search-to-find.com browser hijack

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by ameza21, Aug 23, 2004.

  1. ameza21

    ameza21 Private E-2

    I have had major problems with this browser hijack that I cant seem to get rid of. here is what I have done so far:

    updated windows
    turned off system restore
    rebooted in safe mode
    ran HSR twice
    ran aboutBuster once (two scans)
    ran Ad-aware "Smart System Scan"
    ran Spybot SD
    ran CW Shredder
    ran hijackThis - found R0/R1 entries with c:\windows\nrjnd.dll...... and removed those entries
    emptied temp folder under profile/localsettings/temp/
    rebooted


    my homepage is constantly changed to a search page that tries to load something from v61.com and I costantly get pop ups. whenever i do a search on google, another window pops up with the same search querie on search-to-find.com.


    any suggestions? and let me know if you need any of my logs.
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  3. ameza21

    ameza21 Private E-2

    ok, there are two components in Add/Remove Programs that are a problem. The first is "Home Search Assistant", the second is "Shopping Wizard". We I go to remove them, it says "Unable to open http://www.looking-for.cc/uninstall/HomeSearchAssistant.html" and likewise for the Shopping wizzard, same url but ShoppingWizard.html

    i went to these pages in my browser, and it wanted me to download and run an uninstall program. I was sceptical, but did it anyways and it did nothing. any further suggestions?
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  5. ameza21

    ameza21 Private E-2

    Ok - I followed the generic solution for HSA hijacker, and it seems to have worked. But i will post my hijack and AB logs for you to look at just in case.

    otherwise, my computer seems a lot better than before, even performance-wise.
     

    Attached Files:

  6. ameza21

    ameza21 Private E-2

    One more thing... every so often explorer just magically appears with a new window opened to My Documents. It happens maybe 4 or 5 times a day. I isn't really a big deal, just wondering if you have any ideas what causes that. I has been going on for about 2 weeks now a little bit before I had problems with HSA.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your log looks okay now. I'm wondering about a few things though:

    1) why Windows Autoupdate Service is running twice. These two process lines indicate that:
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wuauclt.exe

    2) Did you run all the steps and run them in the order given? The reason I ask is two fold. You have 3 about:Buster logs. This is not a problem, but where was the third one run? And if step 13a and then 13 k were run, I would have expect to at least see and R0 line indicating www.google.com for a home page (about:Buster typically sets that which would change the setting to www.majorgeeks.com made in 13a )

    3) And did you install this Seti@home stuff? Not that it is a problem! I'm just wondering.

    I'm not sure what is causing Windows Explorer to popup.
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This problem has already been fixed. Please don't answer just to answer. Registry cleaners do not fix the problem. You have to fix the problem. Yes you can use the registry cleaner tool to aid you but you have to know how to use it and what you are looking for.

    In addition, the user had an HSA hijack which is not fixable but just using a registry cleaner.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds