Hi Sami,
I have had the same problem for a number of months.
I Can't access gc.ca (Gov't of Canada) sites. And it's tax time!
I opened and downloaded HijackThis just now. It's results has almost the same Line 17 items (6 line items) listed above.
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.77 85.255.112.212
Except last 5 digits of the Name Server numbers are different.
Is it safe to just "fix" those 6 lines?

Yes its safe to delete those lines. But if you want you can post your log file here so that we can analyze it, and can guide you what to remove.

__________________

SysChat Free computer tech support

Wow you are GOOD!
I used the hijackthis download and the Fix and Repair icon after ticking the 6 lines of Line 017 info.
I could then successfully access the Government of Canada websites!
And sent them all my tax money! Gee thanks!
Seriously, you are to be commended.
I thank you.
I thank Google for helping me find SysChat and the previous poster Boardwalker and the hijackthis developer.
But you Sami found the problem and pointed the way out. Hats off.

V

I'm glad every thing is working well for you.
This site is a Jewel and so are the people who keep it going.
I can only guess at the amount of time it takes to create and maintain the site.
I for one sure do appreciate it.
I came in here with a problem, very frustrated because of my inability to understand what was wrong.
Although I was on the verge of becoming a huge pain in the butt, I was dealt with fairly and with respect!
I am hoping that through study of this site I may be able to help someone in the future. Thanks again,
Emery

I just thankfully found this thread.

I have the same problem on my fathers computer - he is turning 80. All the gc.ca sites are being redirected on his system to somes sites that he would definitely not visit if you know what I mean. I hope to try this solution and will see what it can do. Thanks for bringing your problem on line so others can see what assistance they gave you here. Wish me luck with my attempts.

Will be posting a log of my problem soon.

Pizza in Canada - Tax season and a hijacked gc.ca site is not at all good for some if not all systems.

Hi Pizza53;
I know exactly what you mean.

Before the good people here fixed my problem, I would type in a .gc.ca site by other means and I would be re-directed to some astonishing sites with my Grandchildren looking over my shoulder, (not good!)

I have no idea how this happened, I suspect that one of my security systems messed up.
I tried contacting them both of them, and including the kahuna of the INTERNET, I won't mention any names.

What did I get= (thank you for buying our products)
Glad your problem is fixed and I hope you enjoy this site.
Cheers

Hello,

Here is a zip file of hackthisJE.log.

This is the log of my fathers computer where we have the gc.ca problem and I ran Adaware and Spybot. When I ran spybot I found 4 errors relating to Micorosoft.Windows.Security.InternetExplorer:Setti ngs...
where the registry for
HKEY_LOCAL_MACHINE\Software\Internet Exploreer\Main\FeatureControl\FEATURE_LOCALMACHINE _LOCKDOWN\explorer.exe!=W=1

Mircosoft.WindowsSecurityCenter.AntivirusDisableNo tify:Settings...
where the registry for
HKEY_LOCAL_MACHINE\Software\Security Center\AntiVirusDisableNotify!=dword:0

Mircorsoft.WindowsSecurity Center.FirewallDisableNotify:Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Microsoft WindowsSecurityCenter_disabled: Settings....
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wscsvc\Start!=W=2

I removed these using Spybot.

Today I looked at his system and the Window Security Center told me that he did not have any antivirus, but at that moment the Nortons on his machine was doing an update and I had it scan, but the Security Center did not recognise that the program Nortons was on and running.... sheesh...

I ran Hijack This and got the following log.

Thanks for any help that you can give me.

Pizza53

Just noticed the following in the log...

O17 - HKLM\System\CCS\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{3482D08E-2DA5-4264-B691-5C40CE4F7A77}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165

Same as what was seen in the log of Boardwalker...

Is there anything else that could cause the other probem, or should I reset the registry back from what spybot had removed....

Hi Pizza53,

Yes remove these 5 entries, rest of them are ok.

O17 - HKLM\System\CCS\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{3482D08E-2DA5-4264-B691-5C40CE4F7A77}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{18483498-4575-4C26-A6A1-BBA73B54A840}: NameServer = 85.255.114.43,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.43 85.255.112.165

__________________

SysChat Free computer tech support

I am seeing the exact same problem ... used Hijack This - deleted the same entries BUT still can not gain access to the gc.ca domains.

Thanks in Advance,
Steve

Attached Files

HijackThis.log (7.5 KB, 555 views)