WINDOWS\System32\mshelper.dll,
restarted, and deleted the file. Everything now seems to
be back to normal.

Thanks very much for your help.

Michael

-----Original Message-----
See if you can find which variant is the culprit. There may be some
instructions how to delete by hand.

Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
======

Here is a post by Mike Burgess, check the registry.

Some program (usually spyware\parasite) may have overridden the URL prefix
setting?
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Includes: Repair the corrupted or altered (spyware) HTTP prefixes
See section: Various Registry Fixes = "RepairDefaultPrefix.reg"
[or - manually]
Open Regedit to the following locations and verify the below default
entries:
Start | Run (type) "regedit" (no quotes)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\URL\DefaultPre

fix]
@="http://"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\URL\Prefixes]

"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

[HKEY_CURRENT_USER\Software\Microsoft\Internet

Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

Note: edit as needed, *always* Export before editing.
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/

========

If all fails get help from this forum.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/h ijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/

Henri,

Thanks a lot for your comprehensive reply. I had already
used CWShredder to help remove the spyware. The only
problem that appears to remain is the one I described.
CWShredder, AdAware, Spybot, Spyware Blaster, Hijack
This, IE Restrictions, IE Manager, Diagnose Windows, Spy
Sweeper, and BHO Captor all give my system a clean bill
of health as far as I can tell.

I unchecked Tools>Internet
Options>Advanced>Browsing>Enable 3rd party browser
extensions as you suggested, and this did indeed fix the
problem. However, neither AdAware nor Spybot were able to
find anything wrong.

I'd be very grateful if you have any further suggestions
for resolving this problem.

Thanks,

Michael


http://www.symantec.com/avcenter/venc/data/vbs.bootconf.h culprit
(s) is/are with

.

 

[H Leboeuf]

Glad I could help.

Keep these tools up to date.

--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

Henri,

Thanks again for your reply.

I followed your suggestion and checked
http://www.spywareinfo.com/~merijn/cwschronicles.html
again, which has been updated since I first looked with
info on CWS.Smartfinder.2. I used Hijack This to remove
the BHO, then renamed C:\WINDOWS\System32\mshelper.dll,
restarted, and deleted the file. Everything now seems to
be back to normal.

Thanks very much for your help.

Michael

-----Original Message-----
See if you can find which variant is the culprit. There may be some
instructions how to delete by hand.

Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
======

Here is a post by Mike Burgess, check the registry.

Some program (usually spyware\parasite) may have overridden the URL prefix
setting?
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Includes: Repair the corrupted or altered (spyware) HTTP prefixes
See section: Various Registry Fixes = "RepairDefaultPrefix.reg"
[or - manually]
Open Regedit to the following locations and verify the below default
entries:
Start | Run (type) "regedit" (no quotes)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\URL\DefaultPre

fix]
@="http://"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\URL\Prefixes]

"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

[HKEY_CURRENT_USER\Software\Microsoft\Internet

Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

Note: edit as needed, *always* Export before editing.
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/

========

If all fails get help from this forum.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/h ijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/

Henri,

Thanks a lot for your comprehensive reply. I had already
used CWShredder to help remove the spyware. The only
problem that appears to remain is the one I described.
CWShredder, AdAware, Spybot, Spyware Blaster, Hijack
This, IE Restrictions, IE Manager, Diagnose Windows, Spy
Sweeper, and BHO Captor all give my system a clean bill
of health as far as I can tell.

I unchecked Tools>Internet
Options>Advanced>Browsing>Enable 3rd party browser
extensions as you suggested, and this did indeed fix the
problem. However, neither AdAware nor Spybot were able to
find anything wrong.

I'd be very grateful if you have any further suggestions
for resolving this problem.

Thanks,

Michael


-----Original Message-----
http:/// is indicative of this nasty parasite. Get the
removal tool.

CoolWebSearch - CWS
http://www.spywareinfo.com/articles/cws/
More: Complete list by variant with up-to-date
information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
More: Removal tool:
http://www.symantec.com/avcenter/venc/data/vbs.bootconf.h
tml
More: http://www.spywareguide.com/product_show.php? id=640
--

If unable to connect.
Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit
(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

Dealing with Unwanted Spyware, Parasites, Toolbars and
Search Engines
http://mvps.org/winhelp2002/unwanted.htm


Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm


Hi,

I recently removed the nkvd.us adware from my system
(after becoming infected following a wayward click to
allow an ActiveX control), and now have my homepage,
default homepage, search page, etc. back to normal.
However, when I left-click a (valid) link to a .exe
or .zip file in IE6, the 'The page cannot be displayed'
error page appears, with 'http:///' in the address bar.
Right-clicking a .exe or .zip link then choosing 'Open'
or 'Open in new window' gives the same problem. Links
to .htm, .txt, .pdf, and .doc files work fine. I can
also
right-click links to .exe and .zip files and download
them that way with no problem. Mozilla is unaffected.
I've tried Google, the MSKB, an IE MVP site, and a
computing support messageboard, all with no luck. Can
anyone advise how to fix this?

Thanks.


.

.