Problem with google in IE

Whenever I search for anything in google (on web search not images or new etc.) it just comes up with a load of completely irrelevant random links to porn and suchlike, the sponsored links are strange if there at all and it usually comes back saying about 75,000,000 results. I can't find any sites I want :'(.....
http://www.missingpicture.netfirms.com/google.jpg
However, I can search perfectly with google using mozilla firefox but I don't want to switch to firefox fulltime because I'm afraid of change, and all my settings are in IE. I've run Adaware SE personal, norton antivirus 2004 and HiJack this and removed everything (everything suspicious from HJT) but still haven't fixed the problem. I've been and still will be trawling through the internet trying to find a solution for this problem but so far I haven't had any luck. Please help, I need my google back!

Thankyou in advance

-Nathe

 

Welcome

This site has alot of good tools for cleaning up your computer. It's very important that the first thing you do is the following:

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal.
If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

Try this... you may find it's all you need. If not post your results and I am sure one of the PROS can help you. These guys are quite busy, as you can see by the number of posts, so hang in there. Good Luck!!

 

Ok, sorry, yeah I;ve done that and it fixed a couple of other problems but not my google one! Please help.
I found out that if I use a privacy protector such as Unipeak.com then I can search with google fine. I can use this as a solution for now but unipeak slows things down so I would reeeaaaaaaaaallllllllly appreciate it if someone would spare some time to help me fix this problem. It's a real pain.

 

Make sure you have HijackThis 1.99.1 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, INCLUDING YOUR WEB BROWSER, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder for example C:\Program Files\HJT

 

Ok, done all that, HJT 1.99.1, everything closed 'n' all. Heres the logfile.....

 

Let's get you started.
Please find out some information about this file. Right click, properties, and find version, maker, etc.
C:\WINDOWS\switpa.exe
Make sure you run CWShredder from the READ ME

Please print out these instructions so that you can operate with ALL Browser Windows CLOSED.
Please make sure System Restore is OFF and the Viewing of Hidden Files is Enabled as per the tutorial.

Please look in Add or Remove Programs for the following and Uninstall them if found:

MyWebSearch
SearchBar Cash

NOW:
Please look in Task Manager (ctrl-alt-del)and try to END the following running processes, if found:

saie.exe
searchbarcash.exe
fsg_4203a.exe

Now scan with HijackThis and Check the Boxes for the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\5.bin\MWSBAR.DLL
O2 - BHO: Explorer Class - {962F12AE-2773-4BEB-99EA-B5C3AB9A6606} - C:\WINDOWS\system32\DSMANA~1.DLL
O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - C:\WINDOWS\SYSTEM32\srchbar.dll
O4 - HKLM\..\Run: [mswspl] C:\DOCUME~1\Munky\LOCALS~1\Temp\searchbarcash.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\briony\local settings\temp\fsg_4203a.exe"
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\5.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZC
If you don't recognize this, fix it.
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v6.cab

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files Enabled and navigate to and DELETE the following file(s) and folder(s) if they should remain:

C:\windows\system32\saie.exe
C:\DOCUME~1\Munky\LOCALS~1\Temp\searchbarcash.exe
C:\documents and settings\briony\local settings\temp\fsg_4203a.exe
C:\Program Files\MyWebSearch--->The Folder
C:\WINDOWS\system32\DSMANA~1.DLL
C:\WINDOWS\SYSTEM32\srchbar.dll

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to what you want or something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to what you want or something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Reboot to Normal Windows and Scan with HijackThis and attach that log.
Let me know how your computer is running now and if you had trouble with the above instructions.

Good luck

 

Yay, you fixed it! Thankyou very much.

The only information I could find about switpa.exe was:

• Description: Offer Agent (suspicious?)
• Size: 140K
• Created/Modified: 4th Feb '05
• Accessed: 15th March (Today)
• Version: 1.0.0.30

I couldn't find anything about a company or maker or any other comments on it. The icon was a little blue man like the ones you find on the mens loos if that helps .

Again, thanks for your help but if there's any way to find out how this happened or stop it from happening again I would appreciate the info!

I would send you a basket of muffins but I'm sure you don't want to share your address with me

 

Oops, I forgot. Here's the HJT Logfile.......

 

What is a mens loos?
Are you having anymore problems?
I think C:\WINDOWS\switpa.exe is a bad file. I am going to do some more checking. In the meantime go here Protect Yourself

Use Firefox as your browser.
Check back again today, we may fix that file.

 

That file is bad, let's fix it.

Please print out these instructions so that you can operate with ALL Browser Windows CLOSED.
Please make sure System Restore is OFF and the Viewing of Hidden Files is Enabled as per the tutorial.

Please look in Add or Remove Programs for the following and Uninstall them if found:

OfferAgent

NOW:
Please look in Task Manager (ctrl-alt-del)and try to END the following running processes, if found:

switpa.exe

Now scan with HijackThis and Check the Boxes for the following:

O4 - HKLM\..\Run: [switp] C:\WINDOWS\switpa.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files Enabled and navigate to and DELETE the following file(s) and folder(s) if they should remain:

C:\WINDOWS\switpa.exe
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.

Reboot to Normal Windows and Scan with HijackThis and attach that log.
Let me know how your computer is running now and if you had trouble with the above instructions.

Good luck