Browser Hijack?

[Guest]

I'm working with a Gateway laptop running XP Pro that was infested with
Spyware/Adware. It also had a couple viruses. Everything seems to be clean
now, after running Spybot, AdAware, Microsoft's Spyware Beta, and 2 or 3
other programs. All scans come back clean. I also did an XP boot to
CD/repair on this drive and the browser worked fine when still in SP1 mode.
As soon as I updated to SP2, the browser problems came back.

The problem specifically is that if I type in www.yahoo.com, the browser
will automatically put www in front and either .org or .net behind... so it
would make it www.www.yahoo.com.net or .org. I also cannot browse network
shares when this happens.

I would appreciate anybody's help on this.

Thanks.

 

[Jon Kennedy]

Go to Start...Run, type in regedit, click okay.
Navigate to the following:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
"Append Completion"="no"

"AutoSuggest"="no"

Then click File....Exit

 

[Guest]

Thanks Jon. Those were set to YES, so I changed them to NO. Now however, I
just get a "Page Cannot Be Displayed". It is very intermittent, with it not
working much more than working. I'm going to run down the list Jan Il has
provided on this board and will report back. It'll be difficult with an
intermittent connection, but we'll see if I can do it.

 

[Robert Aldwinckle]

The problem specifically is that if I type in www.yahoo.com, the browser

will automatically put www in front and either .org or .net behind

That's a symptom that your DNS is failing while IE's AutoSearch
is enabled.

You can bypass AutoSearch simply by using a proper protocol
prefix on the URLs you enter. E.g. if you have AutoSuggest enabled
and you start typing and you see a match in the dropdown list
then selecting a full URL (or a Favorite which links to a full URL)
should avoid the symptom.

Then your problem will be making your DNS work better.
That could be a sign of residual corruption (or continuing control
by malware) of your protocol stack.

XPsp2 has a new command which helps refresh part of the registry
which is involved with that:

E.g. enter in a command window:

netsh winsock reset

BTW there is also a show catalog command;
so before doing a reset it might be interesting
to save the old catalog display and then compare
it with the new one, just to convince yourself that
this was worth doing. The complete set of commands
for doing that would be:

netsh winsock show catalog >oldcat.txt
netsh winsock reset
netsh winsock show catalog >newcat.txt
fc oldcat.txt newcat.txt >diffcat.txt
notepad diffcat.txt

If diffcat.txt shows any differences I for one would
be interested in seeing such a report.


Here's an excerpt from a previous reply about the same issue
where I mentioned some other diagnostic and repair possibilities.
Please notice in particular my last caveat. This is slightly off-topic
for this newsgroup.

<excerpt>
FYI for XPsp2 there is a new repair command for the latter possibility:

netsh winsock reset

Otherwise there is

netsh interface ip reset

You might try checking for abnormalities beforehand by

netsh winsock show catalog type=LSP

ipseccmd show filters

(ipseccmd is on the XP Pro Support Tools)


BTW you may get better suggestions in a newsgroup
which specializes in networking for your OS.
</excerpt>


Good luck

Robert Aldwinckle