Spyware/"Home"-button hi-jacker

[alfons]

Everytime I hit "Home" in my explorer, the home adress is
automatically being changed to "res://C:\WINNT\System32
\shdoclc.dll/navcancl.htm" The page I get looks like a
search engine, and the serch window is filled in
with "Spyware removal". Changing the home adress back to
default does not help. Next time i hit the "home"-button
it starts all over again. A pop-up window with search
results for either "casinos" order "viagra" etc. appears.
Microsoft AntiSpyware does not solve the problem, and I
am not able to send them a spyware report.

 

[Ron Chamberlin]

Boot into Safe Mode (F8) at startup;
Empty your temporary files AND your Temporary Internet Files* C:\Documents
and Settings\Username\Local Settings\Temporary Internet Files folder ;
Run the scan while in safe mode;
If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck any
BHO's that you don't recognize.

Ron Chamberlin
MS-MVP



*The .tif are Temporary Internet Files, and are stored in a different barn
than 'normal' temp files.
Here's how I kludge thru to them: Open Windows Explorer--->C:\Documents and
Settings. Then it's to the Tool Bar--->Folder Options--->View--->Hidden
Files and Folders and check the box "Show hidden files and folders" > Now
expand C:\Documents and Settings and under each user you will now see a
folder "Local Settings". Open that puppy and choose Temporary Internet
Files. I am not concerned about the cookies therein, but everything else
can go for now.

 

[Ron Kinner]

Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment. Put Hijack in the subject
so I'll know it's not spam.

Ron Kinner
Microsoft MVP 2004 & 2005
(e-mail address removed)