HELP!!!!!!!! Please decypher this code

[Hickpoppy]

res://C:\WINDOWS\SYSTEM\SHDOCLC.DLL/offcancl.htm#http://www.**********.com

Is this what is causing the automatic IE Homepage switch at start-up?? How can I get rid of this?

Someone PLEASE HELP!!

 

[smp]

I'm not sure about that string, but...
If you mean that when you start IE it goes to the bad homepage, then you go to tools>internet options>homepage and set it, then restart IE and it's back to the same thing. What I did, was shut down IE.
Right click on the IE desktop icon and go to internet options from there, while IE is NOT running. Change the homepage. Start IE and your problem should be fixed. Of course, your problem might have a different cause than mine, but try that anyways.

 

[Hickpoppy]

shut down IE?? I have tried changing it using Internet Options with the program running and not running. I feel it has something to do with that file. I mean, res://C:\WINDOWS\SYSTEM\SHDOCLC.DLL looks like the normal .dll file is being reset.

Any ideas how to get rid of this app?

 

[blahblah99]

it gives you that error when u try to visit a porn site but your mom/dad has put a filter on your net access.

 

[Evadman]

That could also be a DNS server error.

<edit>
Man, I miss my spell-checker

 

[Hickpoppy]

No porno filter running, and changing the homepage using Internet Tools does not work. It is happening at Start-up. This piece of code is somehow running at start-up and changing the IE homepage. Any ideas on how to extract this code?

 

[earthman]

If its running at startup then find out what programs are starting up and you should be able to eliminate it easily. Some malicious web sites use a string like this to force you to keep loading their page. Its probably a registry key in one of the run folders, but you may have something downloaded too thats doing the actual changing. If you can't find a key, try renaming that .dll and see what happens.

 

[RemyCanad]

Is that in your autoexec.bat file? if so just put REM in front of it and see what happens. Make sure to put a space after REM.