Faulty Webhancer Removal

[Webhancer Problem]

I ran the spyware beta and it killed my network
connection (now browser) and disabled my McAfee security
center. After trying a variety of fixes I did a System
Restore to get back online.

The problem appears to be the way the beta deals with a
rather nasty piece of spyware called Webhancer. As I
learned from reading about it online, Webhancer can knock
out your internet connection and cause a variety of other
problems if it is uninstalled improperly. It appears
Microsoft's approach has a problem. I used Spybot to get
rid of it and had no further problem.

Webhancer is a widespread piece of spyware. I suspect
Microsoft will fix this problem soon (they had better!).

About Webhancer:
http://www.cexx.org/webhancer.htm
http://www.doxdesk.com/parasite/webHancer.html
http://simplythebest.net/info/spyware/webhancer_spyware.ht
ml

 

[Reggie]

Same problem!

How do you run a full system restore, without losing saved
documents?


The problem started after my scan. I removed one
threat, "webhancer" located at c:\windows\system32
\sporder.dll. This threat level was judged to be severe.
I am at my wits end.

 

[JD Gill]

Please see the following articles "How to restore the
operating system to a previous state in Windows XP".

http://support.microsoft.com/kb/306084

 

[Mike M]

System Restore has no interest in most user data files such as those with
a doc, txt, wri, xls, ppt, jpg, avi, mp3 extensions (and many many more)
nor does it monitor the contents of the My Documents object. Therefore
using system restore should leave such files intact.

 

[Bill Sanderson]

It appears to me that this issue results from a legitimate (in fact,
Microsoft authored!) dll being mistaken for a piece of Webhancer of the same
name.

I'm seeing a fair number of posts of this issue in different places--it
might help if you would all post the issue in Networking--that might make it
easier for Microsoft to see the impact this problem is having.

And I agree that winsockxpfix is probably a way to get these systems going
again without System Restore--but I don't have a success response yet to
point to.

 

[Dat]

I find that while removing spyware with other tools
(AdAware SE, Spybot S&D) that spyware that hooks onto
winsock will kill network connections if it's yanked out
of the system.

I'll offer two solutions -
1 - quick fix - find & save winsockxpfix.exe and run it.
It'll reset your winsock (and put the files back)

2 - integrate a winsock repair inside of Microsoft
Antispyware

Cheers,
Dat

 

[Guest]

I had the exact same problem last night.The beta install
went well then I ran a scan.The scan found 4 nasty's
including Webhancer.after removing the spyware and
rebooting, my computer said to reinstall Mcafee privacy
service and I was also unable to connect to the internet.I
then removed the beta program via the add/remove program
and then did a system restore.Everything seems ok now.I'll
stick with adaware and spybot s&d untill the beta program
gets the bugs out of it.best regards

 

[Bill Sanderson]

Take a look at tools, advanced tools, system explorers, and note the Winsock
LSPs explorer. I've not run this on a system with a problem with LSP's but
it looks like the framework for this is available.

The other thing to note is that the active agents watch the LSP's, so if you
need to run winsockfix, you should probably turn off Microsoft Antispyware
first--it'll flag the activity, and perhaps prevent it.

 

[Bill Sanderson]

Thanks for the report!

Can you tell us the exact name and version of the McAfee product involved?

There seems to be a single false-positive on a particular file that is the
root cause of this issue, and it shouldn't be hard to fix.