Horse-Search.net AGAIN

I have tried the techniques already mentioned in former horse-search posts and have had no luck in getting rid of this problem. The problem is that a pop-up comes about every 5-10 minutes and randomly searches for something under the website.

The other problem I am having is a problem with updating Windows. In order to log on to the internet for more than 2 hours on my campus, I must update Windows at certain times and the computer will not allow me to update. I'm not sure if the former problem is affecting this problem or not.

Some of my computer specs:

System: Microsoft Windows XP Home Edition Service Pack 1
Pentium 4 CPU 2.26 GHz 512 MB of RAM 40 GB harddrive
Mozilla Firefox browser & have Internet Explorer

let me know if you have any ideas

 

First:
Please download: HSFix.zip

Extract the tool from the ZIP File to a folder you can easily find (preferably in its own folder - like C:\HSFix). It should have a ReadME included with instructions on how to run it and how to collect the log it produces.

Please run the tool as directed and attach the log it produces.

Second:
http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Attach BOTH logs to your next post!

 

Here are my attached HSFix and HijackThis logs.

 

Okay! Before we do anything else. Reboot into Safe Mode, run the HSFIX again and attach that log with a new HJT log.

 

Ok, I rebooted in safe mode and ran the scans again. They look pretty similar.

 

Download Pocket KillBox

Now, Copy and Paste C:\WINDOWS\System32\open32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\System32\w32tm.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES.

After Windows has loaded from the reboot procede to the next steps:

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

O4 - HKLM\..\Run: [Shell] open32.exe

O16 - DPF: {1663ED61-23EB-11D2-B92F-008048FDD814} (MeadCo ScriptX) - http://www.physics.capcollege.bc.ca/ActiveX/WebPrinting/ScriptX.cab

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing ALL of the above, reboot and post a fresh HJT log from normal mode.

 

OK, I did everything mentioned in your instructions except for the following instruction:

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin


I tried going to cleanmgr but when the window popped up there was no option of checking temporary files, temporary internet files, etc. I could only select a drive to choose. So i selected the C: drive and the cleanmgr froze after about a fourth of the way.

Either way, I have posted the HijackThis log that you requested.

Let me know if there is anything else I need/ought to do.

Thanks

 

Your HJT log is clean!

Are you current having any further problems?

 

Thank you so much for helping me with the annoying malware. However, I am still having problems with updating windows and other components. The campus that I attend requires that we download certain windows updates regularly, and when I click the link to update windows, the browser simply freezes up and eventually goes to "(not responding)". I'm not sure if this is a problem you can help me with or if it is more of a university specific problem. If you have any ideas or suggestions please let me know.

Thanks.

 

Since your Malware free, I recommend posting this problem in the Software Forum. Those guys will get you all fixed up.

You should see this article on How to Protect yourself from malware!