Computer Support Forum

Search Assistant is driving me mad

Question: Search Assistant is driving me mad

'Search Assistant' has appeared as a new toolbar on the taskbar menu and every time I start up it appears and totally disrupts all my quicklinks. I can simply de-select it which gives me my quicklinks back but all in the wrong order.

Could some kind person please tell me how to get rid of it, it's an absolute pain!

Terry

Relevance 100%
Preferred Solution: Search Assistant is driving me mad

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: Search Assistant is driving me mad

16 more replies
Relevance 61.5%

Hi All,
Any help would be greatly appreciated. I have tried uninstalling without any success !
 

More replies
Relevance 57.81%

I cannot get rid of these programs no matter what I do. Simply trying to remove the programs from Control Panel/ Add/Remove programs , I'm told they can't be found. I followed instructions from another post and used SpyBot, Ad-Aware SE, Hijack This, a Squared trojan remover and About:Buster, but nothing has worked. I figure that maybe the instructions were based on his computer files exactly. So I've posted the logfile from my computer. If anyone can help, I'd greatly appreciate it!

Logfile of HijackThis v1.99.1
Scan saved at 3:24:19 PM, on 3/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ati2evxx.exe
C:\WINDOWS\System32\Atiptaxx.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\mspr32.exe
C:\WINDOWS\System32\wuauclt.e... Read more

Answer:How do I remove Home Search Assistant, Search Extender and Shopping Wizard?

First of all, you have to unzip Hijack This and save it to a folder of its own in programs files so it can create proper back-ups and function properly.

First click: http://forums.techguy.org/attachment.php?attachmentid=44318

to download cwsserviceremove.zip and unzip it to your desktop and have it ready to run later.
___________________________________________________________________________

Click http://www.intermute.com/spysubtract/cwshredder_download.html to download CWShredder. Do Not run it yet. Download it to the desktop and have it ready to run later.

____________________________________________________________________

Click: http://www.downloads.subratam.org/AboutBuster.zip to download AboutBuster created by Rubber Ducky.

Unzip AboutBuster to the Desktop then click the "Update Button" then click "Check for Update" and download the updates and then click "Exit" because I don't want you to run it yet. Just get the updates so it is ready to run later in safe mode.
_____________________________________________________________________

Now go ahead and set your computer to show hidden files like so:

Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go ... Read more

1 more replies
Relevance 57.81%

I am having major problems. In my add/remove program the shopping wizard and search assistant are listed. When I try to remove them my computer freezes up and nothing happens. I have to shut down and start up again. Computer is running really slow and many programs won't even open. I have run ad-aware and removed what it found, spy sweeper and removed it's findings and mcafee virus scan. I don't know what else to do! Please help me! Thanks in advance! Oh and everynow and then a pop up comes up and the only title it has is "only the best"
 

Answer:Pleaz help me remove shopping wizard, search assistant, and cool web search!

12 more replies
Relevance 57.81%

Google basically does the well know re direct of a search, bringing up various marketing etc sites.

This is the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:09, on 05/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

--
End of file - 920 bytes

Thankyou for any help, would just like the removal of these Search assistant bugs.

Answer:Google searc redirect, Search Assistant/Customize Search element.

Hello.Your Hijackthis log looks extremly small. Have you been fixing any entries?Hijackthis warningHijackThis is an advanced tool, and therefore requires advanced knowledge about Windows and operating systems in general. If you delete items that it shows, without knowing what they are, it can lead to other problems such as your Internet no longer working or problems with running Windows itself.If you do not have advanced knowledge about computers you should NOT fix entries using HijackThis without consulting an expert on using this program.Thanks for Understanding Backup Registry with ERUNTThis tool will create a complete backup of your registry. A backup is created to ensure we have backup so encase anything goes wrong we can deal with it. Do not delete these backups until we are finished.Please download erunt-setup.exe to your desktop. Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.You can find a complete guide to using the program here:http://www.larshederer.homepage.t-online.de/erunt/erunt.txtHow to Restore from the ERUNT BackupOnly restore from the backups if instructed to, or you need to do s... Read more

3 more replies
Relevance 57.4%

I can't seem to uninstall or even locate Homesearch assistant, searchextender or shopping wizard, even though they are present in my control panel. Please view the following log and make suggestions! I am computer literate, all I need is directions as what to do with this information. Thank you in advance for your assistance. Logfile of HijackThis v1.99.1Scan saved at 22:34:58, on 10-12-2005Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exeC:... Read more

Answer:Help: Home Search Assistant, Search Extender & Shopping Wizard

Download the trial version of Ewido Security Suite http://www.ewido.net/en/download/ (W2K/XP Only)? Install ewido.? During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".? Launch ewido? It will prompt you to update click the OK button and it will go to the main screen? On the left side of the main screen click update? Click on Start and let it update.? DO NOT run a scan yet. You will do that later in safe mode.Restart your computer into safe mode now. Perform the following steps in safe mode:(Start tapping F8 at the first black screen after power up)Run Ewido:? Click on scanner? Click Complete System Scan and the scan will begin.? During the scan it will prompt you to clean files, click OK? When the scan is finished, look at the bottom of the screen and click the Save report button.? Save the report to your C: DriveThis will take some time to run!Boot to normal modePost that log and a new HiJack log - but do this before the HiJackThis log====================DownLoad EasyCleaner http://www.majorgeeks.com/download414.htmlUse the clear files and Unnecessary files buttons - I do not recommend using the Duplicates files button as many dupes are there on purpose.Not all tmp files will delete ? that is normal.In the unnecessary button I check the top 4 entries

11 more replies
Relevance 57.4%

Three programs called shopping wizard, home search assistant, and search extender are on the add/remove programs list. when i attempt to uninstall them i get an error message. when i load up IE it starts on auto:blank and i get a lot of popups. ive read some threads about this but they have solutions for windows XP operating system and i have wndows 98, the first few steps about turning off system restore, see hidden files and folders appear to be different. here is my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 20:19:00, on 07/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://wind-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Expl... Read more

Answer:Shopping Wizard, Search Extender, Home Search Assistant

ive got mcaffee on my computer, but it keeps crashing after its scanned
 

1 more replies
Relevance 57.4%

These three nasty things have been bugging me for the past couple of weeks: Shopping Wizard, Search Extender, and Home Search Assistant. Everytime I try to delete them off my add/remove programs it doesnt work. I have tried a number of anti-spyware programs and non of them seem to be able to delete them or even detect them. I would really appreciate if you could help me out and make my life easier. Here is my log from HijacktThisLogfile of HijackThis v1.99.0Scan saved at 12:46:27 AM, on 1/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\WINDOWS\system32\HPConfig.exeC:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec AntiVirus\Rt... Read more

Answer:Shopping Wizard, Search Extender, and Home Search Assistant

Hi Download System Security Suite here:System Security Suite Download & Tutorial. Unzip it to your desktop.Install the program. Don't use it yet.Please print or copy these instructions because you are not able to access the Internet in SafeMode.Make sure you are set to show hidden files and folders: A. On the Tools menu in Windows Explorer, click Folder Options.B. Click the View tab.C. Under Hidden files and folders, click Show hidden files and folders.D. Uncheck Hide extensions for known filetypes and Hide protected operating system files.How to see hidden files in WindowsREBOOT into SafeMode by tapping F8 key repeatedly at bootup: Starting your computer in Safe modeRun HijackThis!, press Scan, and put a check mark next to all these:R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://fastsearchweb.com/srh.php?q=%sR3 - Default URLSearchHook is missingO2 - BHO: (no name) - {322B3263-4125-83BC-EA0A-3B07AB10E29B} - C:\WINDOWS\d3yw.dllO17 - HKLM\System\CCS\Services\Tcpip\..\{B7C1C985-C58A-486E-9395-8549A97277A3}: NameServer = 69.50.166.94,69.31.80.244O17 - HKLM\System\CCS\Services\Tcpip\..\{EF25E273-7575-40CD-835E-3AC69DCC4152}: NameServer = 69.50.166.94,69.31.80.244O17 - HKLM\System\CS1\Services\Tcpip\..\{02F8669E-0851-4979-8B37-47F45CB16AD2}: NameServer = 69.50.166.94,69.31.80.244Close all other windows and browsers, and press the Fix Checked bu... Read more

5 more replies
Relevance 57.4%

When I scan with spyware doctor, one of the scans is a CWS home search assistant. I used aboutbuster to remove it, to no avail. it still shows up during a scan with spyware doctor. why? Anybody also know how rid of spector pro keylogger,7Adpower, In the Know?

Here is my hijackthis log if it will help

Any help would be appreciated
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\System32\alg.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
... Read more

Answer:CWS Home search assistant still showing up on spyware doctor search

13 more replies
Relevance 57.4%

I'm trying to work on my Moms machine and I se these three progs installed and they will not go away. I do know they are some kind of malacious spyware. How in the world do I get rid of these? Everything I have done has failed. Can someone please help me out? This is the current log from Hijackthis:

Logfile of HijackThis v1.99.0
Scan saved at 1:09:15 AM, on 12/25/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\GEARSec.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\mslb.exe
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\Progr... Read more

Answer:Home Search Assistant, Search Extemder & Shopping Wizard

http://forums.techguy.org/t110854.html

Have a look in Control Panel > add/remove or in all programs and uninstall them
Go to the above link and download SpyBot Search and Destroy and AD-Aware SE UPDATE and do a scan with both of them getting rid of all they find

Do a scan with Panda and Housecall

After doing ALL th eabove post another Hijack This log here please
 

3 more replies
Relevance 56.99%

I have tried just about everything. Downloaded all the spyware programs and ran them this is what I am left with . Any ideas?

Edit by chaslang: Unrequested inline log removed
 

Answer:Can't get rig of Cool web search, Shopping wizard and search assistant

From personal experience.. download coolshredder from offsite link removed...

Run this and it should eliminate most of those issues....


Mortgageguru
 

3 more replies
Relevance 56.99%

i want to get rid of home search assistant, search extender, and shopping wizzard (cause AIM to crash), but can't remove them with "change/remove programs". i have followed your "do this first" file, and now have my HackThis log. please help!
 

Answer:Search Assistant, Search Extender, Shopping Wizzard

You have Home Search Assistant (search extender and shopping Wizzard are connected to it). I have had hte virus myself and i suggest you try this basic removal guide http://forums.majorgeeks.com/showthread.php?t=38772 , if that doesnt work you can come back and ask for more help
 

8 more replies
Relevance 55.76%

been trying to clean this mess for daysanyhelp would be greatly appreciatedthanks!Logfile of HijackThis v1.99.1Scan saved at 12:14:50 PM, on 7/13/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\BurnQuick\BQTray.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\palmOne\HOTSYNC.EXEC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\ntno.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Danny\Desktop\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zkumc.dll/sp.html#14414R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkumc.dll/sp.html#14414R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\S... Read more

Answer:HJT log-problems with search extender, search assistant..

ab//Mod edit: Every time you attempt to bump your log, you onlyput yourself farther back in the time sequence. Logs are analyzed on a first in,first worked basis. All HJT Techs are volunteers. Please be patient.

2 more replies
Relevance 55.76%

My computer is really slow the last few days, and programs keep not responding. Have tried Adaware, virus scans, and Spybot. Search Assistant - My search shows up in Add/Remove programs, but it won't let me remove it.
Here's my hijack this log:

Logfile of HijackThis v1.97.7
Scan saved at 11:46:34 AM, on 12/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\VetMsgNT.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\sy... Read more

Answer:Trying to remove Search Assistant - My search HIJACK THIS LOG

A new version of Hijack This has been released so get rid of the old one and
download from this site [http://www.spywareinfo.com/~merijn/
.
 

2 more replies
Relevance 53.71%

ive run adaware spybot the new yahoo anti virus and my laptop is pretty clean (i think). but on my add/remove program list Seaarchassistant-my search is stll there when i click remove i get an error box, in the title bar it sais RUNDLL and the error message reads
Error loading program Crogra~1\MyWay\SrchAsst\1.bin\mysrchas.dll
the specified module could not be found
here is my hjt log thanks for any help

Logfile of HijackThis v1.98.2
Scan saved at 3:47:40 PM, on 3/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\xpoint\xpadmin\xpadmin.exe
C:\PROGRA~1\xpoint\agent\Xpagent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\xpoint\pe\PCRECSA.EXE
C:\PROGRA~1\xpoint\EEClient\xpclient.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\WINDOWS\Syst... Read more

Answer:search assistant my search add/remove

7 more replies
Relevance 53.71%

In my Add/Remove programs list, I have this program "Search Assitant - My Search" which must be add, or spyware, because it won't remove. I've tried both Ad Aware, and Spybot, with the plug in, and folled all instructions. It' still there, and when I try to remove it, I get a blank pop-up page with a vague path string at the top.

I've tried safe mode, I've scanned, I've taken off and put back on MSN 9, so I'm here because I've reached a point where I don't know what to do.

In addition, whether it's related or not, I CAN get onto the internet (dialup), but my MSN9 won't let my email files download and I get an Error Reporting.

Chances are, I've got a variant of a Hijacker, and I'm hoping it's connected to that "Search Assistant" program so that when I finally get rid of it, life will be back to normal.

Please instruct me as what action to take and I will do it. If there is a former string about this specific problem I can refer to, I'd be o.k. with that as long as it works. This is my fourth day of sitting in front of this computer, and my wife's about to leave me...
THANKS!!!
Hawk
 

Answer:Search Assistant - My Search (can't remove. HELP!)

Read this first so you know what you should be doing before posting a HijaakThis log:

http://www.majorgeeks.com/vb/showthread.php?t=35407

The following the instructions in the above line download and run HijaakThis and post a log.
Here's the HijaakThis link: http://www.majorgeeks.com/download3155.html
 

33 more replies
Relevance 53.71%

I have this listing on my Add/Remove Programs list and cannot get rid of it. I believe that it is causing many pop-ups to get around my pop up blocker and overall slowing down my computer. I was wondering if anyone had encountered this problem previously or knew how to remove this programs/virus/spyware, whatever it is. Here is my Hijack This log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\vmss\vmss.exe
C:\windows\system32\newljs.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\iljtwh32.exe
C:\documents and settings\administrator\local settings\temp\aMyp.exe
C:\windows\system32\QDpDKcDg.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\iexat32.exe
C:\Documents and Settings\A... Read more

Answer:Solved: Search Assistant - My Search

16 more replies
Relevance 52.89%

Have been reading the other posts concerning the 180 Search Assistant I came across in Add/Remove Programs today. I'm using W2K and after reading the other posts I followed your instructions and installed Hijack This, ran it, and have attached the resulting log. Would appreciate your thoughts on what I can deleted, if anything.
 

Answer:180 Search Assistant

Hi meinbres, Welcome to TSG!!

I'm posting your log here for easier reading... I'll post a suggestion shortly.

Logfile of HijackThis v1.98.2
Scan saved at 3:57:02 PM, on 11/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\netdde.exe
C:\WINNT\MS\SMS\CORE\BIN\CLISVCL.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Executive Software\DiskeeperServer\DKService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\ups.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\winnt\180ax.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\... Read more

2 more replies
Relevance 52.89%

I cant uninstall this and i also dont know where it come from. When try to get rid of it my pc freezes up and i have to turn it off at the mains, can you help?

Answer:180 search assistant

Looks as though its Adaware and a bit of a pig to get rid of click here and click hereHave you tried running Adaware and Spybot???

10 more replies
Relevance 52.89%
Relevance 52.89%
Question: Search Assistant

if i go to common pages such as ebay, yahoo, google, etc...i get this search assistant page. its driving me crazy. any suggestions?
 

Answer:Search Assistant

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:



Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post).

 

5 more replies
Relevance 52.89%

Hey guys, first post... Read through some of the forums and am trying to remove the "My Way Search Assistant" from the Add/Remove section of the control panel. Used the Ccleaner and when I attempted to remove this entry, I was prompted "Unable to remove MSI Installer" I did all the "Read and Run" steps. It's late, if you think I need to post everything for you to view, I'll be back online tomorrow and get your input. Thanks...
 

Answer:My Way Search Assistant

492slayer said:



if you think I need to post everything for you to viewClick to expand...

Yes please.

We need to see the logs so we can see if somethings stopping it from being removed, whether you have other issues, and so we can help provide a fix.
 

16 more replies
Relevance 52.89%
Question: search assistant

i get redirected to a website titled search assistant whenever i go to some common websites such as ebay and amazon. spybot also picks up some remnants of n-case and dyfuca internet optimizer in the registry key but can't seem to remove it, something about them being in use.

help on these problems would be greatly appreciated. thanks in advance.

Logfile of HijackThis v1.99.1
Scan saved at 9:41:57 PM, on 3/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\... Read more

Answer:search assistant

Hi and welcome to Bleeping. For the VITAL backup feature of HijackThis to function correctly, you MUST place the program in it's own dedicated folder. Go to My DocumentsClick File > New > FolderName it HijackThis and unzip/move HJT to this folder.Run HJT again and checkmark the boxes next to the following:-R3 - Default URLSearchHook is missingO1 - Hosts: 69.50.173.4 lycos.comO1 - Hosts: 69.50.173.4 amazon.comO1 - Hosts: 69.50.173.4 www.amazon.comO1 - Hosts: 69.50.173.4 aol.comO1 - Hosts: 69.50.173.4 www.aol.comO1 - Hosts: 69.50.173.4 earthlink.netO1 - Hosts: 69.50.173.4 www.earthlink.netO1 - Hosts: 69.50.173.4 ebay.comO1 - Hosts: 69.50.173.4 www.ebay.comO1 - Hosts: 69.50.173.4 go.comO1 - Hosts: 69.50.173.4 www.go.comO1 - Hosts: 69.50.173.4 icq.comO1 - Hosts: 69.50.173.4 www.icq.comO1 - Hosts: 69.50.173.4 lycos.comO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [vodipad] C:\WINDOWS\vodipad.exe4 - HKLM\..\Run: [Gufyxp] C:\Program Files\Dogehja\Qroj.exeO4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exeO4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exeNow close ALL windows & browsers and click FIX CHECKEDReboot into Safe Mode.Tap F8 repeatedly when your machine starts to boot up.Select 'Safe Mode' from the options that appear.Set Windows to 'Show all files & folders'.Click Start > My Co... Read more

5 more replies
Relevance 52.89%

OK, so I've done all that was stated in the "Read and Run First" sticky, but for some reason I can't seem to get rid of this My Way thing. When I go to Add/Remove programs, it doesn't even give me an option to delete it. Can someone help me remove this or is it even necessary? Does it hurt to have it on my computer, because I don't even know what it is or how it got here. I'm attaching the files that are requested with exception to the AVG Antispyware log. It told me there wasn't a report available when running AVG.
Thanks in advance to any help that can be given.
Spike
 

Answer:My Way Search Assistant

I know I'm not supposed to bump this, but it's been three days since I first posted and was just thinking maybe it was overlooked. If not, I apologize for the bump. I was just hoping maybe someone could take a look and give me some type of idea what's going on with the My Way Search thing.

Thanks,
Spike
 

4 more replies
Relevance 52.89%

180 Search Assistant has infected my computer. I downloaded Hijack this and ran a test. Here are the results. Can someone tell me what this means and what to do? I would greatly appreciate it! Thanx

Logfile of HijackThis v1.98.2
Scan saved at 12:25:03 PM, on 11/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\WINDOWS\System32\zcqtae.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\AT&T Plug&Share 54Mbps Wireless PCI Adapter\WLANMON.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\mozilla... Read more

Answer:180 search assistant (HELP ME!!)

7 more replies
Relevance 52.89%

not long ago we lost all power during an ice storm and had to do a destructive recovery when we finally got power back on, I uninstalled the games that were restored such as the WildTangent junk that was pre-installed, I have not added hardware and I keep having a problem with IE when I try to go to different webpages, the address bar says the webpage that I put in but it takes me to a Search Assistant Page that I would like to get rid of.... I didn't have it prior to the recovery but my teenager likes these game pages and clicked on something that sent him to a page that messed this up...
I have even purchased the CounterSpy, Spysubtract and Spybot and none of these are finding anything, I have a firewall running and Have had KasperskyDefender Pro way before this happened, but I can't even access ebay.com or amazon, this is getting frustrating.
I found you thru the April 2005 PCWorld mag, thanks for any help you can offer....
 

Answer:Please help me get rid of Search Assistant...

12 more replies
Relevance 52.89%

I've read a few things about this and I know some people feel it shouldn't be a concern but I'm curious if there's anything else going on that I haven't noticed, or if there's anything else I can get rid of to speed up my old laptop.

My Way Search Assistant is showing in Add/Remove Programs but does not have any options to uninstall. I know it supposedly is preinstalled on Dell systems like mine. I haven't noticed it *doing* anything, but anyhow...

I use firefox as my main browser (but use all 3 occasionally), but have had a lot of pop ups at various times, asking if I want to stop the script. Before that happens, the browser(s) are very slow to respond. The messages vary, but often start with chrome://
My guess is that it's just due to a low end laptop, but it's what I've got.

I do have a windows install disc or boot CD around somewhere that was sent to me by dell. I'm also aware I have no antivirus installed as I just uninstalled AVG and want to try something new.

Thanks!

DDS (Ver_10-03-17.01) - NTFSx86
Run by Admin at 15:45:02.46 on Wed 09/29/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.706 [GMT -4:00]
============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe... Read more

Answer:My Way Search Assistant

BUMP, please

If it helps, I can give exact examples of the errors popping up often on firefox:

A script on this page (page was just a restore session from *just* restarting the laptop) may be busy, or it may have stopped responding. You can stop the script or you can continue to see if the script will complete.

Script: chrome://browser/content/aboutSessionRestore.js:124

---
And two others that came right after that one:

Script: file:///c:/Program%20Files/Mozilla%20Firefox/components/nsSessionStore.js:126

Script: chrome://global/content/bindings/browser.xml:0

But yeah.... Bump Please?

1 more replies
Relevance 52.89%

1st post!!!! Any way, I have this problem my self.As if you don?t know the symptoms?. Here are my specific problemsOf course you there are the pop-ups that have a header of ?180 search assistantI have also notice something called Web rebates checked to boot up, I unchecked it and of course after restarting and opening Explorer?. Its warning me that 180 search assistant has been turned off. And it appears in my processes again as Web rebates.This is my hijackthis log:Logfile of HijackThis v1.99.0Scan saved at 11:14:15 AM, on 1/15/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\ATI Technologies\ATI.ACE\cli.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\ATI Technologies\ATI.ACE\CLI.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\Program Files\AIM\aim.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\... Read more

Answer:180 search assistant

Print out these instructions and then close all windows including Internet Explorer.Then I want you to fix some of those entries. Please do the following:Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden files in WindowsRun Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O4 - HKLM\..\Run: [qzqlih] C:\WINDOWS\qzqlih.exeO4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"Reboot your computer into Safe ModeThen delete these files or directories (Do not be concerned if they do not exist)C:\WINDOWS\qzqlih.exeC:\Program Files\Web_Rebates\Reboot your computer to go back to normal mode and post a new log.

3 more replies
Relevance 52.89%

I have a warning about this offfering the options to re-install or leave uninatalled, which do I do?

Answer:180 search assistant, what is this

Don't touch it with a barge pole... it is adware click here

6 more replies
Relevance 52.89%
Question: search assistant

I was checking my register the other day and under search assistant I ran across an item that keeps showing up in our temporary internet files. It's only been in the past week and I can't trace it back to any particular site, it's as if it pops up out of nowhere. I removed the registry keys but still end up with the items under temp files which I am able to delete but would really like to know where they come from, what they are, is it spyware? The item I keep getting is: ak.imgag.com/
I've never seen this page, it doesn't look like our homepage has been hijacked; everything is working like normal. I don't understand why the ms search assistant had these keys however since we don't use ie, we have mozilla on our system. I've tried surfing the net to find out what this thing is but keep running into tons of different answers, the most common one says it may be an active x plug in but I can't find any other info. The original keys were under the autocomplete most recently used (ACMru) section of HKcu. Any help would be appreciated. I've been working on this since I discovered it last week and am no closer to finding an answer. Does anyone know what ak.imgag.com/.... is?

Answer:search assistant

From what I could gather these are images (e.g. ads, animation, etc.) and yes they are Active-X plugins. I usually get them if I send an e-card. If you're really worried that your browser has been hijacked follow these steps.

First, download, install, update, then run ALL of the free spyware removal tools from the links below if you don't have them already. Delete all spyware found.:

http://www.lavasoftusa.com/support/download/
http://www.safer-networking.org/
http://www.intermute.com/spysubtract..._download.html

Then go to www.housecall.trendmicro.com for an online scan..
Then download HiJackThis at www.majorgeeks.com also download this http://www.greyknight17.com/spy/KRC%...20Analyzer.zip
Post your HJT Log here at TSF in the Security Forum so that an expert analyst can read your log.
I really don't think there's anything to worry about but to be on the safe side I recommend doing the above.

2 more replies
Relevance 52.89%

ogfile of HijackThis v1.98.2
Scan saved at 6:47:42 PM, on 9/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\systems.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\Hotbar\bin\448~1.0\SBInst.exe
C:\Program Files\Hotbar\bin\4.4.8.0\WeatherOnTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hotbar\bin\4.4.8.0\HbInst.exe
C:\WINDOWS\System32\drvsys.exe
C:\Documents and Settings\ALAN NORTON\Application Data\ttuh.exe
C:\WINDOWS\System32\donyju.exe
C:\WINDOWS\System32\msr2cenu.e... Read more

Answer:Need help with search assistant

Lets begin by rescanning once again with hijack then insert a check next to each of the following items. Close all browser windows and click "fix checked"

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm

F2 - REG:system.ini: Shell=explorer.exe winlogin.exe

O2 - BHO: (no name) - {3BAA620E-9463-1BE0-DB57-60550DAD2A40} - C:\WINDOWS\System32\cguez.dll

O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.4.8.0\HbHostIE.dll

O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.4.8.0\HbHostIE.dll

O4 - HKLM\..\Run: [system] dcomx.exe

O4 - HKLM\..\Run: [NDplDeamon] winlogin.exe

O4 - HKLM\..\Run: [winlogon] winlogin.exe

O4 - HKLM\..\Run: [System Service] systems.exe

O4 - HKLM\..\Run: [Spam Blocker for Outlook Express] C:\PROGRA~1\Hotbar\bin\448~1.0\SBInst.exe

O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.4.8.0\WeatherOnTray.exe

O4 - HKLM\..\Run: [win_upd2.exe] C:\WINDOWS\System32\WINdirect.exe

O4 - HKLM\..\Run: [wpds.exe] C:\WINDOWS\System32\doriot.exe

O4 - HKLM\..\Run: [Hotbar] C:\Program Files\Hotbar\bin\4.4.8.0\HbInst.exe /Upgrade

O4 - HKLM\..\RunServices: [system] dcomx.exe

O4 - HKLM\..\RunServices: [System Service] systems.exe

O4 - HKLM\..\RunOnce: [System Service] systems.exe

O4 - HKCU\..\Run: [drvsys.exe] C:\WINDOWS\System32\drvsys.exe

O4 - HKCU\..\Run: [key] C:\WINDOWS\S... Read more

1 more replies
Relevance 52.89%

I removed 180 Search Assistant (Internet Optimizer) from the computer that I'm working on and, when I reboot, I get a small window saying "Warning ... 180 Search Assistant removed." It then gives me choices of a)reinstalling it, b)Leaving it uninstalled and removing associated files, c)remind me later. I'm afraid this is a "fraudulent" window and that telling it to leave it uninstalled and to remove files is only going to make things worse. Any experience with this out there? Thanks!
 

Answer:180 Search Assistant

heres a good article http://articles.networktechs.com/394-p1.php
 

1 more replies
Relevance 52.89%

How do I get rid of this search assistant. I removed it from the taskbar by unchecking it, but when I shut down and boot back up, it's there again. It messes up the order that I have my quick launch and is just a pain. I have even tried to remove it from the add&remove programs in the control panel. Windows XP. Please help.
 

Answer:180 Search Assistant

spyware, m'lady, spyware. i'd estimate that 80% of the problems in the Web & Email forum here could be prevented if everyone went out and downloaded a spyware scanner. spyware is a piece of software written so it performs one of two main functions, both of them bad:
1) reporting back on your personal information
2) making a general mess of your computer

unfortunately, 180 is spyware. Add/Remove Programs doesn't get rid of it, going into Msconfig and removing it from your Start-up List doesn't get rid of it, praying to the Almight Technology Gods for salvation from the Spyware Demons doesn't get rid of it.
However, I have a solution. It's free, relatively easy, and if you don't get how to work it, you can ask someone here. Get either the programs Spybot Search & Destroy or AdAware 6.0. Personally, I recommend Spybot Search & Destroy, but you might find AdAware 6.0 easier to use.

To download Spybot Search & Destroy: http://www.spybot.info/index.php?page=download

To download AdAware 6.0: www.lavasoftusa.com/support/download/

Hope this helps!
 

1 more replies
Relevance 52.89%

Can anyone tell me what 180 Search Assistant is and do I need it? I received a message after running Spybot and installing Zone Alarm telling me that someone had remove it, or some of its componants, and offerig to re-install it. I ticked a box saying remind me later.I hope someone will advise me what to do.Regards Rita

Answer:180 Search Assistant

I think this is part of nCase click here

2 more replies
Relevance 52.89%

Hey, somehow I got ahold of that 180 search assistant. I have already downloaded the hijack this program and did the scan. I would appreciate some help in deciphering the logfile. Here's my logfile as follows:

Logfile of HijackThis v1.98.2
Scan saved at 5:12:27 PM, on 12/6/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\Program Files\eDonkey2000\eDonkey2000.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\aim\aim.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Expl... Read more

More replies
Relevance 52.89%

At start-up I keep getting a message board saying, " A third party has deleted this program without your permission", blah-blah-blah. It wants me to click to reinstall to make my programs run better and quicker. I have been closing the message board and carrying on, ignoring it. Can anyone enlighten me as to what this is? Is it genuine? Should I re-install it? If not, how do I get rid of the annoying message board popping up everytime?Thanks for any info. Casey

Answer:180 Search Assistant

Try Ad-aware click here and Spybot click hereUpdate each of them then scan. Let them delete everything they find.

4 more replies
Relevance 52.89%
Question: Search Assistant

How can I uninstall 180 search assistant?

Answer:Search Assistant

Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Double click on the program to run it.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless.

1 more replies
Relevance 52.89%

hi i have this 180 search assistant in my add remove programs i'm using xp i remove it it keeps comming back i download hijacker thing and this is my results
Logfile of HijackThis v1.98.2
Scan saved at 4:40:08 AM, on 11/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\smagent.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\System32\winnt.exe
C:\Program Files\Windows Media Compo... Read more

Answer:180 search assistant

this might help
http://www.sawtoothdistortion.com/Articles/Uninstall180Search.html
 

2 more replies
Relevance 52.89%

motto of the RCMP - WE ALWAYS GET OUR MAN (parasite)
XP Pro
MozillaFirefox

Important Note: Ran SygateOnlineSecurity Scan and it said: "NetBios (port 139) WIDE OPEN - sharing your whole hard disk with the world; DANGEROUS PORT TO HAVE OPEN"
so I think I need some advice on this subject!

SPYBOT LOG (since this file is too long I've had to cut out some bits of this; hope I didn't cut out anything important

--- Search result list ---
DoubleClick: Tracking cookie (Mozilla: kunjabihari) (Cookie, nothing done)
Avenue A, Inc.: Tracking cookie (Firebird: default) (Cookie, nothing done)
CoolWWWSearch: Tracking cookie (Firebird: default) (Cookie, nothing done)
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)

^ THESE WERE EVENTUALLY FIXED ^

--- Search result list ---
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-21-1960408961-920026266-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Setting... Read more

Answer:Search Assistant 180

Run HJT again and put a check in the following:

F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O4 - HKLM\..\Run: [hlmfdfgtni] C:\WINDOWS\System32\hqixlj.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
Close all applications and browser windows before you click "fix checked".

Restart in safe mode
Open Windows Explorer. Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files".
Now click "Apply to all folders", Click "Apply" then "OK"

Delete these:

C:\Windows\System32\wsaupdater.exe --> file
C:\WINDOWS\System32\hqixlj.exe --> file
C:\Program Files\WindowsSA --> folder

Reboot and post another log.
 

3 more replies
Relevance 52.89%

I keep getting pop-ups, even though they're meant to be blocked, and I even get them when I'm online and don't click on anything. The most likely suspect appears to be 180 Search Assistant, but I can't get rid of the various programs it seems to have installed. Spybot and Ad-Aware don't detect it, and Add/Remove Programs can't remove it, so how can I get rid of this ?

Thanks
 

Answer:How can I get rid of 180 Search Assistant

9 more replies
Relevance 52.89%

this program keeps showing up on my computer and i've uninstalled it 3 or 4 times from the add/remove programs part of the control panel. any one know how to get rid of it for good.
 

Answer:180 search assistant

Are you using adaware se or spybot? If now, then try running one of these and it should detect and delete everything.
 

1 more replies
Relevance 52.89%

ok, gang...this one is a stumper, at least to me. pop-up blockers do NOT stop it (maybe because my service pak 2 is made by microsoft?)..it has ALL the answers for me..no matter what it is i'm looking for. it's a full size window, and the banner at the top reads "brought to you by the 180 search assistant-microsoft internet explorer". i have a hard time believing that microsoft would actually annoy it's customers so badly..i mean, there ARE other browsers out there..and some are becoming quite popular, i've noticed.

i've run spybot s&d, and adaware..emptied the temp files and deleted the cookies..it's still there. help? thanx, guys.

h&k to all,

damgud

Answer:180 search assistant

Download the latest version of HijackThis (HJT), from here.Put HijackThis in a Permanent folder:Click My Computer / C: / File / New / Folder / name the folder; HijackThisPut HijackThis.exe, in this folder.This is a mandatory step, for the backup and restore functions, of HijackThis, to be able to work.Read the pinned post in the HJT forum, hereFollow the directions, EXACTLY! This is important!Then, run a log, and post it in the HJT forum here. Do not, fix anything, yet.A member, of the HJT Team, will help you out.Please, be patient, these people are volunteers. They will help you out, as soon as possible.

2 more replies
Relevance 52.89%

Hi,

I know next to nothing about computers so some really simple advice would be really appreciated - I am so stuck on this one!

Everytime I load up an internet page, popups appear that are from the "search180 assistant". Does anyone know how I can stop this from happening?

My computer is fairly old but has Windows XP.

Thanks

Kerry
 

Answer:Search 180 Assistant - please help!

8 more replies
Relevance 52.89%

Good Morning:
In our internet explorer, when you press the search button, we are getting an 'error on page'. If you go into the different toolbars, they work, but not the default search assistant...Last time this happened, we had disabled the internet search assistant tool. I fear we may have done this again, but for the life of me I cannot find where to fix this. I have looked in IE manage add-ons and is it not there. I have also looked in services.msc, but its not there either (I didn't think it would be there anyway, since it is an internet search, and not the computer)...Can anybody help me? thanks
 

More replies
Relevance 52.89%

Hi I am new here - I seem to have gotten the 180 Search Assistant in my computer. I have tryed to get rid of it with both Skybot and CWShredder but without luck. If anyone can help me here is my Hijackthis logfile....help would be greatly appreciated!Logfile of HijackThis v1.98.2Scan saved at 16:01:21, on 16.11.2004Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\WINDOWS\system32\drivers\KodakCCS.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exeC:\WINDOWS\system32\MMTray.exeC:\WINDOWS\system32\MMTray2k.exeC:\WINDOWS\system32\MMTrayLSI.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Common Files\Real ... Read more

Answer:180 Search assistant

Hi It is a good ideea to print or copy these instructions because you are not able to access the Internet in SafeMode.Make sure you are set to show hidden files and folders: A. On the Tools menu in Windows Explorer, click Folder Options.B. Click the View tab.C. Under Hidden files and folders, click Show hidden files and folders.D. Uncheck Hide extensions for known filetypes and Hide protected operating system files.How to see hidden files in WindowsREBOOT into SafeMode by tapping F8 key repeatedly at bootup: Starting your computer in Safe modeRun HijackThis!, press Scan, and put a check mark next to all these:R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)O4 - HKLM\..\Run: [gzyz] C:\WINDOWS\gzyz.exeClose all other windows and browsers, and press the Fix Checked button.Search for these files and delete them if found:C:\WINDOWS\gzyz.exe <-- this fileEmpty the Recycle Bin.REBOOT normally. Perform a full scan here: Trendmicro, check AutoClean and let him remove anything he finds.REBOOT your computer, run HijackThis! again and post a new log please.

9 more replies
Relevance 52.89%

Please review my Hijackthis log and let me know how do i remove this DNS search assistant .I dont know how come this got installed and most of the time i dont get the desired webpage but this one.There were few viruses also which i searched in google and deleted them but this dnssearch assitant is not going no matter how many times i am fixing them.Please help me as i am not that knowledgeable in these thing.

Logfile of HijackThis v1.99.0
Scan saved at 11:20:09 AM, on 12/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\eXpress\NS Client\AeXNSAgent.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\lotus\notes\ntmulti.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\System32\erfock.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Yahoo!\Messenger\YPag... Read more

More replies
Relevance 52.89%
Question: Search Assistant

When searching from a site like Yahoo or Google, a Search Assistant pane keeps appearing on the right hand side of the IE 6.0 window. It does not appear to be the IE search assistant as it has a different look. It has a "results" tabl and a "search" tab at the top of the pane. Bringing up "Properties" by right clicking on the pane indicates that the URL is About:Blank. All the other inforamation in the the Properties/General window is given as "not available".

This pane is rather annoying and I wish to turn it off. Any method for doing this?
Win XP Home
MS IE 6.0
 

Answer:Search Assistant

8 more replies
Relevance 52.89%

I can't seem to navigate on the web anymore. Or better yet I can't even sign on anymore. I've had to go back and use my old computer in order to get on line now. Due to this spyware, my old computer is much faster than the new one and that should not be. I have tried ad-ware to clean things off but this is not working on this problem. I have ran hijack this and below is the log I get: Can someone tell me what to do to bring my computer back.
Logfile of HijackThis v1.97.7
Scan saved at 8:20:01 PM, on 7/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME\Binn\sqlservr.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\desk98.exe
C:\WINDOWS\System32\3capplnk.exe
C:\WINDOWS\SYSTEM32\3cmlink.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Hasbro Interactive\Atari Arcade Hits 1\Atari icon.exe
C:\WINDOWS\av.exe
C:\windows\temp\Y3zPDEjFX.exe
C:\WINDOWS\TimeSynchronize.exe
C:\WINDOWS\System32\axsnmnf.exe
C:\Program Files\Common files\updater\wupdater.exe
C:\WINDOWS\wkcqa.exe
C:\Program Files\Common files\WinTools\WTo... Read more

Answer:How do I get rid of search assistant 180?

Run HJT again and put a check in the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\ClearSearch\CSIE.DLL (file missing)
... Read more

3 more replies
Relevance 52.89%

hello everyone,

I am stock with the 180 search assistant and I can not uninstall it. I need help uninstall it !

Thanks in advance

Answer:help to get rid of 180 search assistant

Hi there Kardon,Next time, instead of including your log, can you please post it like I did below? It saves us some time.I will be looking at your log Logfile of HijackThis v1.98.2Scan saved at 14:32:46, on 2004-11-20Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeC:\WINDOWS\System32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\Program Files\Analog Devices\SoundMAX\Smtray.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\Intel\NCS\PROSet\PRONoMgr.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exeC:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exeC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\Sy... Read more

6 more replies
Relevance 52.89%

Please, please help me. I can't seem to get rid of 180 Search Assistant and my Google toolbar has completely vanished! Also, my internet homepage has been altered to www.blazefind.com and everytime I change it to my default setting (www.btopenworld.com) then log on again, the blazefind address reappears.

I have attached my logfile below having done a HijackThis scan and wonder whether you can advise me on what I should/shouldn't delete.

I hope you can assist 'cause this is driving me mad!!!

Thanks so much.
Karen

Logfile of HijackThis v1.97.7
Scan saved at 21:00:30, on 11/07/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\WINDUPDATES\WINUPDT.EXE
C:\PROGRAM FILES\WIND... Read more

Answer:180 search assistant

Hiya and welcome

I've slipt your reply off to a new thread, as its easier to work on that way. Also, this will bump up for the Security experts to see easier

Regards

eddie
 

2 more replies
Relevance 52.07%

I ran a spy ware program and it is showing that I am infected by CWS Home Search Assistant. I downloaded the Hijackthis program and made a log file that I am posting below. I don't want to delete anything that should not be deleted. Can anyone help me with this or point me in the right direction for help?ThanksJaunlucLogfile of HijackThis v1.99.1Scan saved at 9:03:41 PM, on 3/1/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\PROGRA~1\VCOM\Fix-It\mxtask.exeF:\Program Files\Norton Anti Virus\navapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINDOWS\system32\BRMFRSMG.EXEC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files... Read more

Answer:Cws Home Search Assistant

Hi and welcome to Bleeping.

Your log is clean. What program detected this and in what location?

2 more replies
Relevance 52.07%

Logfile of HijackThis v1.99.1Scan saved at 1:05:20 PM, on 3/25/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\Explorer.EXEC:\jerrys\gcasServ.exeC:\Program Files\Yahoo!\browser\ybrwicon.exeC:\Program Files\AntiVir PersonalEdition Classic\avgnt.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\WINDOWS\System32\ctfmon.exeC:\PROGRA~1\Yahoo!\browser\ycommon.exeC:\Program Files\SpywareGuard\sgmain.exeC:\jerrys\gcasDtServ.exeC:\Program Files\SpywareGuard\sgbhp.exeC:\Program Files\AntiVir PersonalEdition Classic\sched.exeC:\Program Files\AntiVir PersonalEdition Classic\avguard.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Cobian Backup 7\cbs.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program ... Read more

Answer:Need Help Getting Rid Of Cws Home Search Assistant

Sorry for the delay. If you are still having problems please post a brand new HijackThis log as a reply to this topic. Before posting the log, please make sure you follow all the steps found in this topic:Please follow the instructions at the Preparation Guide before posting a HijackThis logIf you have already followed these steps, then go ahead and post a new log as a reply.But before you do so I advise you to follow this advise:Download CWShredder to your desktop. Start CWShredder and click ?I Agree? > click ?Update?Start CWShredder and Click FixClick Next and let it fix everything.

1 more replies
Relevance 52.07%

Hi,

180 Search Assistant keeps trying to reinstall itself and I can't find the files assosiated with 180 Search Assistant. Here is my Hijack log. Any help at identifiying any bad files would be most appriciated!

Logfile of HijackThis v1.99.0
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Progra... Read more

Answer:180 Search Assistant HiJack Log

Self bump
 

2 more replies
Relevance 52.07%

i have been fighting with HSA for 3 days now and i cant figure out how to remove it.I need help.

Logfile of HijackThis v1.98.0
Scan saved at 12:47:34 PM, on 2/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\mfcbr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\apiue32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\Bin\HPOstr05.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\bin\HPOVDX05.EXE
C:\WINDOWS\System32\hpoipm07.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.ninemsn.com.au/0SEDEAT/SAOS01
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\doins.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\... Read more

Answer:Home Search Assistant

The solution is here: http://www.majorgeeks.com/vb/showthread.php?t=35917

You just need to follow the steps and take the appropriate information from your HijaakThis log and apply it at the correct places.
 

1 more replies
Relevance 52.07%

First off, great site. I used it to attempt to delete SpySheriff and Home Search Assistant.Can someone take a look at my logfile from HJT and let me know if any more action is needed on my part. Also. The themes on my taskbar and windows seem to be disrupted. I am having a hard time changing them back. Any help is greatly appreciated.Thanks All,FALogfile of HijackThis v1.99.1Scan saved at 5:00:59 PM, on 12/14/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeC:\Program Files\ewido\security suite\ewidoctrl.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Sony\VAIO Media Music Server\SSSvr.exeC:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exeC:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exeC... Read more

Answer:A Little Help Re: Home Search Assistant

UPDATE:

I fixed the themes.
Just need some analysis on the HJT.


.................I will be sending a donation. You guys deserve every dollar.
FA

2 more replies
Relevance 52.07%

I need some help removing this bloody thing. Ive spent 5 days trying one thing or another to get this out. Ive read a few items here and tried one to no avail. My scan of HiJack this.

Logfile of HijackThis v1.98.0
Scan saved at 4:04:26 PM, on 02/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\apieb.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\msnr.exe
C:\Program Files\Common Files\Symantec Shared\c... Read more

Answer:Home Search Assistant Help!!

read thread:


http://www.majorgeeks.com/vb/showthread.php?t=35407
 

2 more replies
Relevance 52.07%

Hello, I'm fixing a friends computer and for the first time I have gotten stuck. I have gone through the instructions on this site and Short-Media's. Both times I enter IE and it comes back. The services are not there RPC Helper etc. I remove all the HJT entries (some aren't there example the (no name) one and such.) I can't update adaware or spybot because it wont let me connect to the internet. I have the cat5 plugged in and all the settings seem right but it won't connect. I've ran Norton One Button Checkup and AntiVirus. Here is my HJT Log, Followed by my Startup List from HJT (for the services part):Logfile of HijackThis v1.99.1Scan saved at 12:55:44 PM, on 8/26/2005Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\drivers&... Read more

Answer:HJT Log: Home Search Assistant Still

Note: I know to remove the R1's and the R3

3 more replies
Relevance 52.07%

Hi, here is my HJT log, my computer has been infected with Home Search Assistant and since CWS_NS3 kept coming up on ad-aware scans, I decided to take a closer look and wound up here. Please help me decide what to remove from this log, as I am aware that some items should not be removed. I've been following the directions listed on http://www.bleepingcomputer.com/tutorials/remove-home-search-assistant/ and below I've placed an * next to each one I suspect should be removed. Thank You in advance Logfile of HijackThis v1.99.1Scan saved at 1:32:49 PM, on 1/2/2006Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exeC:\WINNT\System32\svchost.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXEC:\WINNT\System32\nvsvc32.exeC:\WINNT\system32\regsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system3... Read more

Answer:Home Search Assistant

Sorry for the delay. Are you still having problems? If so, please post a brand new hijackthis log as a reply to this topic. Also make sure you have followed all the instructions in this topic before you post your new log:Preparation Guide For Use Before Posting A Hijackthis Log

1 more replies
Relevance 52.07%

a couple weeks ago i had 180 search assistant on my computer, i went to ctrl+alt+del>applications and then i closed msbb.exe and deleted it in my computer c://

i just got it again and when i try to end it in ctrl+slt+del it closes when i moseover...and when i run msconfig that also closes...i rele don't know what to dao and i need help. if you caould email me or reply that would be very helpful

email: addy removed by Cookiegal
 

Answer:Spybot and 180 Search Assistant

16 more replies
Relevance 52.07%

Hi, I have downloaded the hijack this program and have done a log,

Logfile of HijackThis v1.99.0
Scan saved at 1:56:20 PM, on 1/21/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RioMSC.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\winnt\180ax.exe
C:\WINNT\mmups.exe
C:\WINNT\suploads.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\DeskAd Service\DeskAdServ.exe
C:\WINNT\system32\SahAgent.exe
C:\Program Files\DeskAd Service\DeskAdKeep.exe
C:\WINNT\system32\REOSMSNGR.EXE
C:\WINNT\system32\prutict.exe
C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
C:\Program Files\NETGEAR WG311v2 Adapter\wlancfg5.exe
C:\PROGRA~1\COMMON~1\tsa\ts2.exe
C:\WINNT\system32\prutict.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Internet Explorer\iexplore.e... Read more

Answer:Spybot and 180 Search Assistant

Hi, While you have at least one Internet Explorer page open, go to Add/Remove Programs and uninstall:

180solutions ///Secret Smileys, PopCentral or similar

Internet Optimizer

Viewpoint everything

DeskAd everything

MediaMotor

ShopAtHomeAgent (SAHagent)

You have tons of spyware etc on there, you need to download these:

AdAware SE personal edition v. 1.05

SpyBot 1.3

flrman1 said:

Go here and download Adaware SE.

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode tick Perform full system scan.

Next deselect Search for negligible risk entries.

Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Restart your computer.

Then go here and download Spybot Search & Destroy.

Install the program and launch it.

Before scanning press Online and Search for Updates .

Put a check mark at and install all updates.

Click Check for Problems and when the scan is finished let Spybot fix/remove all it finds marked in RED.

Restart your computer.

Come back here and post another Hijack This log and we'll get rid of what's left.Click to expand...

The links in the quote box will get you to the download page. Then, install a... Read more

1 more replies
Relevance 52.07%

I tried everything, Norton...Adware...Spy Ware..and I cannot get rid of my home page changing to a home search assistant. I have even tried the down load HS Remove....Home Page still changes to a search assistant. Does anyone have an idea how I can correct this? Thanks -John
 

Answer:Home Search Assistant

I had the same problem. It was a major pain to get rid of. I downloaded Hijackthis and that took care of the homepage thing. Here is a thread from another site that helped me get rid of it. Just go down the line and try each thing.
http://www.computing.net/security/wwwboard/forum/12346.html

Best of luck to you. I know how annoying it can be.
 

3 more replies
Relevance 52.07%

I have been plagued with this thing for a while now! I hate it! Please help.

Here is my Hijack Log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\EzButton System V1.0\EzButton.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Pro... Read more

Answer:Home Search Assistant

Please checkout this thread http://www.majorgeeks.com/vb/showthread.php?t=35917 for info on removing.
 

2 more replies
Relevance 52.07%

I have tried most of the posted fixes here, and even the latest hsremove.exe. It keeps coming back with new file names. I have system restore disabled and have used Ad-Aware, Spybot, and HJ-this. I have been trying for a week to get rid of this %$$#&^^*&i**ing thing, to to avail.

Should I just give up and reload XP.

I cant go back with system restore, because there are no previous dates to go to. I don't know why....
 

Answer:Home Search Assistant

Could you post your HJT log please
 

6 more replies
Relevance 52.07%

While my desktop was messed up I had no choice, but to use my laptop (which I am typing on now).

I logged onto it this morning and found myself under the banner of those infected with the Search Assistant, Shopping Wizard, and one other program that the name slips me.

I tried using Adware, Spybot, Hijack This, and even Force Uninstalled them..but the damn thing keeps coming back.

I tried some stuff that I saw on other forums and newsgroups, but I want to see what you guys think of my particular case here.

Here is my hi jack this log...

Logfile of HijackThis v1.97.7
Scan saved at 2:21:34 PM, on 6/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
c:\toshiba\ivp\swupdate\swupdtmr.exe
C:\WINDOWS\wanmpsvc.exe
C:... Read more

More replies
Relevance 52.07%

I've tried everything to get rid of these, ad-aware, spybot s&d, etc. I don't know what to do. I really don't know anything. Please help! Here's my HijackThis log thing:

Logfile of HijackThis v1.97.7
Scan saved at 9:05:15 PM, on 6/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\iesj.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\ieiz.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\Brad\My Documents\My Downloads\toolbarcop.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Brad\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fwpiw.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://fwpiw.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://fwpiw.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fwpiw.dll/sp.html#96676
R1 - HKLM\Software\Mic... Read more

More replies
Relevance 52.07%

Hi, I am new to this forum so if I break any rules of etiquette, I am sorry. I recently got the Home Search Assistant on my computer somehow and I am having trouble removing it. I did a HighJack This scan and just need some guidance on what to remove. Thanks in advance for all your help. Here is the log:Logfile of HijackThis v1.99.1Scan saved at 9:07:04 AM, on 6/3/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\WTablet\TabUserW.exeC:\WINDOWS\system32\DVDRAMSV.EXEC:\WINDOWS\System32\inetsrv\inetinfo.exeC:\Program Files\... Read more

Answer:Home Search Assistant Bug

Download the attached zip file and unzip it to your desktop.http://www.mvps.org/winhelp2002/DelDomains.infRight-click on the deldomains.inf file and select 'Install'Download cwshredder 2.12 from here:http://cwshredder.net/bin/CWShredder.exeRun the file after it is downloaded and click on the fix button. Let it do its thing and when its done, even if it crashes.When its done run hijackthis again post a new log

1 more replies
Relevance 52.07%

I'm having a problem opening web pages (even though I can open the home page). The message at the bottom left of the screen reads "Connecting to page (IP address)" instead of a URL. Then I get a page cannot be displayed message. The page will usually then load after 4 or 5 tries. I have used Spybot and Adaware and deleted the items they found. But, still having the problem. Anyway, here's the log. Thanks for your help.Logfile of HijackThis v1.98.2Scan saved at 4:00:22 PM, on 11/22/2004Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\S24EvMon.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\WINNT\system32\svchost.exeC:\Program Files\Network Associates\Common Framework\FrameworkService.exeC:\Program Files\Network Associates\VirusScan\Mcshield.exeC:\Program Files\Network Associates\VirusScan\VsTskMgr.exeC:\WINNT\system32\RegSrvc.exeC:\WINNT\system32\regsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\ZCfgSvc.exeC:\WINNT\Explorer.EXEC:\WINNT\system32\... Read more

Answer:DSO Exploit, 180 Search Assistant

Open Add/Remove programs and remove these if they exist:BullsEye NetworkWindows AdControlWeb_Rebates180Search AssistantI want you to fix some of those entries. Please do the following:Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden filesRun Hijackthis again, click scan, and Put a checkmark next to each of these. Be sure to close all browser windows, including this one before clicking the Fix button.R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dllO2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINNT\wsem302.dllO2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dllO4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exeO4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"O4 - HKLM\..\Run: [jwzgfsx] C:\WINNT\jwzgfsx.exeO4 - HKLM\..\Run: [salm] c:\temp\salm.exeO4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exeO8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htmReboot your computer into Safe Mode an... Read more

1 more replies
Relevance 52.07%

HijackThis log belowHi, I?ve got a serious problem and i would be very thankfull if anyone could help me.The situation is that my computer was infected with home search assintant, and has I browsed the web in search for info, i?ve come across with this site. The thing is i have followed your instructions for the removal and it solved that problem. the thing is i think i?ve deleted something i shouldn?t have, because my pc is a mess. i?ve tried to restore the fixes i?ve done with hijackThis but it?s all the same Here are some of the problems i?ve encontered so far:1- When i try to open some files, i get a error message saying that it is allready open somewhere.2- i can?t make a simple copy paste anywhere, either windows, or any program3- i can?t use some of the hiperlinks on the web or with messenger, (i can?t acess my hotmail e-mail neither using messenger nor using internet explorer.4- Coreldraw 10 stoped working. a message displays cored has generated errors and must close. an error log ius being created5- my norton antivirus can?t scan i when i reboot the computer i get a message from symantec saying that there is no status information about norton and that he can be being sabotaged by a vyrus or hacker activity.6 when i open the control panel the layout of the page is screwed up. all of the icons apear on the left pannel , and the right side is empty7 I can?t see the content of system32 folder neither the programs folder8 I?ve tryed to fix windows 200 using the windows cd... Read more

Answer:need Help, please about home search assistant

Hi,

Having a look.

26 more replies
Relevance 52.07%

Hi
I have dont know how picked up Zango Search Assistant 10.0.341.0and cant get rid of it. My spyware is blocking it but it is coming up every few mins and is a pain. can any body help me get rid of it
 

Answer:zango search assistant 10.0.341.0

Let's run some scans and see what we can find.

* Click here to download HJTsetup.exe

Save HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you also use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you also use Opera browser
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click ... Read more

1 more replies
Relevance 52.07%

Is there some way I can set up the search page to show the 'search assistant' window rather than the default.

TIA.
 

Answer:Search Assistant selection.

Start | Run type Regedit press enter
navigate to:

Code:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
On right hand side You should see Use Search Asst with a value of no
Change that to yes, or just delete the Use Search Asst value

HTH

Jerry
 

3 more replies
Relevance 52.07%

Hello, I think, after having viewpoint media toolbar and AOL downloaded on my computer, I have search assistant on my computer. I have tried getting it off one account with good luck, but I need help in analyzing the logs for my mom's username account. Perhaps after that I will go to my Dad's and see if he too is infected.

I have done the preliminary stuff like Avira scan, Malware bytes, DDS log, etc, but I am still working on GMER.

Here is the log (don't mind the Logitech stuff code 018):

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:04:55 PM, on 9/4/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
G:\Computer Protection\Lavasoft\Ad-Aware\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\... Read more

Answer:Search Assistant Troubles!

Bump

*update* Gmer scan was completed on safemode, but unfortunately it froze up when I asked it to save. It did not announce anything being caught.
 

2 more replies
Relevance 52.07%

Follwed instructions and the toolbar diappeared.. Now as I start browsing on firefox I get an alert from my Norton firewall asking to permit this connection. I block it.I permitted this before and the hijacker returned .This is the log from norton firewall log: Help is appreciated. Thanks Details: This one time, the user has chosen to "block" communicationsOutbound TCP connectionRemote address,service is (f15717.bins.lop.com(66.220.17.158),http(80))Process name is "C:\Program Files\Internet Explorer\iexplore.exe" Logfile of HijackThis v1.98.2Scan saved at 1:19:31 AM, on 8/26/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exec:\Program Files\Norton Personal Firewall\NISUM.EXEC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\HP\KBD\KBD.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Common Files\Microsoft Shared\Work... Read more

Answer:Search Assistant removal

Are you already being helped in another thread?

1 more replies
Relevance 52.07%

Logfile of HijackThis v1.98.2Scan saved at 6:05:20 AM, on 8/23/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exec:\Program Files\Norton Personal Firewall\NISUM.EXEC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\HP\KBD\KBD.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\WINDOWS\LTMSG.exec:\progra~1\... Read more

Answer:Search Assistant Removal

I want you to fix some of those entries. Please do the following:Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden files in WindowsRun Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix buttonR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bqqiwmqzjtdiaqd.net/YobkkBgtflu...pJ4cDxgrq5m.jpgO2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod-1.dllO2 - BHO: (no name) - {D851EA4E-FB53-1B72-AD35-D592E4700583} - C:\PROGRA~1\ERRORC~1\Hold this.exeO2 - BHO: TChkBHO Class - {F6E6D2FD-5AFD-4D35-91CD-3F09010EFD52} - C:\WINDOWS\system32\effje.dllO4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exeO4 - HKLM\..\Run: [Audio Noun] C:\PROGRA~1\OPENDO~1\Info Platform First.exeO4 - HKLM\..\Run: [support bird readme move] C:\Documents and Settings\All Users\Application Data\Proxy More Support Bird\heartfast.exeO4 - Startup: PowerReg Scheduler.exeO8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\System32\wweb32.dll/lookup.htmlO16 - DPF: {0191ABF4-9421-435E-9FFD-CD827A2A82D8} (SBITAX7Ctrl Class) - http://ultimateplugin.com/tl7000.dllO16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...f7... Read more

1 more replies
Relevance 52.07%

every time i double click on a shortcut or program the search assistant comes up rather than opening a program/////
can anyone help????
 

Answer:Solved: search assistant

7 more replies
Relevance 52.07%

Hello! My computer is infected with myway garbage. SAS did not catch it, but MBAM did. MBAM quarantined it, but MyWay Search Assistant is still running and it will NOT allow me to uninstall. I also can not boot up in safe mode. Help, please?

Here is it's log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

6/10/2010 10:41:45 PM
mbam-log-2010-06-10 (22-41-45).txt

Scan type: Quick scan
Objects scanned: 141347
Time elapsed: 8 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\mywaysearchassistantde.auxiliary (Adware.MyWaySearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywaysearchassistantde.auxiliary.1 (Adware.MyWaySearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Answer:MyWay Search Assistant

Please run the Malwarebytes scan again and post the new log.

35 more replies
Relevance 52.07%

Ok, I got rid of the Home Search thing, but now I cannot access my advanced settings in the properties! That means I can't change my monitor settings adapter ect... basicly all the tabs are gone! And also some buttons have the Xp shell style but others are just the classic look! Please help A.S.A.P! Thanx in advance!

Answer:Home Search Assistant gone but...

I'm not familiar with the details of your recent fix, but you might check start-->control panel--> appearance & themes (or display properties)-->computer's theme-->dropdown menu in display properties box at that access point... make sure it's not in windows classic.

5 more replies
Relevance 52.07%

CWShredder removes it, but it keeps coming back. Here is my log.

Logfile of HijackThis v1.98.2
Scan saved at 11:08:18 PM, on 11/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\BRMFRSMG.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner.DELL\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\_h.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\_s.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\_h.html
R1 - HKLM\Software\Microsoft\Internet Explorer\... Read more

Answer:Search Assistant 180 keeps reappearing

Run the current version of CWShredder, clean everything it finds, then run HijackThis and fix all these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\_h.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\_s.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\_h.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\_h.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\_s.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = C:\WINDOWS\_s.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = C:\WINDOWS\_s.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = C:\WINDOWS\_h.html
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = C:\WINDOWS\_h.html
R1 - HKCU\Software\Microsoft\Internet Explorer... Read more

1 more replies
Relevance 52.07%

Okay I accidently got this stupid Zango Search assistant and I want it off my computer and I went into my computer into add/remove programs and it will not let me delet it..... HELP

-Stephanie

Answer:Zango Search Assistant

post us a hijack this log

2 more replies
Relevance 52.07%

Hi

Im trying to open up my search assistant in windows XP professional. I go through start, and then search, but the thing is when i click on the search button nothing happens.

I have previously removed some spyware and viruses which i think may have been attatched to the windows search assistant.

I need help as soon as possible.
Thanks
 

Answer:Windows Search Assistant

11 more replies
Relevance 52.07%

Please help. I followed the instructions on the CWS_NS3 Removal Guide for the Home Assistant. In Step 2 where it says disable the one of the above services, I disabled Remote Procedure Call (RPC) with no "Helper" attached. Now, my installed printers won't work, when i minimize a file it closes and a couple of my programs won't run. Please help! I did write down the path to executable field. Can you help? Thanks. Barbara

Answer:Home Search Assistant

HiEnable the service: Remote Procedure Call (RPC)Post a hijackthis log here please - follow the link:http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/How to post a HijackThis Log

1 more replies
Relevance 52.07%

I have no idea how this home search assistant was installed on my computer but i can not get rid of it. Can someone help me please
 

Answer:Home Search Assistant

88champ said:

I have no idea how this home search assistant was installed on my computer but i can not get rid of it. Can someone help me pleaseClick to expand...
 

2 more replies
Relevance 52.07%

Logfile of HijackThis v1.99.1
Scan saved at 1:05:20 PM, on 3/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\jerrys\gcasServ.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\jerrys\gcasDtServ.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Cobian Backup 7\cbs.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\jerrys 2\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\jerrys\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet... Read more

Answer:need help getting rid of home search assistant

try right clicking on the ***'t and see if the dropdown menu gives a choice to stop/change the ***'t.
 

3 more replies
Relevance 52.07%

I am having a great deal of trouble removing home search assistant from my computer. I have followed a number of online tutorials but have failed to remove it from my computer. If anyone could help me in any way I would appreciate it. I have attached the results from HJT. Thanks.ogfile of HijackThis v1.98.2Scan saved at 5:14:14 PM, on 11/25/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\hkcmd.exeC:\WINDOWS\system32\dla\tfswctrl.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exeC:\Program Files\DIGStream\digstream.exeC:\WINDOWS\System32\P2P Networking\P2P Networking.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\MUSICMATCH\MUSICM... Read more

Answer:Home Search Assistant and HJT

Hi jamie3219,You have a nasty CoolWebSearch infection which requires precise steps to fix:Please download ServiceFilter.zip. This will reveal potential unauthorized running services in your system. Extract it to a new folder on your desktop. Double-click ServiceFilter.vbs. This script will create a text file named Post_This.txt in the same folder as the script itself has been saved - copy and paste the contents of Post_This.txt in your next reply here along with a new Hijackthis log.From the moment you post your list, until you see a detailed fix written up, DO NOT reboot your system or log off. If you do, the service will have changed and the fix provided will not work

5 more replies
Relevance 52.07%

I have a Netgear Router which when loading the USB Software it loads 180 Search Assistant. Does anyone know how or if i can remove this safely and allow my wireless conection to work. If i remove it as said in the manual the wireless conection is still operating but the web and outlook express will not collect or send information. Adware belives this item is Spyware if i keep using Adware, the adware file will soon fill up with 180 Search Asssistant info

Answer:NETGEAR 180 SEARCH ASSISTANT

Wipe it with Adaware or this click here, fix any problems if it damages your internet connection with this click here

2 more replies
Relevance 52.07%

I've set up three new Dell PC's this week and notice that a program called "My Way Search Assistant" is appearing in the Add/Remove programs list.

Is this the same "My Way" that gets zapped when doing a Spyware clean up?

If so, what the hell are Dell doing sticking it on their PC's
 

Answer:Dell - My Way Search Assistant

here is a website that might help you.
http://www.pchell.com/support/mywebsearch.shtml
 

1 more replies
Relevance 52.07%

I thought I had Search Assistant and kin removed, but then it came back on me. Here's my latest log:Logfile of HijackThis v1.99.1Scan saved at 5:34:23 PM, on 4/22/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\mfcad.exeC:\WINDOWS\system32\msole32.exeC:\Program Files\Analog Devices\SoundMAX\SMTray.exeC:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\system32\sdksu32.exeC:\program files\valve\steam\steam.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\OpenOffice.org 1.9.79&#... Read more

Answer:HijackThis Log - Search Assistant etc.

Download cwshredder 2.12 from here:http://cwshredder.net/bin/CWShredder.exeRun the file after it is downloaded and click on the fix button. Let it do its thing and when its done, even if it crashes.When its done run hijackthis again post a new log

7 more replies
Relevance 52.07%

Thought I'd give this a second try--see if anyone has an idea, other than a complete reinstall.

Search for Files/Folders not working

------------------------------------

I have a problem with the "Search for files & folders" function. Indexing is turned off.

When I do a search for the single letter "a" or other combinations that start with "a," "ab," "ac," "ag"... the search looks at the WINNT directory, only.

For example, a search for "ad[obe]" will scan the all the drives.

But, a search for "ac[robat]" only scans C:\ or C:\WINNT.

If I search for "ac[robat]" specifing it to look at a drive other than C, then it searches that drive properly.

It's only when I do a search looking at "my computer" or all "local hardware," does it exclude certain letters and look at C:\ or C:\WINNT\ for that letter/letter combination.

Any ideas? --sys. is clean of viruses, etc.

Bob in Provo
 

Answer:Search Assistant broken

If you have no particular attachment to that search function, you might just use a different searcher. I use Agent Ransack in XP and find it faster and more thorough than the MS search. It's free. It has no adware. Registration is optional. It works.
 

2 more replies
Relevance 52.07%

in my Windows XP and I'm not sure how this happened. I can't figure out how to get it back. Thanks
 

Answer:Lost the Search Assistant

Hi,,Search Assistant is not a good thing..Do you think you could post a hijackthis log? Click the link below and install hijackthis from one of the links at the site. Install then run it. Hit the scan button and check no boxes. The Scan button will change to a save log button. Save the log somewhere you can find it then copy and paste all the text here in a post so we may check it over.

http://mjc1.com/mirror/hjt/
 

2 more replies
Relevance 52.07%

First, thanks a lot to you guys for taking the time to help us less knowlegeable computer users.I have been infected with the Home Search Assistant hijack for some time now, but can't seem to get rid of it. If anyone can help, I would be most grateful!Here is my latest Hijack This log:Logfile of HijackThis v1.99.0Scan saved at 9:24:19 PM, on 2/5/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Documents and Settings\Anthony Barrett\My Documents\Hijack This\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\sueau.dll/sp.html#37049R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\sueau.dll/sp.html#37049R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\sueau.dll/sp.html#37049R1 - HKLM\Software\Microsoft\Internet Explorer&#... Read more

Answer:Home Search Assistant - please help!

Thanks for sending your HijackThis logfile.You have a CWS About:Blank infection, which will take several messages to completely fix.Here are the first instructions:This is a variant of CoolWebSearch that redirects your homepage to about:blank. It also installs a malicious service that prevents it from being fixed. We need to eliminate that service.Obtain list of irregular services:Please download ServiceFilter.Unzip ServiceFilter.zip to a convenient folder like C:\ServiceFilter.Navigate to where you unzipped it and double-click on ServiceFilter.vbs.If you have an active anti-virus it might prevent the script from starting. Please allow the script to run.It will open a text file (POST_THIS.TXT) that lists all of the irregular services.Press Ctrl + A simultaneously to select all of the text.Copy and paste the whole thing into your next post.A copy of POST_THIS.TXT is saved to where ServiceFilter.vbs was saved just in case you accidentally close out of it.Please send a fresh HijackThis log along with the Post_This.txt information.Then, do not reboot until you hear back from me.Thanksdaveai

15 more replies
Relevance 52.07%

Hi everyone, Search assistant is driving me suicidal, please could someone take a look at my "highjack this" log. Any help would be appreciated. Many tanks in advance.Logfile of HijackThis v1.99.0Scan saved at 19:59:25, on 01/28/2005Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SYSTEM\MSTASK.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\TASKMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\WINDOWS\SYSTEM\GSICON.EXEC:\WINDOWS\SYSTEM\DSLAGENT.EXEC:\WINDOWS\LOADQM.EXEC:\WINDOWS\RUNDLL32.EXEC:\PROGRAM FILES\TRUST\250S SERIES\LWBWHEEL.EXEC:\WINDOWS\RUNDLL32.EXEC:\WINDOWS\SYSTEM\QTTASK.EXEC:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXEC:\WINDOWS\SYSTEM\DDHELP.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\WINDOWS\SYSTEM\RNAAPP.EXEC:\WINDOWS\SYSTEM\TAPISRV.EXEC:\WINDOWS\TEMP\HIJACKTHIS.EXEC:\WINDOWS\NOTEPAD.EXEC:\HIGHJACK THIS\HIJACKTHIS.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.ukR1 - HKLM\Software\Microsoft\Internet Expl... Read more

Answer:Please help, search assistant nightmare

[Edited]

tweak, please refrain from offering advice as it can cause confusion.

15 more replies