The majority of users running WebHancer are not aware they are running it, unless they have noticed system side-effects or unusual data transfers from their machine. WebHancer, like “Comet Curse”, falls into the category of “everything-installs-it-can’t-get-rid-of-it” foistware, with completely unrelated software secretly installing the WebHancer product on the user’s system. (Given this, I think the program should be more aptly called “WebCancer” 🙂 In one of the most user-hostile moves I’ve seen in a while, the clandestine WebHancer install will alter critical Registry keys relating to Windows Sockets, causing the system’s Internet connection capabilities to break if the user dares to try uninstalling the spy. WebHancer’s makers claim not to modify system files (which is, technically, true) although they have confirmed that attempting to remove it will break your system.
How to remove:
As noted earlier, simply deleting WebHancer files from your system will result in losing your ability to connect to the Internet. WebHancer modifies your Windows Sockets configuration, binding itself to Winsock so that all packets are passed through WebHancer.
WebHancer’s suggested removal method is to make sure WebHancer is installed, and remove it using Windows’ Add/Remove Software feature as described at the bottom of WebHancer’s installation page. If you have already deleted WebHancer components, the company suggests that you download (or get a friend to download, due to the connectivity problem!) their Customer Companion, fully install it, then use Add/Remove Programs to uninstall.
WebHancer can also be safely removed by pest-removal software such as Spybot Search&Destroy and AD-Aware.
If you cannot access the Internet and simply need to restore Internet access, try LSP-Fix program to repair the portion of the registry WebHancer and similar programs like to damage.
Be warned: Although uninstallation can in some cases go off without a hitch, in other cases it is extremely difficult to remove WebHancer completely. This letter from Doug D. explains just such a case.
WebHancer conflict with Microsoft IIS – causes problems with ASP scripts
Problems have been reported when WebHancer installs itself on a Windows 2000 system running IIS. Robert G. writes:
“It causes server script ASP pages to not work at all when the web application settings are in medium and high isolation modes. The default mode is medium which allows pretty good performance benefits over “low isolation” mode. WebHancer doesn’t seem to cause a problem with ASP pages when using low isolation mode.”
The suggested solution is to remove WebHancer and things should work as before. This semi-related MS Knowledge Base article may also be of interest:
Q303379: Firewall Client Conflict with Third-Party Layered Service Providers Causes Connectivity Problems
WebHancer associated with shdocvw.dll and Explorer errors, and bluescreens
An involuntary WebHancer user reports the following issues after a (failed) removal of WebHancer:
* Error messages:
“An error or exception occurred while calling the function “DllInstall” in “C:\WINDOWS\SYSTEM\shdocvw.dll”
“Explorer has caused an error in SHDOCVW.DLL. Explorer will now close.”
Similar error messages referring to SHELL32.DLL.
* Bluescreen errors
If anyone has also had this experience, please let me know (especially, if you know how to fix this 🙂
Other information:
The webhancer process will appear on the Ctrl-Alt-Delete list (Task List) in Windows as Whagent. Any of the following files in your Windows directory indicate a WebHancer infestation:
* webhdll.dll
* whagent.inf
* whInstaller.exe
* whInstaller.ini
* regwebh.dll
* wbhshare.dll
* whiedc.dll
* whiehlpr.dll
* whieshm.dll
Removal Instructions:
From WebHancer:
If you have lost connectivity is this usually a sign of incorrectly removing the customer Companion. To correct this problem, re-install the Customer companion and follow the instructions below to remove.
How do I remove it completely?
To remove the agent, Click: START–>SETTING–>CONTROL PANEL
double click on ADD/REMOVE Programs.
scroll down to WEBHANCER AGENT and click ADD/REMOVE.
1. In your Windows (Winnt) directory, you can delete these files as well, as they are dll’s and files used only by the our agent:
sporder.dll
webhdll.dll
whagent.inf
whInstaller.exe
whInstaller.ini
2. Delete the WebHancer folder in the Program Files directory. (If you get a sharing violation on the wbhshare.dll its because its been loaded, you’ll need to reboot before deleting this directory).
3. Delete all the files out of you temp directory (most likely c:\temp). These files were put here temporarily during installation.
atlansi.dll
atlunicode.dll
license.txt
regwebh.dll
sporder.dll
wbhshare.dll
webhdll.dll
whAgent.exe
whAgent.inf
whAgent.ini
whiedc.dll
whiehlpr.dll
whiehlpr.ini
whieshm.dll
whInstaller.exe
whInstaller.ini
A Caution
Andreas M. reports that some Webhancer installations coming along with other programs do not uninstall properly, even causing the Internet connection problems mentioned. The solution is to install the stand-alone version from WebHancer’s web site (ugggh), then remove it using Add/Remove Programs. Again, you can also use AD-Aware to safely remove Webhancer.
“how to” from http://www.cexx.org/webhancer.htm
