Computer Support Forum

Myway Search Assistant Removal

Question: Myway Search Assistant Removal

I was infected on Sunday July 5th and ran the Superantispy software and that seem to clear the issue, but I still have the Myway Search Assistant as a listed program. I see a previous post with the same issue and followed all the instructions up to including the post from Chaslang on 07-05-05 14:43 (http://forums.majorgeeks.com/showthread.php?t=66855). I believe the threat has been removed, but like rookiegirl it still shows in my "add/remove programs" and I want to make sure the threat is completely removed.

I didn't know if the delmyway.reg given to rookiegirl would work directly for my PC. Attached are the log files. Please let me know if there's more to be done and how to get rid of the final traces of the Myway Search Assistant

Thanks in advance for you help!
(first time msg board, so please let me know if I've committed any faux paus!)

Relevance 100%
Preferred Solution: Myway Search Assistant Removal

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: Myway Search Assistant Removal

Welcome to Major Geeks!

We cannot continue until you attach the last log that was requested which is the C:\MGlogs.zip file created by running MGtools.

19 more replies
Relevance 79.17%

Hi. My mywaysearch assisant is gone rogue. I've attached my log of hijackthis so I just need help on what to do next. Already uninstalled myway and cleared the folders as well.
 

Answer:Myway Search Assistant Removal

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****
Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.


After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
Helpful Notes:


If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
If you cannot seem to login to an infected user account, try using ... Read more

1 more replies
Relevance 91.84%

Hello! My computer is infected with myway garbage. SAS did not catch it, but MBAM did. MBAM quarantined it, but MyWay Search Assistant is still running and it will NOT allow me to uninstall. I also can not boot up in safe mode. Help, please?

Here is it's log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

6/10/2010 10:41:45 PM
mbam-log-2010-06-10 (22-41-45).txt

Scan type: Quick scan
Objects scanned: 141347
Time elapsed: 8 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\mywaysearchassistantde.auxiliary (Adware.MyWaySearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywaysearchassistantde.auxiliary.1 (Adware.MyWaySearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Answer:MyWay Search Assistant

Please run the Malwarebytes scan again and post the new log.

35 more replies
Relevance 91.02%

Hi,

I'm running XP, SP3, with AVG (newly downloaded) Spybot (Teatimer was resident) and Adaware.

I ran a number of spyware assistants which diagnosed infections with Virtumondo, and found Myway search assistant (which Wikipedia said is malware) when running add or remove programs. I went through the steps in Read & run me first, but I know the Myway is still there and assume Virtumondo is as well.

I've attached the logs. I could not run Rootfix; I kept getting an error message which said contact the author (I did, no answer yet).

I suspected malware when I noticed that at times my CPU was almost 100% busy, mostly with teatimer (I've since disabled it). Wikipedia (!!!) said that Virtumundo could corrupt it; that was the first answer I saw. I downloaded Spyware Doctor which found Virtumundo, but CD net had a bad review so I uninstalled it. I saw you do not approve of Vundo fix. SO: How do I get rid of Virtumundo and MyWay search assistant?

Thank you for all the time you devote to this! I'm going back to turn on firewalls, antivirus, spyware detectors, etc.
 

Answer:Virtumondo & Myway Search Assistant

Note that myway search assistant shows up in the add/remove programs list, but shows no size - one of the antispy programs may have partially removed it.
I downloaded Spyware Doctor again and re-ran it, and it did not find Virtumonde this time. I uninstalled AVG and installed Antivir and Comodo and Spyblaster.
Is it possible that all I have now is a registry entry to delete?

Thanks again!
 

2 more replies
Relevance 73.8%

Logfile of HijackThis v1.98.2Scan saved at 6:05:20 AM, on 8/23/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exec:\Program Files\Norton Personal Firewall\NISUM.EXEC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\HP\KBD\KBD.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\ALCXMNTR.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\WINDOWS\LTMSG.exec:\progra~1\... Read more

Answer:Search Assistant Removal

I want you to fix some of those entries. Please do the following:Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden files in WindowsRun Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix buttonR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bqqiwmqzjtdiaqd.net/YobkkBgtflu...pJ4cDxgrq5m.jpgO2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod-1.dllO2 - BHO: (no name) - {D851EA4E-FB53-1B72-AD35-D592E4700583} - C:\PROGRA~1\ERRORC~1\Hold this.exeO2 - BHO: TChkBHO Class - {F6E6D2FD-5AFD-4D35-91CD-3F09010EFD52} - C:\WINDOWS\system32\effje.dllO4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exeO4 - HKLM\..\Run: [Audio Noun] C:\PROGRA~1\OPENDO~1\Info Platform First.exeO4 - HKLM\..\Run: [support bird readme move] C:\Documents and Settings\All Users\Application Data\Proxy More Support Bird\heartfast.exeO4 - Startup: PowerReg Scheduler.exeO8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\System32\wweb32.dll/lookup.htmlO16 - DPF: {0191ABF4-9421-435E-9FFD-CD827A2A82D8} (SBITAX7Ctrl Class) - http://ultimateplugin.com/tl7000.dllO16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...f7... Read more

1 more replies
Relevance 73.8%

Happy 4th of July Everyone!

Somehow I got this little bugger... can't figure out how to get rid of it.
You can't remove it from the "Add/Remove Hardware" screen.

I have a HijackThis log if you want to see it.
I ran AdawareSE but for some reason I don't think it's updating correctly.

Any help would be appreciated!
Thanks

 

Answer:My Way Search Assistant Removal

You should be looking at Add/Remove Programs not Hardware.

If you still have problems, follow the steps below. HijackThis is far from the first step. What version of Ad-Aware SE do you have. Make sure you compare to the one in the links below.

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
 

13 more replies
Relevance 73.8%

Hello HijackThis Team and the Moderators!! You guys helped me out a couple years ago, which I appreciated. Now once again, am here asking for your help.Can't get rid of this &$#%$ Search Assistant Have scanned with Ad-Aware and Spybot - Search and Destroy but to no avail - it comes back up each time I do a Hijack This run. Not sure of this but I think it controls results on Google--sometimes I do a search, and the weirdest sites come up as results--just doesn't look right.Anyway, your help is much appreciated, as always!! Logfile of Trend Micro HijackThis v2.0.2Scan saved at 6:44:24 AM, on 26/02/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16574)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exeC:\WINDOWS\system32\gearsec.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlcl... Read more

Answer:Please Help With Search Assistant Removal

Hello jaja67893,

Welcome back to Bleeping Computer

Sorry about the delay. If you still need help, please post a new HijackThis log to make sure nothing has changed, and I'll be happy to look at it for you.

Thanks,
tea

3 more replies
Relevance 73.8%

Follwed instructions and the toolbar diappeared.. Now as I start browsing on firefox I get an alert from my Norton firewall asking to permit this connection. I block it.I permitted this before and the hijacker returned .This is the log from norton firewall log: Help is appreciated. Thanks Details: This one time, the user has chosen to "block" communicationsOutbound TCP connectionRemote address,service is (f15717.bins.lop.com(66.220.17.158),http(80))Process name is "C:\Program Files\Internet Explorer\iexplore.exe" Logfile of HijackThis v1.98.2Scan saved at 1:19:31 AM, on 8/26/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exec:\Program Files\Norton Personal Firewall\NISUM.EXEC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\HP\KBD\KBD.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Common Files\Microsoft Shared\Work... Read more

Answer:Search Assistant removal

Are you already being helped in another thread?

1 more replies
Relevance 72.98%

I am trying to remove Home Search Assistant - CWS_NS3 and have a question about step 2 under the Begin Removal Procedure - specifically the services that are running. I do not have Network Security Service or Workstation NetLogon Service but have Remote Procedure Call (RPC) Locater NOT "HELPER" as described as the three. What should I do? Thanks.

Answer:Home Search Assistant Removal

The first thing I need you to do is download the file from here:ServiceFilter.zip - Get list of XP/2000/NT ServicesExtract the zip file to your C: drive. Once it is extracted there will be a directory on your C: drive called ServiceFilter. Inside the C:\ServiceFilter directory will be a file called ServiceFilter.vbs. Simply double-click on the ServiceFilter.vbs. When the script finishes a wordpad document should open with the unknown services listed in it. If the script could not access wordpad then you will see a message box telling you so. In that case you need to open POST_THIS.TXT by double-clicking it and pasting the contents as a reply to this topic. Please provide a brand new hijackthis log as well in this reply.

1 more replies
Relevance 72.98%

Please help--I have been infected by the Home Search Assistant. I am running Norton antivirus and "Alert Spy"--any help is greatly appreciated. By the way, this is a work computer. Here is my most recent HJT LOGLogfile of HijackThis v1.99.0Scan saved at 2:06:41 PM, on 1/19/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\NavNT\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\NavNT\Rtvscan.exeC:\oracle\Ora_Client\bin\omtsreco.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exeC:\WINDOWS\System32\tp4serv.exeC:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEC:\P... Read more

Answer:Home Search Assistant Removal

Sorry about a new log being posted, but I got booted from the laptop (battery died).Logfile of HijackThis v1.99.0Scan saved at 4:43:53 PM, on 1/19/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\NavNT\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\NavNT\Rtvscan.exeC:\oracle\Ora_Client\bin\omtsreco.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exeC:\WINDOWS\System32\tp4serv.exeC:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXEC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exeC:\Program Files\AClient\Bin\XCDiffCache.exeC:\windo... Read more

38 more replies
Relevance 72.98%

I'm sure you have all seen a lot of this lately. I am comfortable enough to follow someones wonderful instructions, but I am not confident in changing dll files without an expert opionion. I have attached my log file from hijack this. I have read all of the instructions from this site and downloaded all of the tools. I just need to know which files I should alter. Thank you very much.____________________________________Logfile of HijackThis v1.99.0Scan saved at 4:22:20 PM, on 1/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\AGRSMMSG.exeC:\PROGRA~1\QtVprMtx\QTVPRMTX.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Apoint2K\Apoint.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\support.com\bin\tgcmd.exeC:\WINDOWS\system32\netts32.exeC:\WINDOWS\system32\Zrdhon.exeC:\WINDOWS\system32\Qlixmm.exeC:\Program Files\Apoint2K\Apntex.exeC:\Program Files\Common Fil... Read more

Answer:Home Search Assistant Removal

Your logfile is being analyzed now, and a response will be posted shortly.

Thanks
daveai

6 more replies
Relevance 72.98%

It appears I have fallen victim to the Home Search Assistant hijack as so many others have. I downloaded the HSRemove tool and followed the instructions contained therein. After running the program in safe mode, I checked the add/remove programs and Home Search Assistant is no longer listed. When I restart my computer in normal mode, it reappears. IE opens with the message that the hijack has been removed, but once I close IE and reopen it again the hijack is back. The curious thing is that I stopped and disabled Network Security Services when in safe mode. When I restart in normal mode, I find that Network Secuirty Services has been changed back to "automatic". Any ideas??? I have Windows XP home edition. I have set up an administrator account and a personal account too if that makes a difference. Thanks for any help you can offer.
 

Answer:Home Search Assistant Removal

It does in that you need to remove it from both accounts. More importantly, you can not open internet explorer until you have done both. Double the pleasure
 

3 more replies
Relevance 72.16%

Before I pestered you with my HijackThis log - I've seen these things before and they're not pretty - I followed your Home Search Assistant Removal Guide, and I no longer get the annoying symptoms. You guys rock!

Answer:Home Search Assistant Removal Guide Did The Job!

Thank Grinler, the guy who created the tutorial
I'm glad we could help.
David

1 more replies
Relevance 72.16%

Hi everybody,

my problem is that i just don?t seem to be able to get rid of that damn Search Assistant that appears beside the clock-tray on the taskbar.
Everytime I turn on my computer it is back, I?ve run AdAware 6, SpyWareDoctor etc. You just name it. So this is kinda my last call for help.. i?m going nuts over this :evil: Search Assistant.

So here below i?m going to post the log from Hijack This and hope someone can lend me a helping hand

--------- HijackThis ---------
Logfile of HijackThis v1.97.7
Scan saved at 16:02:00, on 14/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\AS***ent.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Java\j2re1.4.... Read more

Answer:Search Assistant Removal problem (HJT included)

Hi,
Go to http://www.greyknight17.com/spyware.htm
Its a KRC Anti-Spware Tutorial..Very helpful.
Do follow everthing suggested.
Great start for security team in digesting your problem.
Upgrade your HJT to latest version.
Repost new HJT LOG.
Marty

1 more replies
Relevance 71.34%

Hey guys.....................I have recently encountered CWS home search assistant in spyware doctor and as you already know Im sure........it wont remove it. Ive ran all the scans with the CW and Home search programs includding CWShredder, virus scans, asquared, adaware, spybot,ect, ect. My problem is...........I followed the guide to removing it and when I get to the part where you look for bogus network processes.......I dont find anything. I saw names of newtork service programs that were similar but not exact, so I ran the "get active services" file to see which were bogus and which werent, and all of them came back without the funny characters following the name that are supposed to differentiate the bogus service from the real service. What should I do now? Do I continue with the removal guide even though I can find bogus network service names? This is what I came up with:These are the Current Active Services: Adobe Active File Monitor V4: AdobeActiveFileMonitor4.0C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe Application Layer Gateway Service: ALGC:\WINDOWS\System32\alg.exe Windows Audio: AudioSrvC:\WINDOWS\System32\svchost.exe -k netsvcs Computer Browser: BrowserC:\WINDOWS\System32\svchost.exe -k netsvcs Cryptographic Services: CryptSvcC:\WINDOWS\system32\svchost.exe -k netsvcs DHCP Client: DhcpC:\WINDOWS\System32\svchost.exe -k... Read more

Answer:Cws Home Search Assistant Removal..........tutorial Problem

Anyone out there?

18 more replies
Relevance 61.91%
Question: removal of myway

cannot function around my way tool bar it misleads and redirects me in wrong direction

Answer:removal of myway

have you removed it in programs & features?Some HELP in posting on Computing.net plus free progs and instructions 7 Medals

2 more replies
Relevance 61.09%

Hi,
I'm running Windows XP, and Spybot will not remove InstaFink and MyWay.MyWebSearch. How do I go about removing them?
 

More replies
Relevance 61.09%

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Professional, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i7 CPU Q 820 @ 1.73GHz, Intel64 Family 6 Model 30 Stepping 5
Processor Count: 8
RAM: 8119 Mb
Graphics Card: NVIDIA Quadro FX 880M, 1024 Mb
Hard Drives: C: Total - 305143 MB, Free - 274828 MB;
Motherboard: Hewlett-Packard, 1521
Antivirus: Microsoft Security Essentials, Updated and Enabled

What is the best tool to remove this?
G
 

More replies
Relevance 60.68%

Not sure - Search Bar - bfc.myway.com/ - should this be, or has my Search Bar been hijacked? If you see anything else, suspicious, please let me know! Thanks!


Log was analyzed using KRC HijackThis Analyzer - Updated on 1/16/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\McAfee.com\MPS\mscifapp.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe... Read more

Answer:Search Bar - bfc.myway ?

Hi calista.......let's get you cleaned up!

=========

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer. After we are finished with your log file and verified that it's clean, you may turn it back on and create a new restore point.

... Read more

3 more replies
Relevance 60.68%

Arg, this ridiculous program has gotten itself in my computer and I have no clue what to do- it won't let me visit a bunch of sites I used to go to all the time.

I tried the whole go to the control panel and uninstall it- its NOT on the list!

I did a hijackthis and I put the attachment up.

I appreciate anything anyone can tell me- about about to just backup all my files and reformat my computer- something I do NOT want to do.
 

Answer:Please help me with myway search!

Hi and Welcome

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
Make sure you check version numbers and get all updates.
Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.



When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

[*]runkeys.txt - the log from GetRunKey.bat
[*]newfiles.txt - the log from ShowNew.bat
CounterSpy - ONLY IF you were not able to run Windows Defender
Bitdefender - from step 6
Panda Scan - from step 6
HijackThis


NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of t... Read more

1 more replies
Relevance 60.68%

help please my daughter's PC can only connect to internet via the wired ethernet connection when it's in safe mode. Only other internet access via wireless card. After checking and/or replacing the obvious, cable/modem/router, I thought maybe malware could be preventing the access since she tinkers in places such as myspace and limewire. I Ran READ ME FIRST clean procedures and myway.mywebsearch still seems to linger. still no internet.... help!? please... although we can connect with the external wireless card, it's driving me insane that we can't use the direct connection. SAS mbam and ComboFix logs attached. MGlogs.zip to follow.
 

Answer:Malware MyWay.MyWebSearch Removal

MGlogs.zip
 

4 more replies
Relevance 60.68%

Hello,

There was/is an extensive thread on removing the MyWay Search Assistant posted in 2005. I carefully followed all steps up to where she was instructed to copy some items into the registry. I've saved all logs but am new to this so will wait to hear from someone before posting them.
What I have is that MyWay is still listed in the Add/Remove programs but it fails and cannot remove it.
Running Super AntiSpyware on a brief scan does not find it but on a complete or full scan it does. Searching the registry using regedit I find it in multiple locations. Not sure how to get a txt file from redit. The other suggested registry search tool in that old thread is now a broken link.
Thank you for any assistance you may offer.
 

Answer:I've followed all the steps in the old 2005 MyWay removal and no joy

Welcome to Major Geeks!

Instructions from 3 years ago may no longer apply and using instructions given to someone else is not always a good idea either. Try the below:

Click Start, Run, and enter the below into the Run box and click OK.

msiexec.exe /quiet /x{78d944d7-a97b-4004-ab0a-b5ad06839940}

If the above does not work, you will need to do the below.


Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide
and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****
Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.
After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
Helpful Notes:
If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto an... Read more

1 more replies
Relevance 59.86%

IT'S Driving me Bleeding MADi believe this git off a thing came with an app my son D/L'ed and installed.i uninstaled it and thought that was the end of it. but the puters still behaving badly,[which is begining to get really annoying now] so i thought id check to see if anything else was instaled. i found the myway folder still in C/ programmes so i tryed to delete it, it wouldnt let me.so i ran my cleaners,Lavasoft-Adaware 6Spybot S&DEScan AVSpysweeperCW ShredderA2 Malware cleanerAVG FreeBut not one has found it, i know its there i can see it, and FEEL its presence.any suggestions please?""D""

Answer:Cannot Remove MYWAY Search bar

click hereclick here

10 more replies
Relevance 59.86%

How do I get rid of MyWay search engine Got this from a   pintrest post should have known better.Edit: Moved topic from Introductions to the more appropriate forum. ~ Animal

Answer:Get rid MyWay search engine

Welcome aboard   Download Security Check from here or here and save it to your Desktop. Double-click SecurityCheck.exe Follow the onscreen instructions inside of the black box. A Notepad document should open automatically called checkup.txt; please post the contents of that document.NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.Make sure the following options are checked:
Internet ServicesWindows FirewallSystem RestoreSecurity Center/Action CenterWindows UpdateWindows DefenderOther ServicesPress "Scan".It will create a log (FSS.txt) in the same directory the tool is run.Please copy and paste the log to your reply. Please download MiniToolBox and run it.Checkmark following boxes:Report IE Proxy SettingsReport FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList last 10 Event Viewer logList Installed ProgramsList Devices (do NOT change any settings here)List Users, Partitions and Memory sizeList Restore PointsClick Go and post the result. Please download Malwarebytes Anti-Malware (MBAM) to your desktop.NOTE. If you already have MBAM 2.0 installed scr... Read more

1 more replies
Relevance 59.45%

Greetings Forum

I have a friend who asked me to take a look at her computer after she tried doing a few things I suggested to her, over the past 2 weeks. I suggested things I learned here from MG's.

She said her computer was terribly slow! Using Quickbooks, has become very tedious & she uses that software on a daily basis. She said that in between transactions, there is a mandatory wait time before she can even input anything next, wait time was about 1-2 minutes, when it used to be 10 seconds or so. She also said that her computer would take about 10 minutes or so, to be ready to use, before the little icon stopped flashing the "Sand Timer/Hourglass" - and have a ready desktop.

I asked her to (she is not very comfortable or knowledgeable with downloading off internet, and not very tech saavy) So with guidance, we proceeded. I asked her to download the normal: Mbam, Sas, Avast, Ccleaner, etc. She told me they were already on her desktop & didn't remember what they were. I then remembered that I did something to her computer about a year or so ago, she just let them be there dormant? Anyway we ran scans & continued. Of course, we updated. I then had her download Ad-aware and Advanced system care. We discussed things as they were found & I provided what I had gleaned. We researched a few files I did not know before deleting. Then I had her go through here applications from Control Panel to see if anything looked famili... Read more

Answer:Myway Search Assitant + Very Slow

The final scan log from MGtools is attached.

Thanks Again.
 

8 more replies
Relevance 58.63%

A month or so ago i noticed my super antispy doesnt stat up on its own anymore, I went to the run menu and typed in mscofig but its not in the list anymore? and my windows messenger that i never use isnt there but start up with on its own?

A day ago my daughter downloaded something and my way search assistant is dragging my dell optiplex down, found the files and deleted them but its still putting cookies on my pc.

Help please! Thanks jeremy

Answer:cant get rid of myway search, and my statrup menu changed on its own

Hello, can you run MBAM..Next run MBAM (MalwareBytes):Please download Malwarebytes Anti-Malware (v1.46) and save it to your desktop.Before you save it rename it to say zztoy.exe alternate download link 1alternate download link 2MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.Make sure you are connected to the Internet.Double-click on mbam-setup.exe to install the application.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-MalwareThen click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan.If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.On the Scanner tab:Make sure the "Perform Quick Scan" option is selected.Then click on the Scan button.If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. The scan will begin and "Scan in progress" will show at the top. ... Read more

1 more replies
Relevance 58.63%

I read the Prep Guide but could not run gmer. When I did I got blue screen saying something about kernel something. I can run it again if you need the exact message.

I have Installed, update, and ran the following:

Avast AV
MAlwarebytes
Ad-aware
Spybot s&d
Spywareblaster
CCleaner
Advanced System Care

They fixed quite a bit of problems, but I'm sure there are still some hidden ones.

Like I said in the title I-play and Myway search are present, and I cant use windows update.
When I go to the windows update site using IE I get Error number: 0x80070002. I tried using Microsofts suggested repairs to no avail.

Thanks in advance.

My DDs log:
.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_11
Run by Maria Tobar at 20:20:35 on 2011-07-28
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.74 [GMT -7:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32 ... Read more

Answer:I-play & Myway Search + No Windows Update

Good evening. ;)The first thing you need to do is to remove one of your anti-virus programs - the rule is one active resident scanner per machine. Either Lavasoft Ad-Watch Live or avast! Antivirus has to go.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Once you've done the above, do the below and post accordingly:Take a trip to this webpage for download links and instructions for running Combofix by sUBs: http://www.bleepingcomputer.com/combofix/how-to-use-combofix * When prompted to save Combofix, change the filename BEFORE saving it - any name will do, as long as it has .exe at the end. Please be aware that this tool may require the PC to be rebooted so close any programs you have open before you start. When CF has finished, it will produce a log - C:\ComboFix.txt - copy and paste Let me know how the PC is behaving.* There are two points to note from the instructions page:1) The Recovery Console.It is recommended that you install this as, in certain circumstances, it may be the difference between a successful repair and a reformat. If you are uncertain as to whether or not you already have the Recovery Console installed, simply run CF and it will prompt you if it does not detect it.CF will complete some, but not all, of it's removal tasks without the installation of the Console, so you are free to choose whether you want to complete this step, but it is in your interests to do so.2) Disabling your Anti-Virus.CF has been the ... Read more

17 more replies
Relevance 58.63%

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:36:49 PM, on 7/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe
C:\Program Files\BellSouth\BellSouth Internet Security\Freedom.exe
C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R1 - HKCU\Software\Microsoft\Internet Explorer\... Read more

More replies
Relevance 58.63%

click here I thought I would share this URL with you people. I was shown it by another person & think it's a great portal especially for those who want more than google, but less clutter than yahoo.For the tech heads - it even gives loading times etc!!! EnjoyTony

More replies
Relevance 58.22%

Search engines don't work from myway.com home page. I select "Change Search engine" and attempt to choose Google click finished, go back to the home page then enter a question and then after hitting enter the next page It goes to a page called "My Way" and just sits there. What do I do to fix it?

Answer:search engines don't work from myway.com home page

Your system is infected with the myway.com redirect virus. A google search will turn up numerous explanations on how to get rid of it.

2 more replies
Relevance 57.81%

Google basically does the well know re direct of a search, bringing up various marketing etc sites.

This is the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:09, on 05/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

--
End of file - 920 bytes

Thankyou for any help, would just like the removal of these Search assistant bugs.

Answer:Google searc redirect, Search Assistant/Customize Search element.

Hello.Your Hijackthis log looks extremly small. Have you been fixing any entries?Hijackthis warningHijackThis is an advanced tool, and therefore requires advanced knowledge about Windows and operating systems in general. If you delete items that it shows, without knowing what they are, it can lead to other problems such as your Internet no longer working or problems with running Windows itself.If you do not have advanced knowledge about computers you should NOT fix entries using HijackThis without consulting an expert on using this program.Thanks for Understanding Backup Registry with ERUNTThis tool will create a complete backup of your registry. A backup is created to ensure we have backup so encase anything goes wrong we can deal with it. Do not delete these backups until we are finished.Please download erunt-setup.exe to your desktop. Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.You can find a complete guide to using the program here:http://www.larshederer.homepage.t-online.de/erunt/erunt.txtHow to Restore from the ERUNT BackupOnly restore from the backups if instructed to, or you need to do s... Read more

3 more replies
Relevance 57.81%

I am having major problems. In my add/remove program the shopping wizard and search assistant are listed. When I try to remove them my computer freezes up and nothing happens. I have to shut down and start up again. Computer is running really slow and many programs won't even open. I have run ad-aware and removed what it found, spy sweeper and removed it's findings and mcafee virus scan. I don't know what else to do! Please help me! Thanks in advance! Oh and everynow and then a pop up comes up and the only title it has is "only the best"
 

Answer:Pleaz help me remove shopping wizard, search assistant, and cool web search!

12 more replies
Relevance 57.81%

I cannot get rid of these programs no matter what I do. Simply trying to remove the programs from Control Panel/ Add/Remove programs , I'm told they can't be found. I followed instructions from another post and used SpyBot, Ad-Aware SE, Hijack This, a Squared trojan remover and About:Buster, but nothing has worked. I figure that maybe the instructions were based on his computer files exactly. So I've posted the logfile from my computer. If anyone can help, I'd greatly appreciate it!

Logfile of HijackThis v1.99.1
Scan saved at 3:24:19 PM, on 3/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ati2evxx.exe
C:\WINDOWS\System32\Atiptaxx.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\mspr32.exe
C:\WINDOWS\System32\wuauclt.e... Read more

Answer:How do I remove Home Search Assistant, Search Extender and Shopping Wizard?

First of all, you have to unzip Hijack This and save it to a folder of its own in programs files so it can create proper back-ups and function properly.

First click: http://forums.techguy.org/attachment.php?attachmentid=44318

to download cwsserviceremove.zip and unzip it to your desktop and have it ready to run later.
___________________________________________________________________________

Click http://www.intermute.com/spysubtract/cwshredder_download.html to download CWShredder. Do Not run it yet. Download it to the desktop and have it ready to run later.

____________________________________________________________________

Click: http://www.downloads.subratam.org/AboutBuster.zip to download AboutBuster created by Rubber Ducky.

Unzip AboutBuster to the Desktop then click the "Update Button" then click "Check for Update" and download the updates and then click "Exit" because I don't want you to run it yet. Just get the updates so it is ready to run later in safe mode.
_____________________________________________________________________

Now go ahead and set your computer to show hidden files like so:

Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go ... Read more

1 more replies
Relevance 57.4%

These three nasty things have been bugging me for the past couple of weeks: Shopping Wizard, Search Extender, and Home Search Assistant. Everytime I try to delete them off my add/remove programs it doesnt work. I have tried a number of anti-spyware programs and non of them seem to be able to delete them or even detect them. I would really appreciate if you could help me out and make my life easier. Here is my log from HijacktThisLogfile of HijackThis v1.99.0Scan saved at 12:46:27 AM, on 1/25/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\WINDOWS\system32\HPConfig.exeC:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec AntiVirus\Rt... Read more

Answer:Shopping Wizard, Search Extender, and Home Search Assistant

Hi Download System Security Suite here:System Security Suite Download & Tutorial. Unzip it to your desktop.Install the program. Don't use it yet.Please print or copy these instructions because you are not able to access the Internet in SafeMode.Make sure you are set to show hidden files and folders: A. On the Tools menu in Windows Explorer, click Folder Options.B. Click the View tab.C. Under Hidden files and folders, click Show hidden files and folders.D. Uncheck Hide extensions for known filetypes and Hide protected operating system files.How to see hidden files in WindowsREBOOT into SafeMode by tapping F8 key repeatedly at bootup: Starting your computer in Safe modeRun HijackThis!, press Scan, and put a check mark next to all these:R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://fastsearchweb.com/srh.php?q=%sR3 - Default URLSearchHook is missingO2 - BHO: (no name) - {322B3263-4125-83BC-EA0A-3B07AB10E29B} - C:\WINDOWS\d3yw.dllO17 - HKLM\System\CCS\Services\Tcpip\..\{B7C1C985-C58A-486E-9395-8549A97277A3}: NameServer = 69.50.166.94,69.31.80.244O17 - HKLM\System\CCS\Services\Tcpip\..\{EF25E273-7575-40CD-835E-3AC69DCC4152}: NameServer = 69.50.166.94,69.31.80.244O17 - HKLM\System\CS1\Services\Tcpip\..\{02F8669E-0851-4979-8B37-47F45CB16AD2}: NameServer = 69.50.166.94,69.31.80.244Close all other windows and browsers, and press the Fix Checked bu... Read more

5 more replies
Relevance 57.4%

Three programs called shopping wizard, home search assistant, and search extender are on the add/remove programs list. when i attempt to uninstall them i get an error message. when i load up IE it starts on auto:blank and i get a lot of popups. ive read some threads about this but they have solutions for windows XP operating system and i have wndows 98, the first few steps about turning off system restore, see hidden files and folders appear to be different. here is my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 20:19:00, on 07/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://wind-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Expl... Read more

Answer:Shopping Wizard, Search Extender, Home Search Assistant

ive got mcaffee on my computer, but it keeps crashing after its scanned
 

1 more replies
Relevance 57.4%

I'm trying to work on my Moms machine and I se these three progs installed and they will not go away. I do know they are some kind of malacious spyware. How in the world do I get rid of these? Everything I have done has failed. Can someone please help me out? This is the current log from Hijackthis:

Logfile of HijackThis v1.99.0
Scan saved at 1:09:15 AM, on 12/25/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\GEARSec.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\mslb.exe
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\Progr... Read more

Answer:Home Search Assistant, Search Extemder & Shopping Wizard

http://forums.techguy.org/t110854.html

Have a look in Control Panel > add/remove or in all programs and uninstall them
Go to the above link and download SpyBot Search and Destroy and AD-Aware SE UPDATE and do a scan with both of them getting rid of all they find

Do a scan with Panda and Housecall

After doing ALL th eabove post another Hijack This log here please
 

3 more replies
Relevance 57.4%

I can't seem to uninstall or even locate Homesearch assistant, searchextender or shopping wizard, even though they are present in my control panel. Please view the following log and make suggestions! I am computer literate, all I need is directions as what to do with this information. Thank you in advance for your assistance. Logfile of HijackThis v1.99.1Scan saved at 22:34:58, on 10-12-2005Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exeC:... Read more

Answer:Help: Home Search Assistant, Search Extender & Shopping Wizard

Download the trial version of Ewido Security Suite http://www.ewido.net/en/download/ (W2K/XP Only)? Install ewido.? During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".? Launch ewido? It will prompt you to update click the OK button and it will go to the main screen? On the left side of the main screen click update? Click on Start and let it update.? DO NOT run a scan yet. You will do that later in safe mode.Restart your computer into safe mode now. Perform the following steps in safe mode:(Start tapping F8 at the first black screen after power up)Run Ewido:? Click on scanner? Click Complete System Scan and the scan will begin.? During the scan it will prompt you to clean files, click OK? When the scan is finished, look at the bottom of the screen and click the Save report button.? Save the report to your C: DriveThis will take some time to run!Boot to normal modePost that log and a new HiJack log - but do this before the HiJackThis log====================DownLoad EasyCleaner http://www.majorgeeks.com/download414.htmlUse the clear files and Unnecessary files buttons - I do not recommend using the Duplicates files button as many dupes are there on purpose.Not all tmp files will delete ? that is normal.In the unnecessary button I check the top 4 entries

11 more replies
Relevance 57.4%

When I scan with spyware doctor, one of the scans is a CWS home search assistant. I used aboutbuster to remove it, to no avail. it still shows up during a scan with spyware doctor. why? Anybody also know how rid of spector pro keylogger,7Adpower, In the Know?

Here is my hijackthis log if it will help

Any help would be appreciated
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\System32\alg.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
... Read more

Answer:CWS Home search assistant still showing up on spyware doctor search

13 more replies
Relevance 56.99%

I have tried just about everything. Downloaded all the spyware programs and ran them this is what I am left with . Any ideas?

Edit by chaslang: Unrequested inline log removed
 

Answer:Can't get rig of Cool web search, Shopping wizard and search assistant

From personal experience.. download coolshredder from offsite link removed...

Run this and it should eliminate most of those issues....


Mortgageguru
 

3 more replies
Relevance 56.99%

i want to get rid of home search assistant, search extender, and shopping wizzard (cause AIM to crash), but can't remove them with "change/remove programs". i have followed your "do this first" file, and now have my HackThis log. please help!
 

Answer:Search Assistant, Search Extender, Shopping Wizzard

You have Home Search Assistant (search extender and shopping Wizzard are connected to it). I have had hte virus myself and i suggest you try this basic removal guide http://forums.majorgeeks.com/showthread.php?t=38772 , if that doesnt work you can come back and ask for more help
 

8 more replies
Relevance 56.58%

My computer is infected with god knows what & I am unable to install SP2 without it locking up. End up having to use a restore point to regain control.Dell Dimension 4400 with windows XP Home EditionUpdated to SP1a but cannot update to SP2 I guess because of the infections.Here are the results of the tests:Deckard's System Scanner v20071014.68Run by Pamela on 2008-04-12 19:18:34Computer is in Normal Mode.---------------------------------------------------------------------------------- System Restore --------------------------------------------------------------Successfully created a Deckard's System Scanner Restore Point.-- Last 5 Restore Point(s) --56: 2008-04-13 00:19:21 UTC - RP486 - Deckard's System Scanner Restore Point55: 2008-04-12 21:12:51 UTC - RP485 - Norton Security Online post configuration restore point54: 2008-04-12 18:19:58 UTC - RP484 - Installed Windows XP KB892130.53: 2008-04-12 18:19:32 UTC - RP483 - Software Distribution Service 3.052: 2008-04-12 18:16:09 UTC - RP482 - 04/12/08-02-- First Restore Point -- 1: 2008-01-10 00:26:12 UTC - RP431 - System CheckpointBacked up registry hives.Performed disk cleanup.-- HijackThis (run as Pamela.exe) ----------------------------------------------logfile has no content; running clone.-- HijackThis Clone ------------------------------------------------------------Emulating logfile of Trend Micro HijackThis v2.0.2Scan saved at 2008-04-12 20:13:10Platform: Windows XP Service Pack 1 (5.01.2600)MSIE: Internet Explorer ... Read more

Answer:Infected With Myway.mysearch & Myway.mywebsearch

Hello Ive_Got_Problems, You need to stop opening duplicate threads. It just prevents you from getting help. We try to help the oldest threads first, and by opening a new thread you are pushed back in the line. Download SDFix and save it to your Desktop. Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, the Advanced Options Menu should appear; Select the first option, to run Windows in Safe Mode, then press Enter. Choose your usual account. Open the extracted SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt. Finally copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log-- If this error message is displayed when running SDFix: "The command prompt has been ... Read more

8 more replies
Relevance 55.76%

My computer is really slow the last few days, and programs keep not responding. Have tried Adaware, virus scans, and Spybot. Search Assistant - My search shows up in Add/Remove programs, but it won't let me remove it.
Here's my hijack this log:

Logfile of HijackThis v1.97.7
Scan saved at 11:46:34 AM, on 12/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\VetMsgNT.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\sy... Read more

Answer:Trying to remove Search Assistant - My search HIJACK THIS LOG

A new version of Hijack This has been released so get rid of the old one and
download from this site [http://www.spywareinfo.com/~merijn/
.
 

2 more replies
Relevance 55.76%

been trying to clean this mess for daysanyhelp would be greatly appreciatedthanks!Logfile of HijackThis v1.99.1Scan saved at 12:14:50 PM, on 7/13/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\BurnQuick\BQTray.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\palmOne\HOTSYNC.EXEC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\ntno.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Danny\Desktop\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zkumc.dll/sp.html#14414R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkumc.dll/sp.html#14414R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\S... Read more

Answer:HJT log-problems with search extender, search assistant..

ab//Mod edit: Every time you attempt to bump your log, you onlyput yourself farther back in the time sequence. Logs are analyzed on a first in,first worked basis. All HJT Techs are volunteers. Please be patient.

2 more replies
Relevance 53.71%

Hi,I am having this problem - Helpassitant folder created in my document and settings folder, every time i reboot my computer.I have many problems because of this.. like slow booting up... freezing computer..Any help is really appreciatedThanks for you time and efforts in advance.Disha

Answer:Help Assistant Removal

Hello my name is Sempai and welcome to Bleeping Computer. *We apologize for the delay. Forum has been busy.* Please stay with me until I declare that your computer is clean as most users don't reply anymore once they found out that their computer is running smoothly, but absence of symptoms does not mean that a computer is free from infection.*It is important not to make any further changes or run any other tools unless instructed to. This may hinder the cleaning process of your machine.*Please be patient, all Bleeping Computer helpers are volunteers and have lives outside this forum.*You must reply within 5 days otherwise this topic will be closed.+++++++++++++++++++1. Download GMER Rootkit Scanner from here. Extract the contents of the zipped file to the desktop. Double click GMER.exe and if you are asked if you want to allow gmer.sys driver to load, please allow it to do so. If it gives you a warning about rootkit activity and asks if you want to run scan, please click on NO. In the right panel you will see several boxes that have been checked. Uncheck the following the following checkboxes: Sections IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) Now click on the Scan button and wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in ark.txt and save it to your desktop.Post the contents of that report when you reply.2. Download OTL to your Desktop.Double click on the icon... Read more

12 more replies
Relevance 53.71%

ive run adaware spybot the new yahoo anti virus and my laptop is pretty clean (i think). but on my add/remove program list Seaarchassistant-my search is stll there when i click remove i get an error box, in the title bar it sais RUNDLL and the error message reads
Error loading program Crogra~1\MyWay\SrchAsst\1.bin\mysrchas.dll
the specified module could not be found
here is my hjt log thanks for any help

Logfile of HijackThis v1.98.2
Scan saved at 3:47:40 PM, on 3/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\xpoint\xpadmin\xpadmin.exe
C:\PROGRA~1\xpoint\agent\Xpagent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\xpoint\pe\PCRECSA.EXE
C:\PROGRA~1\xpoint\EEClient\xpclient.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\WINDOWS\Syst... Read more

Answer:search assistant my search add/remove

7 more replies
Relevance 53.71%

In my Add/Remove programs list, I have this program "Search Assitant - My Search" which must be add, or spyware, because it won't remove. I've tried both Ad Aware, and Spybot, with the plug in, and folled all instructions. It' still there, and when I try to remove it, I get a blank pop-up page with a vague path string at the top.

I've tried safe mode, I've scanned, I've taken off and put back on MSN 9, so I'm here because I've reached a point where I don't know what to do.

In addition, whether it's related or not, I CAN get onto the internet (dialup), but my MSN9 won't let my email files download and I get an Error Reporting.

Chances are, I've got a variant of a Hijacker, and I'm hoping it's connected to that "Search Assistant" program so that when I finally get rid of it, life will be back to normal.

Please instruct me as what action to take and I will do it. If there is a former string about this specific problem I can refer to, I'd be o.k. with that as long as it works. This is my fourth day of sitting in front of this computer, and my wife's about to leave me...
THANKS!!!
Hawk
 

Answer:Search Assistant - My Search (can't remove. HELP!)

Read this first so you know what you should be doing before posting a HijaakThis log:

http://www.majorgeeks.com/vb/showthread.php?t=35407

The following the instructions in the above line download and run HijaakThis and post a log.
Here's the HijaakThis link: http://www.majorgeeks.com/download3155.html
 

33 more replies
Relevance 53.71%

I have this listing on my Add/Remove Programs list and cannot get rid of it. I believe that it is causing many pop-ups to get around my pop up blocker and overall slowing down my computer. I was wondering if anyone had encountered this problem previously or knew how to remove this programs/virus/spyware, whatever it is. Here is my Hijack This log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\vmss\vmss.exe
C:\windows\system32\newljs.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\iljtwh32.exe
C:\documents and settings\administrator\local settings\temp\aMyp.exe
C:\windows\system32\QDpDKcDg.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\iexat32.exe
C:\Documents and Settings\A... Read more

Answer:Solved: Search Assistant - My Search

16 more replies
Relevance 53.3%

i original posted in security - as i dont have the machine
but will probably connect tomorrow

however, as i only really want advice from the experts here - i moved to the virus forum

I have just been helping a friend remotely on a laptop - windows 10 remove amazon assistant
which keeps popping up on the screen

usually adwarecleaner followed by malwarebytes gets rid of these

Adwarecleaner - listed it as an optional PUP and i made sure it was checked - also checked other amazon items WOW - etc
and removed and rebooted

Still came up

ran adwarecleaner again
this time it had removed other items - except amazon button1 (which is amazon assistant)
so removed it again and rebooted

still came up

ran malwarebytes

listed as a threat - quarantined
rebooted

still there

how do we get of this think
ALL google searches appear to indicate that Malwarebytes & Adwarecleaner - should remove
 

More replies
Relevance 53.3%

After having numerous problems with my machine locking up I discover the Help Assistant directory with a copy of my hard drive in it. After some initial research I tried to remove it by disabling the user and deleting the directory only to have it return. I found another topic regarding this but after reading decided to contact you first before doing anything more.DDS log file is below and Attach.txt is attached. When I tried to run GMER, after making the requested adjustments and then clicking scan, it began scanning and then displayed the blue problem detected screen and windows has been shut down. Pertinant information in blue screen was:======================================DRIVER_IRQL_NOT_LESS_OR_EQUAL======================================then the standard if first time restart message followed by:======================================Technical Information:*** STOP: 0x000000D1 (0x0000000C, 0x00000002, 0x000000000, oxEE0C2E52)Mpfp.sys - Adress EE0C2E52 base a EE0B9000, Date STamp 49de3cac======================================DDS logDDS (Ver_10-03-17.01) - NTFSx86 Run by Mommy at 13:15:06.03 on Sat 06/12/2010Internet Explorer: 8.0.6001.18702Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.158 [GMT -4:00]AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}============== Running Processes ===============C:\WINDOWS\syste... Read more

Answer:Help Assistant Virus removal

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please also continue to work with me until I give you the all clear. Even if your computer appears to act better, you may still be infected.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.Once we start working together, please reply back within 3 days or this thread may be closed so we can help others who are waiting.We need to create an OTL report,Please download OT... Read more

16 more replies
Relevance 53.3%

Hi,

I have looked through a few forums on removing the Amazon Assistant virus but I still have not removed it from my machine. I'm continuously getting the blank, white pop-up. When I went to remove the program, the "uninstall" option is greyed out and I am unable to get into the actual file to delete it because it keeps saying that the file is open. I haven't been able to close the pop-up for long enough to remove the file. As I type this, the pop-up is coming up every 10-15 seconds. I just need this gone, it's getting to be too much and my machine is slowing down exponentially.

Here are the specifications of my machine.

Tech Support Guy System Info Utility version 1.0.0.4
OS Version: Microsoft Windows 10 Home, 64 bit
Processor: Intel(R) Core(TM) i5-6200U CPU @ 2.30GHz, Intel64 Family 6 Model 78 Stepping 3
Processor Count: 4
RAM: 3969 Mb
Graphics Card: Intel(R) HD Graphics 520, 1024 Mb
Hard Drives: C: 930 GB (812 GB Free);
Motherboard: Acer, Ironman_SK
Antivirus: Avast Antivirus, Enabled and Updated

I also went ahead and ran a scan on my computer with the FRST (x64) program I saw in many other replies. I will include both scans below.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-12-2017
Ran by Ethan Hughes (administrator) on HUGHES (06-12-2017 13:24:46)
Running from C:\Users\Ethan Hughes\Downloads
Loaded Profiles: Ethan Hughes (Available Profiles: Ethan Hughes)
Platform: Windows 10 Home Version 1709 16299.64 (X64) Languag... Read more

Answer:Amazon Assistant Removal

Here is the additional scan:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-12-2017
Ran by Ethan Hughes (06-12-2017 13:26:14)
Running from C:\Users\Ethan Hughes\Downloads
Windows 10 Home Version 1709 16299.64 (X64) (2017-11-10 02:58:41)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================

Administrator (S-1-5-21-2008701448-1604200778-1345039759-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2008701448-1604200778-1345039759-503 - Limited - Disabled)
Ethan Hughes (S-1-5-21-2008701448-1604200778-1345039759-1001 - Administrator - Enabled) => C:\Users\Ethan Hughes
Guest (S-1-5-21-2008701448-1604200778-1345039759-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-2008701448-1604200778-1345039759-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs s... Read more

1 more replies
Relevance 53.3%

I inadvertenly downloaded the wrong site. I meant to get on the FedEx tracking site but ended up with "PackageTracking by myway". This myway Malware has taken over and the problems worsen. Rather than having Google Chrome as my web browser it is now "myway". Also I am on the home page and click Chrome and MicroSost Word pops up instead ? I have tried everything I know to kill it Search/Programs and Features/ etc but there is no trace of it anywhere that I can find ?
I don't have the $ to go thru MicroSoft so I'm hoping this site will prove useful.

Thanks,
Kevin in Boston

Not sure if my email was posted with my question so here it is:

<[email protected]>
 

More replies
Relevance 52.89%
Question: Search Assistant

How can I uninstall 180 search assistant?

Answer:Search Assistant

Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Create a folder at C:\HJT and move HijackThis.exe there. Double click on the program to run it.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless.

1 more replies
Relevance 52.89%

180 Search Assistant has infected my computer. I downloaded Hijack this and ran a test. Here are the results. Can someone tell me what this means and what to do? I would greatly appreciate it! Thanx

Logfile of HijackThis v1.98.2
Scan saved at 12:25:03 PM, on 11/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\WINDOWS\System32\zcqtae.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\AT&T Plug&Share 54Mbps Wireless PCI Adapter\WLANMON.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\mozilla... Read more

Answer:180 search assistant (HELP ME!!)

7 more replies
Relevance 52.89%
Relevance 52.89%

I keep getting pop-ups, even though they're meant to be blocked, and I even get them when I'm online and don't click on anything. The most likely suspect appears to be 180 Search Assistant, but I can't get rid of the various programs it seems to have installed. Spybot and Ad-Aware don't detect it, and Add/Remove Programs can't remove it, so how can I get rid of this ?

Thanks
 

Answer:How can I get rid of 180 Search Assistant

9 more replies
Relevance 52.89%

motto of the RCMP - WE ALWAYS GET OUR MAN (parasite)
XP Pro
MozillaFirefox

Important Note: Ran SygateOnlineSecurity Scan and it said: "NetBios (port 139) WIDE OPEN - sharing your whole hard disk with the world; DANGEROUS PORT TO HAVE OPEN"
so I think I need some advice on this subject!

SPYBOT LOG (since this file is too long I've had to cut out some bits of this; hope I didn't cut out anything important

--- Search result list ---
DoubleClick: Tracking cookie (Mozilla: kunjabihari) (Cookie, nothing done)
Avenue A, Inc.: Tracking cookie (Firebird: default) (Cookie, nothing done)
CoolWWWSearch: Tracking cookie (Firebird: default) (Cookie, nothing done)
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)

^ THESE WERE EVENTUALLY FIXED ^

--- Search result list ---
DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-21-1960408961-920026266-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Setting... Read more

Answer:Search Assistant 180

Run HJT again and put a check in the following:

F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O4 - HKLM\..\Run: [hlmfdfgtni] C:\WINDOWS\System32\hqixlj.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
Close all applications and browser windows before you click "fix checked".

Restart in safe mode
Open Windows Explorer. Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files".
Now click "Apply to all folders", Click "Apply" then "OK"

Delete these:

C:\Windows\System32\wsaupdater.exe --> file
C:\WINDOWS\System32\hqixlj.exe --> file
C:\Program Files\WindowsSA --> folder

Reboot and post another log.
 

3 more replies
Relevance 52.89%
Question: Search Assistant

When searching from a site like Yahoo or Google, a Search Assistant pane keeps appearing on the right hand side of the IE 6.0 window. It does not appear to be the IE search assistant as it has a different look. It has a "results" tabl and a "search" tab at the top of the pane. Bringing up "Properties" by right clicking on the pane indicates that the URL is About:Blank. All the other inforamation in the the Properties/General window is given as "not available".

This pane is rather annoying and I wish to turn it off. Any method for doing this?
Win XP Home
MS IE 6.0
 

Answer:Search Assistant

8 more replies
Relevance 52.89%

ogfile of HijackThis v1.98.2
Scan saved at 6:47:42 PM, on 9/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\systems.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\Hotbar\bin\448~1.0\SBInst.exe
C:\Program Files\Hotbar\bin\4.4.8.0\WeatherOnTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hotbar\bin\4.4.8.0\HbInst.exe
C:\WINDOWS\System32\drvsys.exe
C:\Documents and Settings\ALAN NORTON\Application Data\ttuh.exe
C:\WINDOWS\System32\donyju.exe
C:\WINDOWS\System32\msr2cenu.e... Read more

Answer:Need help with search assistant

Lets begin by rescanning once again with hijack then insert a check next to each of the following items. Close all browser windows and click "fix checked"

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm

F2 - REG:system.ini: Shell=explorer.exe winlogin.exe

O2 - BHO: (no name) - {3BAA620E-9463-1BE0-DB57-60550DAD2A40} - C:\WINDOWS\System32\cguez.dll

O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.4.8.0\HbHostIE.dll

O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.4.8.0\HbHostIE.dll

O4 - HKLM\..\Run: [system] dcomx.exe

O4 - HKLM\..\Run: [NDplDeamon] winlogin.exe

O4 - HKLM\..\Run: [winlogon] winlogin.exe

O4 - HKLM\..\Run: [System Service] systems.exe

O4 - HKLM\..\Run: [Spam Blocker for Outlook Express] C:\PROGRA~1\Hotbar\bin\448~1.0\SBInst.exe

O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.4.8.0\WeatherOnTray.exe

O4 - HKLM\..\Run: [win_upd2.exe] C:\WINDOWS\System32\WINdirect.exe

O4 - HKLM\..\Run: [wpds.exe] C:\WINDOWS\System32\doriot.exe

O4 - HKLM\..\Run: [Hotbar] C:\Program Files\Hotbar\bin\4.4.8.0\HbInst.exe /Upgrade

O4 - HKLM\..\RunServices: [system] dcomx.exe

O4 - HKLM\..\RunServices: [System Service] systems.exe

O4 - HKLM\..\RunOnce: [System Service] systems.exe

O4 - HKCU\..\Run: [drvsys.exe] C:\WINDOWS\System32\drvsys.exe

O4 - HKCU\..\Run: [key] C:\WINDOWS\S... Read more

1 more replies
Relevance 52.89%

I've read a few things about this and I know some people feel it shouldn't be a concern but I'm curious if there's anything else going on that I haven't noticed, or if there's anything else I can get rid of to speed up my old laptop.

My Way Search Assistant is showing in Add/Remove Programs but does not have any options to uninstall. I know it supposedly is preinstalled on Dell systems like mine. I haven't noticed it *doing* anything, but anyhow...

I use firefox as my main browser (but use all 3 occasionally), but have had a lot of pop ups at various times, asking if I want to stop the script. Before that happens, the browser(s) are very slow to respond. The messages vary, but often start with chrome://
My guess is that it's just due to a low end laptop, but it's what I've got.

I do have a windows install disc or boot CD around somewhere that was sent to me by dell. I'm also aware I have no antivirus installed as I just uninstalled AVG and want to try something new.

Thanks!

DDS (Ver_10-03-17.01) - NTFSx86
Run by Admin at 15:45:02.46 on Wed 09/29/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.706 [GMT -4:00]
============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe... Read more

Answer:My Way Search Assistant

BUMP, please

If it helps, I can give exact examples of the errors popping up often on firefox:

A script on this page (page was just a restore session from *just* restarting the laptop) may be busy, or it may have stopped responding. You can stop the script or you can continue to see if the script will complete.

Script: chrome://browser/content/aboutSessionRestore.js:124

---
And two others that came right after that one:

Script: file:///c:/Program%20Files/Mozilla%20Firefox/components/nsSessionStore.js:126

Script: chrome://global/content/bindings/browser.xml:0

But yeah.... Bump Please?

1 more replies
Relevance 52.89%

Hey guys, first post... Read through some of the forums and am trying to remove the "My Way Search Assistant" from the Add/Remove section of the control panel. Used the Ccleaner and when I attempted to remove this entry, I was prompted "Unable to remove MSI Installer" I did all the "Read and Run" steps. It's late, if you think I need to post everything for you to view, I'll be back online tomorrow and get your input. Thanks...
 

Answer:My Way Search Assistant

492slayer said:



if you think I need to post everything for you to viewClick to expand...

Yes please.

We need to see the logs so we can see if somethings stopping it from being removed, whether you have other issues, and so we can help provide a fix.
 

16 more replies
Relevance 52.89%

Hey, somehow I got ahold of that 180 search assistant. I have already downloaded the hijack this program and did the scan. I would appreciate some help in deciphering the logfile. Here's my logfile as follows:

Logfile of HijackThis v1.98.2
Scan saved at 5:12:27 PM, on 12/6/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\eMachines Bay Reader\shwiconem.exe
C:\Program Files\eDonkey2000\eDonkey2000.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\aim\aim.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Expl... Read more

More replies
Relevance 52.89%

Please, please help me. I can't seem to get rid of 180 Search Assistant and my Google toolbar has completely vanished! Also, my internet homepage has been altered to www.blazefind.com and everytime I change it to my default setting (www.btopenworld.com) then log on again, the blazefind address reappears.

I have attached my logfile below having done a HijackThis scan and wonder whether you can advise me on what I should/shouldn't delete.

I hope you can assist 'cause this is driving me mad!!!

Thanks so much.
Karen

Logfile of HijackThis v1.97.7
Scan saved at 21:00:30, on 11/07/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\WINDUPDATES\WINUPDT.EXE
C:\PROGRAM FILES\WIND... Read more

Answer:180 search assistant

Hiya and welcome

I've slipt your reply off to a new thread, as its easier to work on that way. Also, this will bump up for the Security experts to see easier

Regards

eddie
 

2 more replies
Relevance 52.89%

Please review my Hijackthis log and let me know how do i remove this DNS search assistant .I dont know how come this got installed and most of the time i dont get the desired webpage but this one.There were few viruses also which i searched in google and deleted them but this dnssearch assitant is not going no matter how many times i am fixing them.Please help me as i am not that knowledgeable in these thing.

Logfile of HijackThis v1.99.0
Scan saved at 11:20:09 AM, on 12/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\eXpress\NS Client\AeXNSAgent.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\lotus\notes\ntmulti.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\System32\erfock.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Yahoo!\Messenger\YPag... Read more

More replies
Relevance 52.89%

not long ago we lost all power during an ice storm and had to do a destructive recovery when we finally got power back on, I uninstalled the games that were restored such as the WildTangent junk that was pre-installed, I have not added hardware and I keep having a problem with IE when I try to go to different webpages, the address bar says the webpage that I put in but it takes me to a Search Assistant Page that I would like to get rid of.... I didn't have it prior to the recovery but my teenager likes these game pages and clicked on something that sent him to a page that messed this up...
I have even purchased the CounterSpy, Spysubtract and Spybot and none of these are finding anything, I have a firewall running and Have had KasperskyDefender Pro way before this happened, but I can't even access ebay.com or amazon, this is getting frustrating.
I found you thru the April 2005 PCWorld mag, thanks for any help you can offer....
 

Answer:Please help me get rid of Search Assistant...

12 more replies
Relevance 52.89%
Question: Search Assistant

if i go to common pages such as ebay, yahoo, google, etc...i get this search assistant page. its driving me crazy. any suggestions?
 

Answer:Search Assistant

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:



Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post).

 

5 more replies
Relevance 52.89%

Can anyone tell me what 180 Search Assistant is and do I need it? I received a message after running Spybot and installing Zone Alarm telling me that someone had remove it, or some of its componants, and offerig to re-install it. I ticked a box saying remind me later.I hope someone will advise me what to do.Regards Rita

Answer:180 Search Assistant

I think this is part of nCase click here

2 more replies
Relevance 52.89%
Question: search assistant

I was checking my register the other day and under search assistant I ran across an item that keeps showing up in our temporary internet files. It's only been in the past week and I can't trace it back to any particular site, it's as if it pops up out of nowhere. I removed the registry keys but still end up with the items under temp files which I am able to delete but would really like to know where they come from, what they are, is it spyware? The item I keep getting is: ak.imgag.com/
I've never seen this page, it doesn't look like our homepage has been hijacked; everything is working like normal. I don't understand why the ms search assistant had these keys however since we don't use ie, we have mozilla on our system. I've tried surfing the net to find out what this thing is but keep running into tons of different answers, the most common one says it may be an active x plug in but I can't find any other info. The original keys were under the autocomplete most recently used (ACMru) section of HKcu. Any help would be appreciated. I've been working on this since I discovered it last week and am no closer to finding an answer. Does anyone know what ak.imgag.com/.... is?

Answer:search assistant

From what I could gather these are images (e.g. ads, animation, etc.) and yes they are Active-X plugins. I usually get them if I send an e-card. If you're really worried that your browser has been hijacked follow these steps.

First, download, install, update, then run ALL of the free spyware removal tools from the links below if you don't have them already. Delete all spyware found.:

http://www.lavasoftusa.com/support/download/
http://www.safer-networking.org/
http://www.intermute.com/spysubtract..._download.html

Then go to www.housecall.trendmicro.com for an online scan..
Then download HiJackThis at www.majorgeeks.com also download this http://www.greyknight17.com/spy/KRC%...20Analyzer.zip
Post your HJT Log here at TSF in the Security Forum so that an expert analyst can read your log.
I really don't think there's anything to worry about but to be on the safe side I recommend doing the above.

2 more replies
Relevance 52.89%

ok, gang...this one is a stumper, at least to me. pop-up blockers do NOT stop it (maybe because my service pak 2 is made by microsoft?)..it has ALL the answers for me..no matter what it is i'm looking for. it's a full size window, and the banner at the top reads "brought to you by the 180 search assistant-microsoft internet explorer". i have a hard time believing that microsoft would actually annoy it's customers so badly..i mean, there ARE other browsers out there..and some are becoming quite popular, i've noticed.

i've run spybot s&d, and adaware..emptied the temp files and deleted the cookies..it's still there. help? thanx, guys.

h&k to all,

damgud

Answer:180 search assistant

Download the latest version of HijackThis (HJT), from here.Put HijackThis in a Permanent folder:Click My Computer / C: / File / New / Folder / name the folder; HijackThisPut HijackThis.exe, in this folder.This is a mandatory step, for the backup and restore functions, of HijackThis, to be able to work.Read the pinned post in the HJT forum, hereFollow the directions, EXACTLY! This is important!Then, run a log, and post it in the HJT forum here. Do not, fix anything, yet.A member, of the HJT Team, will help you out.Please, be patient, these people are volunteers. They will help you out, as soon as possible.

2 more replies
Relevance 52.89%

I have a warning about this offfering the options to re-install or leave uninatalled, which do I do?

Answer:180 search assistant, what is this

Don't touch it with a barge pole... it is adware click here

6 more replies
Relevance 52.89%

Good Morning:
In our internet explorer, when you press the search button, we are getting an 'error on page'. If you go into the different toolbars, they work, but not the default search assistant...Last time this happened, we had disabled the internet search assistant tool. I fear we may have done this again, but for the life of me I cannot find where to fix this. I have looked in IE manage add-ons and is it not there. I have also looked in services.msc, but its not there either (I didn't think it would be there anyway, since it is an internet search, and not the computer)...Can anybody help me? thanks
 

More replies
Relevance 52.89%

I cant uninstall this and i also dont know where it come from. When try to get rid of it my pc freezes up and i have to turn it off at the mains, can you help?

Answer:180 search assistant

Looks as though its Adaware and a bit of a pig to get rid of click here and click hereHave you tried running Adaware and Spybot???

10 more replies
Relevance 52.89%

At start-up I keep getting a message board saying, " A third party has deleted this program without your permission", blah-blah-blah. It wants me to click to reinstall to make my programs run better and quicker. I have been closing the message board and carrying on, ignoring it. Can anyone enlighten me as to what this is? Is it genuine? Should I re-install it? If not, how do I get rid of the annoying message board popping up everytime?Thanks for any info. Casey

Answer:180 Search Assistant

Try Ad-aware click here and Spybot click hereUpdate each of them then scan. Let them delete everything they find.

4 more replies
Relevance 52.89%

Have been reading the other posts concerning the 180 Search Assistant I came across in Add/Remove Programs today. I'm using W2K and after reading the other posts I followed your instructions and installed Hijack This, ran it, and have attached the resulting log. Would appreciate your thoughts on what I can deleted, if anything.
 

Answer:180 Search Assistant

Hi meinbres, Welcome to TSG!!

I'm posting your log here for easier reading... I'll post a suggestion shortly.

Logfile of HijackThis v1.98.2
Scan saved at 3:57:02 PM, on 11/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\netdde.exe
C:\WINNT\MS\SMS\CORE\BIN\CLISVCL.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Executive Software\DiskeeperServer\DKService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\ups.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\winnt\180ax.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\... Read more

2 more replies
Relevance 52.89%

I can't seem to navigate on the web anymore. Or better yet I can't even sign on anymore. I've had to go back and use my old computer in order to get on line now. Due to this spyware, my old computer is much faster than the new one and that should not be. I have tried ad-ware to clean things off but this is not working on this problem. I have ran hijack this and below is the log I get: Can someone tell me what to do to bring my computer back.
Logfile of HijackThis v1.97.7
Scan saved at 8:20:01 PM, on 7/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SOSHOME\Binn\sqlservr.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\desk98.exe
C:\WINDOWS\System32\3capplnk.exe
C:\WINDOWS\SYSTEM32\3cmlink.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Hasbro Interactive\Atari Arcade Hits 1\Atari icon.exe
C:\WINDOWS\av.exe
C:\windows\temp\Y3zPDEjFX.exe
C:\WINDOWS\TimeSynchronize.exe
C:\WINDOWS\System32\axsnmnf.exe
C:\Program Files\Common files\updater\wupdater.exe
C:\WINDOWS\wkcqa.exe
C:\Program Files\Common files\WinTools\WTo... Read more

Answer:How do I get rid of search assistant 180?

Run HJT again and put a check in the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\ClearSearch\CSIE.DLL (file missing)
... Read more

3 more replies
Relevance 52.89%

hello everyone,

I am stock with the 180 search assistant and I can not uninstall it. I need help uninstall it !

Thanks in advance

Answer:help to get rid of 180 search assistant

Hi there Kardon,Next time, instead of including your log, can you please post it like I did below? It saves us some time.I will be looking at your log Logfile of HijackThis v1.98.2Scan saved at 14:32:46, on 2004-11-20Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeC:\WINDOWS\System32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\Program Files\Analog Devices\SoundMAX\Smtray.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\Intel\NCS\PROSet\PRONoMgr.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exeC:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exeC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\Sy... Read more

6 more replies
Relevance 52.89%
Question: search assistant

i get redirected to a website titled search assistant whenever i go to some common websites such as ebay and amazon. spybot also picks up some remnants of n-case and dyfuca internet optimizer in the registry key but can't seem to remove it, something about them being in use.

help on these problems would be greatly appreciated. thanks in advance.

Logfile of HijackThis v1.99.1
Scan saved at 9:41:57 PM, on 3/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\... Read more

Answer:search assistant

Hi and welcome to Bleeping. For the VITAL backup feature of HijackThis to function correctly, you MUST place the program in it's own dedicated folder. Go to My DocumentsClick File > New > FolderName it HijackThis and unzip/move HJT to this folder.Run HJT again and checkmark the boxes next to the following:-R3 - Default URLSearchHook is missingO1 - Hosts: 69.50.173.4 lycos.comO1 - Hosts: 69.50.173.4 amazon.comO1 - Hosts: 69.50.173.4 www.amazon.comO1 - Hosts: 69.50.173.4 aol.comO1 - Hosts: 69.50.173.4 www.aol.comO1 - Hosts: 69.50.173.4 earthlink.netO1 - Hosts: 69.50.173.4 www.earthlink.netO1 - Hosts: 69.50.173.4 ebay.comO1 - Hosts: 69.50.173.4 www.ebay.comO1 - Hosts: 69.50.173.4 go.comO1 - Hosts: 69.50.173.4 www.go.comO1 - Hosts: 69.50.173.4 icq.comO1 - Hosts: 69.50.173.4 www.icq.comO1 - Hosts: 69.50.173.4 lycos.comO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [vodipad] C:\WINDOWS\vodipad.exe4 - HKLM\..\Run: [Gufyxp] C:\Program Files\Dogehja\Qroj.exeO4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exeO4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exeNow close ALL windows & browsers and click FIX CHECKEDReboot into Safe Mode.Tap F8 repeatedly when your machine starts to boot up.Select 'Safe Mode' from the options that appear.Set Windows to 'Show all files & folders'.Click Start > My Co... Read more

5 more replies
Relevance 52.89%

this program keeps showing up on my computer and i've uninstalled it 3 or 4 times from the add/remove programs part of the control panel. any one know how to get rid of it for good.
 

Answer:180 search assistant

Are you using adaware se or spybot? If now, then try running one of these and it should detect and delete everything.
 

1 more replies
Relevance 52.89%

Hi,

I know next to nothing about computers so some really simple advice would be really appreciated - I am so stuck on this one!

Everytime I load up an internet page, popups appear that are from the "search180 assistant". Does anyone know how I can stop this from happening?

My computer is fairly old but has Windows XP.

Thanks

Kerry
 

Answer:Search 180 Assistant - please help!

8 more replies
Relevance 52.89%

hi i have this 180 search assistant in my add remove programs i'm using xp i remove it it keeps comming back i download hijacker thing and this is my results
Logfile of HijackThis v1.98.2
Scan saved at 4:40:08 AM, on 11/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\smagent.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE
C:\WINDOWS\System32\winnt.exe
C:\Program Files\Windows Media Compo... Read more

Answer:180 search assistant

this might help
http://www.sawtoothdistortion.com/Articles/Uninstall180Search.html
 

2 more replies
Relevance 52.89%

OK, so I've done all that was stated in the "Read and Run First" sticky, but for some reason I can't seem to get rid of this My Way thing. When I go to Add/Remove programs, it doesn't even give me an option to delete it. Can someone help me remove this or is it even necessary? Does it hurt to have it on my computer, because I don't even know what it is or how it got here. I'm attaching the files that are requested with exception to the AVG Antispyware log. It told me there wasn't a report available when running AVG.
Thanks in advance to any help that can be given.
Spike
 

Answer:My Way Search Assistant

I know I'm not supposed to bump this, but it's been three days since I first posted and was just thinking maybe it was overlooked. If not, I apologize for the bump. I was just hoping maybe someone could take a look and give me some type of idea what's going on with the My Way Search thing.

Thanks,
Spike
 

4 more replies
Relevance 52.89%

I removed 180 Search Assistant (Internet Optimizer) from the computer that I'm working on and, when I reboot, I get a small window saying "Warning ... 180 Search Assistant removed." It then gives me choices of a)reinstalling it, b)Leaving it uninstalled and removing associated files, c)remind me later. I'm afraid this is a "fraudulent" window and that telling it to leave it uninstalled and to remove files is only going to make things worse. Any experience with this out there? Thanks!
 

Answer:180 Search Assistant

heres a good article http://articles.networktechs.com/394-p1.php
 

1 more replies
Relevance 52.89%

Hi I am new here - I seem to have gotten the 180 Search Assistant in my computer. I have tryed to get rid of it with both Skybot and CWShredder but without luck. If anyone can help me here is my Hijackthis logfile....help would be greatly appreciated!Logfile of HijackThis v1.98.2Scan saved at 16:01:21, on 16.11.2004Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\WINDOWS\system32\drivers\KodakCCS.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exeC:\WINDOWS\system32\MMTray.exeC:\WINDOWS\system32\MMTray2k.exeC:\WINDOWS\system32\MMTrayLSI.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Common Files\Real ... Read more

Answer:180 Search assistant

Hi It is a good ideea to print or copy these instructions because you are not able to access the Internet in SafeMode.Make sure you are set to show hidden files and folders: A. On the Tools menu in Windows Explorer, click Folder Options.B. Click the View tab.C. Under Hidden files and folders, click Show hidden files and folders.D. Uncheck Hide extensions for known filetypes and Hide protected operating system files.How to see hidden files in WindowsREBOOT into SafeMode by tapping F8 key repeatedly at bootup: Starting your computer in Safe modeRun HijackThis!, press Scan, and put a check mark next to all these:R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)O4 - HKLM\..\Run: [gzyz] C:\WINDOWS\gzyz.exeClose all other windows and browsers, and press the Fix Checked button.Search for these files and delete them if found:C:\WINDOWS\gzyz.exe <-- this fileEmpty the Recycle Bin.REBOOT normally. Perform a full scan here: Trendmicro, check AutoClean and let him remove anything he finds.REBOOT your computer, run HijackThis! again and post a new log please.

9 more replies
Relevance 52.89%

1st post!!!! Any way, I have this problem my self.As if you don?t know the symptoms?. Here are my specific problemsOf course you there are the pop-ups that have a header of ?180 search assistantI have also notice something called Web rebates checked to boot up, I unchecked it and of course after restarting and opening Explorer?. Its warning me that 180 search assistant has been turned off. And it appears in my processes again as Web rebates.This is my hijackthis log:Logfile of HijackThis v1.99.0Scan saved at 11:14:15 AM, on 1/15/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\ATI Technologies\ATI.ACE\cli.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\ATI Technologies\ATI.ACE\CLI.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\Program Files\AIM\aim.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\... Read more

Answer:180 search assistant

Print out these instructions and then close all windows including Internet Explorer.Then I want you to fix some of those entries. Please do the following:Please make sure that you can view all hidden files. Instructions on how to do this can be found here:How to see hidden files in WindowsRun Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O4 - HKLM\..\Run: [qzqlih] C:\WINDOWS\qzqlih.exeO4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"Reboot your computer into Safe ModeThen delete these files or directories (Do not be concerned if they do not exist)C:\WINDOWS\qzqlih.exeC:\Program Files\Web_Rebates\Reboot your computer to go back to normal mode and post a new log.

3 more replies
Relevance 52.89%

How do I get rid of this search assistant. I removed it from the taskbar by unchecking it, but when I shut down and boot back up, it's there again. It messes up the order that I have my quick launch and is just a pain. I have even tried to remove it from the add&remove programs in the control panel. Windows XP. Please help.
 

Answer:180 Search Assistant

spyware, m'lady, spyware. i'd estimate that 80% of the problems in the Web & Email forum here could be prevented if everyone went out and downloaded a spyware scanner. spyware is a piece of software written so it performs one of two main functions, both of them bad:
1) reporting back on your personal information
2) making a general mess of your computer

unfortunately, 180 is spyware. Add/Remove Programs doesn't get rid of it, going into Msconfig and removing it from your Start-up List doesn't get rid of it, praying to the Almight Technology Gods for salvation from the Spyware Demons doesn't get rid of it.
However, I have a solution. It's free, relatively easy, and if you don't get how to work it, you can ask someone here. Get either the programs Spybot Search & Destroy or AdAware 6.0. Personally, I recommend Spybot Search & Destroy, but you might find AdAware 6.0 easier to use.

To download Spybot Search & Destroy: http://www.spybot.info/index.php?page=download

To download AdAware 6.0: www.lavasoftusa.com/support/download/

Hope this helps!
 

1 more replies
Relevance 52.07%

Hi - i seem to have gotten this in my computer Can anyone help me to get rid of it? Here is my Hijackthis logfile:

Help would be greatly appreciated

Logfile of HijackThis v1.98.2
Scan saved at 11:51:52, on 16.11.2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\MMTray.exe
C:\WINDOWS\system32\MMTray2k.exe
C:\WINDOWS\system32\MMTrayLSI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\windows\msbb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program F... Read more

Answer:Spybot and 180 Search Assistant

7 more replies
Relevance 52.07%

I've got this thing, I get constant pop-ups, really annoying. I found out that if I have this, chances are that I have some other junk too. Here is my hijack this log. Some very nice person, please let me know what to do. Thanks.

Logfile of HijackThis v1.98.2
Scan saved at 4:15:01 PM, on 11/17/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wscntfy.exe
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\PROMon.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PhoneTools\CapFax.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\koqwej.exe
C:\WINNT\System32\NMSSvc.exe
C:\temp\salm.exe
C:\Program Files\AIM+\AIM+.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\AIM95\aim.exe
C:\Program Files\SpywareGuard\sgmain.ex... Read more

Answer:180 search assistant spyware- NEED HELP!

8 more replies
Relevance 52.07%

Recently I have all the sudden had the Search Assistant start popping up on my taskbar when i log onto my computer. I can right click on my taskbar and goto toolbars and uncheck it. I know it wasn't there a while ago. Any way to remove this, or disable it? i've tried going into the registy and adding the Use Search Asst no value in the software\windows\currentversion\cabinent and that didn't get it. I also tried adding it to the internet explorer spot in teh registry as well. Any idea on how to disable/remove this?
 

Answer:Search Assistant on Taskbar

16 more replies
Relevance 52.07%

in my Windows XP and I'm not sure how this happened. I can't figure out how to get it back. Thanks
 

Answer:Lost the Search Assistant

Hi,,Search Assistant is not a good thing..Do you think you could post a hijackthis log? Click the link below and install hijackthis from one of the links at the site. Install then run it. Hit the scan button and check no boxes. The Scan button will change to a save log button. Save the log somewhere you can find it then copy and paste all the text here in a post so we may check it over.

http://mjc1.com/mirror/hjt/
 

2 more replies
Relevance 52.07%

I am using xp and I deleted a program file called search assistant. next, I clicked internet explorer and leopard search assistant came up. Can anyone explain what happened and where is ie? Greatly appreciated!

Answer:Leopard Search Assistant

Looks like you've picked up a browser hijacker. Run your AntiVirus and antispyware scans from Safe Mode. Remember to update them first.How to start Windows in Safe ModeWhich apps do you have by the way?

5 more replies
Relevance 52.07%

Thought I'd give this a second try--see if anyone has an idea, other than a complete reinstall.

Search for Files/Folders not working

------------------------------------

I have a problem with the "Search for files & folders" function. Indexing is turned off.

When I do a search for the single letter "a" or other combinations that start with "a," "ab," "ac," "ag"... the search looks at the WINNT directory, only.

For example, a search for "ad[obe]" will scan the all the drives.

But, a search for "ac[robat]" only scans C:\ or C:\WINNT.

If I search for "ac[robat]" specifing it to look at a drive other than C, then it searches that drive properly.

It's only when I do a search looking at "my computer" or all "local hardware," does it exclude certain letters and look at C:\ or C:\WINNT\ for that letter/letter combination.

Any ideas? --sys. is clean of viruses, etc.

Bob in Provo
 

Answer:Search Assistant broken

If you have no particular attachment to that search function, you might just use a different searcher. I use Agent Ransack in XP and find it faster and more thorough than the MS search. It's free. It has no adware. Registration is optional. It works.
 

2 more replies