Hijack by isearch

My browser (ie) has been hijacked by isearch. It always goes to the isearch home page and puts two folders in my bookmarks that point to porn sites! That's all I need my six year old to click on. I have followed the steps on the "things to do before you ask for help" page with no luck. Any help would be appreciated. BTW, I also use firefox and it has not been effected.

 

wow, that happened to me twice and now im ready for the next time it happens......

DONT post your hijackthis log yet (since i wouldnt be able to tell you what to delete) BUT wait for someone to come and ask you for it.....i posted mine on another site, and when they told me to delete stuff, it was fixed


the only advice i can give you is to wait for someone to ask for your hijackthis log

 

fmlipton

Please, take the time to go through the following tutorial entitled READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Going through the tutorial may eliminate your problem. Please post back with the results.

Thank You,

 

I went through the walkthrough with no luck. I did find a few files here and there, can't remember their names, but nothing worked. I did delete everything that was recommended. I run spybot and ad-aware regularly and find something almost everytime.

 

Have you read the following post?
NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

If not, please read it.

Please follow the instructions in the HJT Tutorial and attach your HJT log with your next post.

 

Here's my HijackThis log.

 

fmlipton,

Please look in Add or Remove Programs for the following and Uninstall them if found:

MyWay


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotsearchbar.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
(If you need this then keep it)

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)

O2 - BHO: ohb - {285B5CCD-C3F0-4EB6-9632-7D0A3C3AF824} - C:\WINDOWS\system32\hsrb.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iiqwgn] c:\windows\system32\iiqwgn.exe

O8 - Extra context menu item: bugmenot - file://C:\Program Files\bugmenot.htm

O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4047/ftp.coupons.com/v3123/cpbrkpie.cab
O16 - DPF: {DE910060-8EFB-44B9-B492-75180696643F} (iiittt Class) - http://www.hotsearchbar.com/toolbar30/hsrb.cab

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\MyWaySA ←–– Delete this whole folder if it exist!

C:\WINDOWS\system32\hsrb.dll

c:\windows\system32\iiqwgn.exe

C:\Program Files\bugmenot.htm

NEXT:
Run CCleaner

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing ALL of the above, Scan with HijackThis and attach the new log.

 

I've done what you asked. I deleted MyWaySA, however, it was in the add/remove programs list after I rebooted. It no longer had a remove button so it's still there. I found no folder for the program. Here's my new HJT log.

 

Your log is clean!

Are you having any further problems?

 

Yes, everything is working fine. Thanks for your help, my head was getting sore from pounding it against the wall.

 

Great!

You should see this article on How to Protect yourself from malware!