spywatre, adware or virus?

[DB]

Been having huge problems getting on the internet for two days. my email
works but when I try to browse the internet all I get is "Page cannot be
displayed"

I am running WINXP and using Bell Sympatico High Speed.
I ran Adaware, Spybot and did a virus scan, each program detected some exe
and dll files and deleted them.

When I try to browse I also get the following at the bottom:

Downloading from site: res://c:\windows\system32\shdoclc.dll/dnserror.htm

I cannot get onto ANY website at all................

anyone have any ideas? This is really frustrating.

Thanks
DB

[Robin T Cox]

"DB" <Drbutchermd@hotmail.com> wrote in
news:r4qxb.16049$dt2.1304274@news20.bellglobal.com :

> Downloading from site: res://c:\windows\system32\shdoclc.dll/dnserror.htm
>
> I cannot get onto ANY website at all................
>
> anyone have any ideas? This is really frustrating.
>

There may be a clue in this link:
http://www.generation.net/~hleboeuf/...c.htm#SHDOCDSN

I suggest you download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log, load it in Notepad, and copy its contents. Most
of what it lists will be harmless or even essential, don't fix anything
yet.

Then go to http://forums.spywareinfo.com/
where you'll get expert help.

Just sign in, or post as a guest,and go to the Spyware and Hijackware
Removal Support section. Press "new topic", explain your problem, and
copy and paste the contents of the Hijack This log into your new message.

[DB]

thanks for your info, problem is that I cannot browse the internet. Each
page says Page cannot be displayed. I can log onto the internet but cannot
browse, I can send and receive email, check newsgroups and use p2p programs
but thats it.....

I'll try kazzaa for Highjack this.


"Robin T Cox" <robin2803@hotmail.com> wrote in message
news:Xns9440BA9727B2Brobin2803@62.253.162.114...
> "DB" <Drbutchermd@hotmail.com> wrote in
> news:r4qxb.16049$dt2.1304274@news20.bellglobal.com :
>
> > Downloading from site:
res://c:\windows\system32\shdoclc.dll/dnserror.htm
> >
> > I cannot get onto ANY website at all................
> >
> > anyone have any ideas? This is really frustrating.
> >
>
> There may be a clue in this link:
> http://www.generation.net/~hleboeuf/...c.htm#SHDOCDSN
>
> I suggest you download 'Hijack This!'. http://www.tomcoyote.org/hjt/
> Unzip, doubleclick HijackThis.exe, and hit "Scan".
>
> When the scan is finished, the "Scan" button will change into a "Save Log"
> button.
> Press that, save the log, load it in Notepad, and copy its contents. Most
> of what it lists will be harmless or even essential, don't fix anything
> yet.
>
> Then go to http://forums.spywareinfo.com/
> where you'll get expert help.
>
> Just sign in, or post as a guest,and go to the Spyware and Hijackware
> Removal Support section. Press "new topic", explain your problem, and
> copy and paste the contents of the Hijack This log into your new message.

[Whiskers]

In alt.privacy.spyware on Thursday 27 Nov 2003 7:52 pm, DB
<Drbutchermd@hotmail.com> wrote:

> thanks for your info, problem is that I cannot browse the internet. Each
> page says Page cannot be displayed. I can log onto the internet but cannot
> browse, I can send and receive email, check newsgroups and use p2p
> programs but thats it.....
>
> I'll try kazzaa for Highjack this.

Have you tried a different browser? Magazine CDs sometimes have Mozilla or
Netscape or Opera.

--
-- ^^^^^^^^^^ Interested in Citroens?
-- Whiskers <http://www.aacit.net>
-- ~~~~~~~~~~ <news:alt.autos.citroen>

[sponge]

On Thu, 27 Nov 2003 13:52:51 -0600, "DB" <Drbutchermd@hotmail.com>
wrote:

>thanks for your info, problem is that I cannot browse the internet.
Each
>page says Page cannot be displayed. I can log onto the internet but
cannot
>browse, I can send and receive email, check newsgroups and use p2p
programs
>but thats it.....
>
>I'll try kazzaa for Highjack this.

First, if you're running KaZaa (and not the spyware-free KaZaalite),
that probably explains why this problem is occurring.

Second, download it from http://tomcoyote.org/hjt. I would NOT
download programs from KaZaa; I've seen too many that are infected
with trojans or worms.

Third, as DB touched upon, you can prevent the vast majority of these
and other problems by simply switching to a different browser; I
recommend Mozilla or Opera.

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 att yahoo dott com

[sponge]

Correction: Whiskers deseves credit for the advice.

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 att yahoo dott com

[ChasMays]

No offense but these people have no clue what they are talking
about...why would you tell a person who cannot get to the Internet to
download a program from the Internet...stupid lemmings! Anyway, here
is your fix...It from a Microsoft Article 318584...it works! You're
basically deleting (first backing up) two Registry Keys, uninstalling
TCP/IP, rebooting, and then reinstalling TCP/IP...Internet access
restored!!!!

CAUSE
This behavior may occur if the WinSocks library or the TCP/IP stack
are corrupted.
RESOLUTION
To resolve this issue, follow these steps.

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system.
Microsoft cannot guarantee that you can solve problems that result
from using Registry Editor incorrectly. Use Registry Editor at your
own risk.


Click Start, and then click Run.
In the Open box, type Regedit, and then press ENTER.
Navigate to the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock

On the Registry menu, click Export Registry File.
In the File name box, type the name of the backup file; for example,
type Winsock Registry key, and then click Save. Note the name of the
folder in which the registration file is saved.
Repeat steps 3 through 5 for the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock2

Delete the following keys from the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Winsock2

NOTE: Steps 3 through 6 backed up the two registry keys. You can use
the backup files to restore the keys in the event that your computer
displays unexpected behavior. For more information about how to
restore registry keys from .reg files, search the Registry Editor Help
files for the Import or export registry keys topic.


Close the Registry Editor.
Uninstall the TCP/IP protocol. To do this, follow these steps:
In Control Panel, click Network and Dial-up Connections, right-click
Local Area Connection, and then click Properties on the shortcut menu.
Under Components checked are used by this connection, click Internet
Protocol (TCP/IP), and then click Uninstall.
Follow the on-screen instructions to uninstall TCP/IP.
Restart your computer, and then reinstall TCP/IP if it is not
installed automatically:
In Control Panel, double-click Network and Dial-up Connections,
right-click Local Area Connection, and then click Properties on the
shortcut menu.
Click Install.
In the Select Network Component Type dialog box, click Protocol, and
then click Add.
Under Manufacturers, click Microsoft, click Internet Protocol (TCP/IP)
under Network Protocol, and then click OK.
Follow the on-screen instructions to install TCP/IP.
Reset your modem by turning the power off and then on.
Test your Internet connectivity.