Has spyware zapped my PC?

[Stan Sted]

Can anyone suggest how I can get my old PC back on line after it was apparently zapped by Spy or adware?

Whenever I try to start up IE I get this message:

"Downloading from site:res://C:WINDOWS\SYSTEM\SHDOCLC.DLL/dnserror.htm"

I had NAV, Zone Alarm and Spybot running, but after my son used the machine for an MSN session with his chums, we found more than 140 cases of a spyware file (the name of which I can't remember) and when we deleted them all we lost IE shortly afterwards. Rest of my network is OK and cable signal is still fine to a laptop and a Mac

I hope to fix this today so that the family can use the machine while I am away from tomorrow.

cheers

SS

[Keef]

There's more information than you could ever eat in the thread here: http://www.pprune.org/forums/showthread.php?s=&threadid=117136

That's worked for me when I had an attack of the nasties.

You may have to reload IE afterwards, although the fact that it's an HTM file that's causing the problem indicates a fairly simple cure.

[Stan Sted]

Thanks Keef

I did check through that thread before submitting my post. However, I could find no trace in any of the posts or links of the bizarre error message I am receiving.

Earlier I searched google and found several entries for the error message but some of the cures seemed so difficult and risky that I felt I could easily bugger things up and make matters worse.

The technical types on PPRuNe have come to my rescue many times in the past. Their simple solutions written in plain English are so much more easy to follow than some of the entries penned in technospeak elsewhere..

[Keef]

I looked on Google - there is a lot on there about it. It looks as if there are several different potential causes of what you have, with a different cure for each.

The probability is that in removing the nasties, something has been damaged or deleted that IE needs to run. A suggestion that looked like my way of fixing things was this:
Try a repair on Internet
Explorer in the Add-Remove programs applet, Windows Installation, by double-clicking
on the entry "Microsoft Internet Explorer and internet tools" and choosing Repair.

If that doesn't do it, are you running the Microsoft Firewall? I found that does strange things, and turned it off in favour of using ZoneAlarm.

[Stan Sted]

Keef

I think I saw the same solution, but I could not find a repair section on my Internet Explorer. Must be because I have an old version 5.50 and am using Windows 98. Should have upgraded years ago. However, I did download all the Microsoft upgrades. Perhaps one of the upgrades has been zapped?

[stickyb]

The message you are seeing is, i think, the standard one that ie uses when it can't get at whatever has been set as its hone page.
Things to check - has the home page been hi jacked? What is the home page set to?
Do you have any internet connection at all? does anything else work? has your firewall blocked ie?

[Stan Sted]

Home page was hijacked but I didn't make a note of it before resetting to the usual NTLworld. I have no internet connection at the moment, although everything is fine to the router and to a wireless laptop and a Mac wired from the router.
There is no firewall on at the moment - I deleted NAV and Norton firewall, and all my other usual safety nets while trying to re-establish a connection.
I have thoroughly checked and re checked the usual internet settings and found nothing wrong.

[E-Liam]

Hi Stan,

Please download 'Hijack This!' from here (http://www.thespykiller.co.uk/), unzip, and place it in it’s own folder, (not in the temp folder, or on the desktop) doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a reply. (Please disable smileys)

This will give me a rundown of what’s going on in your PC. Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required.

Cheers

Liam
---------------------------------------------------------------------------------
A member of the Alliance of Security Analysis Professionals (http://asap.maddoktor2.com/) since 2004.

[Stan Sted]

Back from trip and having another look at PC problem.

Liam, thanks for the offer of help but unfortunately I can't download anything because I can't log the PC on to the internet. I am sending this via a Mac.

I have checked all the NTL broadband settings and these all appear to be in order. I have disconnected the PC from the router and have tried to access the net directly through the NTL cable modem which is working correctly.

I initially thought there might be a problem with the PC talking to the router but everything is set up for auto connection so I can't really see how it could be a problem.

I will check the seating of the ethernet card (which on first examination does seem a little wobbly) and may also try to connect via a USB lead

I suppose the next thing to do is reload the drivers and reload IE6 or even Windows 98 SE which I use on my ancient PC. After that I will join the queue to talk to the NTL techies.

Dunno what else I can do, except get a better PC. Any thoughts?

[E-Liam]

Hi Stan,

You can download HJT via the Mac to a (formatted) floppy, run on the PC, then put the log on the disc to post back.

It may or may not help, but it will certainly rule out a few possibilities.. :)

Cheers

Liam

[Stan Sted]

Hi Liam

thanks for the suggestion but I am afraid my computer knowledge is rather limited and I wouldn't have a clue how to format a floppy to make a Mac talk to a PC let alone do the other things.

I think the problem may be something extremely basic because whenever I try to connect the PC to the net I get this message:
"cannot find server or DNS error" at the bottom of the page that is headed "The page cannot be displayed"