Home Search Assistant

Dotus5 · Jun 22, 2004

I have been fighting to get rid of HSA myself, and I'm hoping to get some help with this. I have read some of the other boards and it still seems like its just guessing. Let me throw my 2 cents worth in and see if it helps.

HSA actually appeared on my Add/Delete Program list in the control panel. When I tried to uninstall HSA, it came up with a message "Can not open
http://looking-for.cc/uninstall/HomeSearchAssistant.html " So I went to that site and there is an uninstall program to download.

There isn't any instructions and it doesn't seem to work when run.

On another note, my mother had gotten something simular called "Search Page". And again there is a uninstaller at http://searchpage.cc/uninstall.htm. Now, this one works. It has instruction and it did get it off my moms computer.

Is there anyone that might be able to take this info and work out any uninstall for HSA?

hon001 · Jun 28, 2004

Hi,

I have struggled with this bugger all weekend. Finally got an easy fix today, believe it or not, from a Microsoft support guy. The solution worked immediately.

Go to http://hsremove.bravehost.com and download hsremove.exe, run it, and voila!

Major Attitude · Jun 28, 2004

Hon001, looks like the same file saved to a website elsewhere, which currently isnt working. I will look into adding it here. Dotus5, have you tried system restore?

Major Attitude · Jun 28, 2004

hon001, trying to get it the website is very unstable. It appears its a file he uses to remove the only the best problem that is the new plague that no known fix exists for. We need this one if it works. I will keep trying, you can email it to me if you get a chance otherwise.

hon001 · Jun 28, 2004

Where can I find your e-mail address?

Major Attitude · Jun 28, 2004

I emailed you earlier today using your email you provided when you registered.

Major Attitude · Jun 28, 2004

Got it, thanks!

http://www.majorgeeks.com/download4284.html

ChiChi · Jun 28, 2004

You guys are great ! I have been struggling with this damn thing for over a week. Microsoft.com was no help. Spybot was no help. I changed my Registry umpteen times with no luck. One simple download from MajorGeeks and I'm back in control of my PC !!

Thank You !

Shataan · Jun 28, 2004

MajorGeeks` Kung-Fu, is greater... than ours! lol The Force IS indeed strong with them as the Emperor foretold. ;p

maganona · Jun 28, 2004

HELLO!!!!

There is any solution for Windows98 SE?

I have read that there is a program for Windows 2000 and XP...what about the other Windows??

Please....I'm completely desperated!!!!

Thanks

chaslang · Jun 28, 2004

The HSremove link states it is for all Windows.

Rookie · Jun 28, 2004

After downloading HSremove, message states Win2000 or XP only. Anything for Win98?

Major Attitude · Jun 28, 2004

I apologize, that would be my mistake. I dont have a 98 box, or even know anyone with one, to test these things. I am unaware of any other version.

rsd317 · Jun 29, 2004

I hvae run HS remover 3 times still til no avail. ater i run the program and click on interenet explorer it says "if you have received this message than your system is ok" and as soon as i restart ie it goes right back to that damn web page. someone please hlep me!!!!!! thanks.

packer2004 · Jun 29, 2004

Re:Removal instructions - Home Search Assistant

This is a link telling you how to manually remove a program from Add/remove programs in Control Panel.

http://support.microsoft.com/default.aspx?kbid=247501

Download Programs to use:

Ad-adaware 6 Build 181

HiJackThis

Uninstaller Pro (Free for 20 day use)

Security Task Manager (Free for 30 day use)

Cwshreder – Cool web Search removal tool

1) Turn Off System Restore

2) Delete the prefetch folder in C:\windows\

3) Delete files out of C:\documents and settings\(user)\local Settings\Temp & C:\documents and settings\(user)\local Settings\Temporary Internet files

4) Get updated Adware reference file

5) Run Adware and remove all spyware (run all 3 different types of scans)

6) Run Hijackthis- remove all objects related to home search

7) Run Uninstaller pro

8) Go to control panel feature then the add/remove feature

9) Click on 1 of the 3 programs (home search assistent, shopping wizard, search extender) and use the FORCE option, standard uninstall will not work

10) Repeat for the remaining two

11) Then check out IE Plugins & Toolbars and delete objects not recognized

12) Run Security Task Manager Delete/quarantine potentially dangerous/Dangerous objects except for programs you know are legit. (Ex: Google toolbar will come up seems to be harmless)

13) Run regedit and search for HSA, home, SW, shopping, home, SE, search assistant/assistant, SA and extender. Delete the appropriate folders

Check:

HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main Start Page

HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Toolbar\Webrowser

HKEY_LOCAL_MACHINE\Software\Microsoft\InternetExplorer\Main Start Page

HKEY_LOCAL_MACHINE\software\Microsoft\InternetExplorer\Main Default Page

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\_NS_Service_3

14) Run Norton Antivirus live update or download updated Definition Files

15) Scan computer

16) Reboot

rsd317 · Jun 29, 2004

thanks for the help but i have done gone through those steps at least 5 times and still everytime i restart it goes back to normal...its weird because the first ie window i open starts up to my normal home page and the next one goes back to the .dll. also what is the virus doing? one more thing can you please be abit more specific when going through the steps. oh yea, i cant find "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\_NS_Service_3"

squires · Jul 1, 2004

i have been fighting with HSA for 3 days now and i cant figure out how to remove it.I need help.

Logfile of HijackThis v1.98.0
Scan saved at 12:47:34 PM, on 2/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\mfcbr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\apiue32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\Bin\HPOstr05.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\bin\HPOVDX05.EXE
C:\WINDOWS\System32\hpoipm07.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.ninemsn.com.au/0SEDEAT/SAOS01
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\doins.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://doins.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://doins.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\doins.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\doins.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://doins.dll/index.html#96676
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://anna/
R3 - Default URLSearchHook is missing
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: (no name) - {81ECDBCA-1DE3-27FD-325A-F6E0C0C236CF} - C:\WINDOWS\system32\sysei32.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [apiue32.exe] C:\WINDOWS\apiue32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP OfficeJet Series 500 Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\Bin\HPOstr05.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

Can some one please help

Zitty Mcgee · Jul 1, 2004

I wish this download link would work for me http://www.majorgeeks.com/download4284.html

why doesnt it work?

chaslang · Jul 1, 2004

Squires,

Please start your own thread!

chaslang · Jul 1, 2004

Zitty Mcgee said:

I wish this download link would work for me http://www.majorgeeks.com/download4284.html

why doesnt it work?
Click to expand...

That link does not work anymore because HSremove was pulled. Most likely due to the fact that it caused other problems and did not always work anyway.

Neo55378008 · Jul 2, 2004

Hon001,

Could you please e-mail me hsremove.exe
My address is brent@sharpsphere.com

Thank you

fernie · Jul 2, 2004

Hey, try this web site,www.hsremove.com this person had the same problems that we all had and decided to make his own program. I've been fighting this Bug for several days and tried Everything posted here and nothing worked. I finally out of frustration started playing around in the internet typing home search assistant removal, hsaremoval and finally hsremove.com IT WORKS but you have to run the program several times. Good Luck to all...

chaslang · Jul 2, 2004

fernie said:

Hey, try this web site,www.hsremove.com this person had the same problems that we all had and decided to make his own program. I've been fighting this Bug for several days and tried Everything posted here and nothing worked. I finally out of frustration started playing around in the internet typing home search assistant removal, hsaremoval and finally hsremove.com IT WORKS but you have to run the program several times. Good Luck to all...
Click to expand...

Not a good idea! The HSremove program deletes lot's of valid startup programs you need for valid operation of you computer. You are going to find that things you need no longer run. You may have to re-install/re-configure a bunch of things but first you'll have to figure out what it is that the program has removed that you did not want it to.

And by the way the fix (yes it does require some work) here: http://www.majorgeeks.com/vb/showthread.php?t=35917

works. Everyone who has executed it properly has resolved their problem with no side effects.

fernie · Jul 2, 2004

I checked my system and everything is running great, I did not loose any files other than the ones giving me the problem, I guess it worked for me, but caution to all. you might want to have a back up in case you uninstall some programs

chaslang · Jul 2, 2004

fernie said:

I checked my system and everything is running great, I did not loose any files other than the ones giving me the problem, I guess it worked for me, but caution to all. you might want to have a back up in case you uninstall some programs
Click to expand...

It does not uninstall them, it just removes registry keys used to get the appropriate Startup pieces of the programs to run.

samtowers · Jul 2, 2004

I need some help in getting rid of three programs that all seem to be related. They are, Home Search Assistant, Search Extender, and Shopping Wizard. Also, I would love to know how my computer was infected with these in the first place. Can anyone help?

Major Attitude · Jul 2, 2004

Yup, run CWShredder. When done, click the box that says "how did i get infected" which explains Microsofts Java Virtual Machine is insecure and should be uninstalled and includes a link to avoid being infected. This is one of the HUGE loopholes these scumbags use and everyone should do this whether your infected or not. You will then need to download Sun Java. You could also simply run another browser like Firefox or Opera.

Rabbit · Jul 5, 2004

I had a friend of mine with the same problem. We downloaded the HSremove file and it worked just fine with no other problems at all.

Major Attitude · Jul 5, 2004

Yupper Thread above still applies to avoid re-infection.

des · Jul 5, 2004

rsd317 - i am in the same boat - have tried it all and can't shake it. any luck yet or other suggestions?

chaslang · Jul 5, 2004

Have you:

- Disable System Restore
- Rebooted into safe mode
- run HSremove - available here: http://www.majorgeeks.com/download4286.html

des · Jul 5, 2004

no. how do i disable system restore? and i think i can reboot in safe mode by hitting f8, but then what? just run hsremove from safe mode?

chaslang · Jul 5, 2004

des said:

no. how do i disable system restore? and i think i can reboot in safe mode by hitting f8, but then what? just run hsremove from safe mode?
Click to expand...

disable system restore: http://www.majorgeeks.com/vb/showthread.php?t=31668

boot in safe mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam

and yes then run HSremove while in safe mode.

des · Jul 5, 2004

ok, progress. thanks chaslang. i now appear to be rid of hsa (both user accounts in xp). i assume i should turn system restore back on.

i am still unable to enable norton antivirus though. i can run live update successfully but cannot enable it. any suggestions other than reinstall nav?

chaslang · Jul 6, 2004

Once you get Norton fixed, enable system restore. Perhaps an uninstall/reinstall would work.
This hijacker has caused all kinds of programs to stop working and early versions of HSremove may have caused some issues too like removing some required startup programs.

Quinndrew5 · Jul 6, 2004

Can anyone help me with my HyjackThis file?

Logfile of HijackThis v1.98.0
Scan saved at 1:03:30 PM, on 7/6/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\WINDOWS\system32\ntxj.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINDOWS\System32\a.exe
C:\WINDOWS\System32\mlrikorf.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\lrxwiy.exe
C:\WINDOWS\System32\cfbsmt.exe
C:\documents and settings\andrew\local settings\temp\GfjaKad.exe
C:\WINDOWS\System32\IEHost.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\system32\pcs\pcsvc.exe
C:\Program Files\Common Files\Dpi\dpi.exe
C:\documents and settings\andrew\local settings\temp\GfjaKad.exe
C:\WINDOWS\System32\wmeoice.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINDOWS\System32\Nxgo.exe
C:\Documents and Settings\Andrew\Application Data\ttuh.exe
C:\Program Files\AWS\WeatherBug\Weather.EXE
C:\WINDOWS\System32\alqu.exe
C:\WINDOWS\System32\wifobj.exe
C:\WINDOWS\System32\PqpGZ2P.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Documents and Settings\Andrew\Application Data\DownloadPlus.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\sdker.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Andrew\Local Settings\Temporary Internet Files\Content.IE5\0LIV4TEB\HijackThis[1].exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://nkvd.us/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://nkvd.us/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http:///
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nkvd.us/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://nkvd.us/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\sbmve.dll/sp.html#26560
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://sbmve.dll/index.html#26560
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://sbmve.dll/index.html#26560
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\sbmve.dll/sp.html#26560
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\sbmve.dll/sp.html#26560
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://sbmve.dll/index.html#26560
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://nkvd.us/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://nkvd.us/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://t.rack.cc/hp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://vrape.hardloved.com/top/search.php?id=1&s=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\svcpack.exe
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {A0F1D4D8-ADE0-D9D7-4BE2-92D771F1BC8A} - C:\WINDOWS\ntor32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [SafeSurfingUpdate] C:\WINDOWS\System32\SSUpdate.exe
O4 - HKLM\..\Run: [systray] C:\WINDOWS\System32\a.exe
O4 - HKLM\..\Run: [cvlzjsxp] C:\WINDOWS\System32\mlrikorf.exe
O4 - HKLM\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [nvid] C:\WINDOWS\System32\lrxwiy.exe
O4 - HKLM\..\Run: [hxvxsplsmlvi] C:\WINDOWS\System32\cfbsmt.exe
O4 - HKLM\..\Run: [GfjaKad] C:\documents and settings\andrew\local settings\temp\GfjaKad.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Xej7.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe
O4 - HKLM\..\Run: [GfjaKad.exe] C:\documents and settings\andrew\local settings\temp\GfjaKad.exe
O4 - HKLM\..\Run: [473i39g] wmeoice.exe
O4 - HKLM\..\Run: [sdker.exe] C:\WINDOWS\system32\sdker.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Andrew\Application Data\ttuh.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.EXE 1
O4 - HKCU\..\Run: [Mrqgl] C:\WINDOWS\System32\alqu.exe
O4 - HKCU\..\Run: [LwssRVM6R] wifobj.exe
O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Andrew\Application Data\DownloadPlus.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: =>&Français - http:\\wordreference.com\fr\j\iefr119.htm
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)
O10 - Broken Internet access because of LSP provider 'osmim.dll' missing
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {2AEBF56B-88C4-7EC4-3B3F-24F1B5AD40FF} (DownloadUL Class) - http://public.searchbarcash.com/cab/007/ccdffrae.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.sharegear.com/install/setup.exe
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/wildgames/stx/install.cab
O16 - DPF: {AD08A333-609E-11D3-950C-008098601567} - http://wordreference.com/Install/English to French.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.13.5/ttinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/budicon.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll

chaslang · Jul 6, 2004

Quinndrew5,

You need to start your own thread for your problem. You need to tell us what problems you are having.
And most importantly you need to read the instructions here before posting logs: http://www.majorgeeks.com/vb/showthread.php?t=35407

Your log is huge. Follow the directions in that post and shutdown all unnecessary stuff before running HijaakThis. Also make sure you run the scans with other items as requested.

As a heads up, you are going to need to run HSremove. Download it here: http://www.majorgeeks.com/download4286.html

chast · Jun 15, 2005

after being swamped with trojans, hijacked and HSA I was about to format my drive. I tried every demo software that I could find and all had different scan results. I found a software company in Braintree MA that has a 30 day trial of a real working program. This one really works. It removed the HSA, about:blan, many trojans and something that was causing my IE browser to spewl trojans everytime I opened it. It took about 15 minutes to scan my XP drive and found, crucified and deleted 82 problems. My computer is back to normal. After the 30 day trial you can purchase this for 30.00. The name of the program is "SpySubtract" by Intermute. They are at www.intermute.com.

Good luck
Charlie
www.ocnfiberoptics.com

chaslang · Jun 15, 2005

chast said:

after being swamped with trojans, hijacked and HSA I was about to format my drive. I tried every demo software that I could find and all had different scan results. I found a software company in Braintree MA that has a 30 day trial of a real working program. This one really works. It removed the HSA, about:blan, many trojans and something that was causing my IE browser to spewl trojans everytime I opened it. It took about 15 minutes to scan my XP drive and found, crucified and deleted 82 problems. My computer is back to normal. After the 30 day trial you can purchase this for 30.00. The name of the program is "SpySubtract" by Intermute. They are at www.intermute.com.

Good luck
Charlie
www.ocnfiberoptics.com
Click to expand...

This thread is almost a year old. Why are you responding to it? Problems have already been fixed in another thread. Also please note, experience with SpySubtract has shown it to be ineffective at removing HSA hijackers. There are 165 forms (could be more now) of CWS. They may remove some mild forms like a few others do, but they do not fix true harder to fix forms which there are many of.

Log in or Sign up

Home Search Assistant

Dotus5 Private E-2

hon001 Private E-2

Major Attitude Co-Owner MajorGeeks.Com Staff Member

Major Attitude Co-Owner MajorGeeks.Com Staff Member

hon001 Private E-2

Major Attitude Co-Owner MajorGeeks.Com Staff Member

Major Attitude Co-Owner MajorGeeks.Com Staff Member

ChiChi Private E-2

Shataan Private First Class

maganona Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Rookie Private E-2

Major Attitude Co-Owner MajorGeeks.Com Staff Member

rsd317 Private E-2

packer2004 Private E-2

rsd317 Private E-2

squires Private E-2

Zitty Mcgee Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Neo55378008 Private E-2

fernie Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

fernie Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

samtowers Private E-2

Major Attitude Co-Owner MajorGeeks.Com Staff Member

Rabbit Private E-2

Major Attitude Co-Owner MajorGeeks.Com Staff Member

des Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

des Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

des Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Quinndrew5 Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chast Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member