SysChat

SysChat (http://www.syschat.com/forum.php)
-   Computer Security (http://www.syschat.com/software-support/computer-security/)
-   -   Help! I can no longer access "any" .gc.ca sites (http://www.syschat.com/help-i-can-no-longer-access-1905.html)

frustrated file-er V 04-13-2007 11:50 PM

Quote:

Originally Posted by Sami (Post 6132)
Found five problems, run the HijackThis again and select these five items from your list and Click on Fix Checked

O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O8 - Extra context menu item: &Search -
O17 - HKLM\System\CCS\Services\Tcpip\..\{25A1717F-55C5-4A55-8BC3-6A025CEE66CC}: NameServer = 85.255.116.77,85.255.112.212
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.77 85.255.112.212
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.77 85.255.112.212
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.77 85.255.112.212

I Think the number 17 is causing you the problem it has put in nameservers from Ukraine

Hi Sami,
I have had the same problem for a number of months.
I Can't access gc.ca (Gov't of Canada) sites. And it's tax time!
I opened and downloaded HijackThis just now. It's results has almost the same Line 17 items (6 line items) listed above.
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.77 85.255.112.212
Except last 5 digits of the Name Server numbers are different.
Is it safe to just "fix" those 6 lines?

Sami 04-14-2007 12:26 AM

Yes its safe to delete those lines. But if you want you can post your log file here so that we can analyze it, and can guide you what to remove.

frustrated file-er V 04-14-2007 11:45 AM

gc.ca problem solved
 
:sbiggrin: Wow you are GOOD!
I used the hijackthis download and the Fix and Repair icon after ticking the 6 lines of Line 017 info.
I could then successfully access the Government of Canada websites!
And sent them all my tax money! Gee thanks!
Seriously, you are to be commended.
I thank you.
I thank Google for helping me find SysChat and the previous poster Boardwalker and the hijackthis developer.
But you Sami found the problem and pointed the way out. Hats off.

V

Boardwalker 04-14-2007 11:17 PM

I'm glad every thing is working well for you.
This site is a Jewel and so are the people who keep it going.
I can only guess at the amount of time it takes to create and maintain the site.
I for one sure do appreciate it.
I came in here with a problem, very frustrated because of my inability to understand what was wrong.
Although I was on the verge of becoming a huge pain in the butt, I was dealt with fairly and with respect!
I am hoping that through study of this site I may be able to help someone in the future. Thanks again,
Emery

Pizza53 04-15-2007 09:46 AM

Redirected gc.ca sites
 
Quote:

Originally Posted by Boardwalker (Post 6133)
Sami;
Thank you! Thank you! Thank you! :) :) :)
What a smart, Kind person you are!

I take this opportunity to thank all those who responded to my dilemma and hope that the information that has transpired may help others in the future.

Having said that, I am sure that none could be as silly as I
I don't know what went wrong to cause the problems, but I have my suspicions LOL:icon_wink:

At the risk of being a PITA, I have one more question.
Should I re-install IE7? which is what I was running before
Cheers, and good on all Ya's

I just thankfully found this thread.

I have the same problem on my fathers computer - he is turning 80. All the gc.ca sites are being redirected on his system to somes sites that he would definitely not visit if you know what I mean. I hope to try this solution and will see what it can do. Thanks for bringing your problem on line so others can see what assistance they gave you here. Wish me luck with my attempts.

Will be posting a log of my problem soon.

Pizza in Canada - Tax season and a hijacked gc.ca site is not at all good for some if not all systems.

:confused:

Boardwalker 04-15-2007 12:45 PM

re-directing
 
Hi Pizza53;
I know exactly what you mean.

Before the good people here fixed my problem, I would type in a .gc.ca site by other means and I would be re-directed to some astonishing sites with my Grandchildren looking over my shoulder, (not good!)

I have no idea how this happened, I suspect that one of my security systems messed up.
I tried contacting them both of them, and including the kahuna of the INTERNET, I won't mention any names.

What did I get= (thank you for buying our products)
Glad your problem is fixed and I hope you enjoy this site.
Cheers

Pizza53 04-15-2007 06:18 PM

GC.CA problem - Zip file of Hackthis.log
 
Hello,

Here is a zip file of hackthisJE.log.

This is the log of my fathers computer where we have the gc.ca problem and I ran Adaware and Spybot. When I ran spybot I found 4 errors relating to Micorosoft.Windows.Security.InternetExplorer:Setti ngs...
where the registry for
HKEY_LOCAL_MACHINE\Software\Internet Exploreer\Main\FeatureControl\FEATURE_LOCALMACHINE _LOCKDOWN\explorer.exe!=W=1

Mircosoft.WindowsSecurityCenter.AntivirusDisableNo tify:Settings...
where the registry for
HKEY_LOCAL_MACHINE\Software\Security Center\AntiVirusDisableNotify!=dword:0

Mircorsoft.WindowsSecurity Center.FirewallDisableNotify:Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Microsoft WindowsSecurityCenter_disabled: Settings....
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wscsvc\Start!=W=2

I removed these using Spybot.

Today I looked at his system and the Window Security Center told me that he did not have any antivirus, but at that moment the Nortons on his machine was doing an update and I had it scan, but the Security Center did not recognise that the program Nortons was on and running.... sheesh...

I ran Hijack This and got the following log.

Thanks for any help that you can give me.

Pizza53

Pizza53 04-15-2007 06:27 PM

Quote:

Originally Posted by Pizza53 (Post 6207)
Hello,

Here is a zip file of hackthisJE.log.

This is the log of my fathers computer where we have the gc.ca problem and I ran Adaware and Spybot. When I ran spybot I found 4 errors relating to Micorosoft.Windows.Security.InternetExplorer:Setti ngs...
where the registry for
HKEY_LOCAL_MACHINE\Software\Internet Exploreer\Main\FeatureControl\FEATURE_LOCALMACHINE _LOCKDOWN\explorer.exe!=W=1

Mircosoft.WindowsSecurityCenter.AntivirusDisableNo tify:Settings...
where the registry for
HKEY_LOCAL_MACHINE\Software\Security Center\AntiVirusDisableNotify!=dword:0

Mircorsoft.WindowsSecurity Center.FirewallDisableNotify:Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Microsoft WindowsSecurityCenter_disabled: Settings....
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wscsvc\Start!=W=2

I removed these using Spybot.

Today I looked at his system and the Window Security Center told me that he did not have any antivirus, but at that moment the Nortons on his machine was doing an update and I had it scan, but the Security Center did not recognise that the program Nortons was on and running.... sheesh...

I ran Hijack This and got the following log.

Thanks for any help that you can give me.

Pizza53


Just noticed the following in the log...

O17 - HKLM\System\CCS\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{3482D08E-2DA5-4264-B691-5C40CE4F7A77}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165

Same as what was seen in the log of Boardwalker...

Is there anything else that could cause the other probem, or should I reset the registry back from what spybot had removed....

Sami 04-15-2007 07:38 PM

Hi Pizza53,

Yes remove these 5 entries, rest of them are ok.

O17 - HKLM\System\CCS\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{3482D08E-2DA5-4264-B691-5C40CE4F7A77}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165

mercer.stephen 04-20-2007 06:31 PM

Help!!
 
1 Attachment(s)
I am seeing the exact same problem ... used Hijack This - deleted the same entries BUT still can not gain access to the gc.ca domains.

Thanks in Advance,
Steve


All times are GMT -4. The time now is 03:49 AM.


Copyright © 2005-2013 SysChat.com


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54