Unable to Change Home Page (Home Search Assistant Problem)

I'm currently having a problem changing my homepage in Internet explorer. And There are three items in the control Panel that I cannot remove. The Three programs are Home Search Assistant, Search Extender, and Shopping wizard. I have run the latest adaware, and spybot refrence file, and still doesn't fix the issue. I downloaded a program called Hijackthis, and this is the information displayed in the file:

Logfile of HijackThis v1.97.7
Scan saved at 10:49:32 AM, on 7/16/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\slserv.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\MsgSys.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINNT\System32\hpawoo.exe
C:\WINNT\system32\sdkyr32.exe
C:\WINNT\System32\gnar.exe
C:\WINNT\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlgn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\DOCUME~1\ANTHON~1\LOCALS~1\Temp\ns_temp\jre140_02i.exe
C:\DOCUME~1\ANTHON~1\LOCALS~1\Temp\pft33~tmp\Disk1\manualwrapper.exe
C:\DOCUME~1\ANTHON~1\LOCALS~1\Temp\pft33~tmp\Disk1\setup.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
C:\Program Files\Java\j2re1.4.1_02\lib\unpack.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\rundll32.exe
E:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://your-searcher.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\owacx.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://owacx.dll/index.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.internet-search.info/searchbar
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://owacx.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\owacx.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://owacx.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\owacx.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://your-searcher.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://your-searcher.com/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.we1.attbb.net:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.we1.attbb.net;<local>
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.comcast.net"); (C:\Documents and Settings\Anthony Forney\Application Data\Mozilla\Profiles\default\wsypr9mj.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {CE69A8BF-C2B1-CB51-B3FE-9C25B7ADBFBA} - C:\WINNT\system32\ipju32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [kripurilnno] C:\WINNT\System32\hpawoo.exe
O4 - HKLM\..\Run: [sdkyr32.exe] C:\WINNT\system32\sdkyr32.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKLM\..\RunOnce: [ntpq32.exe] C:\WINNT\system32\ntpq32.exe
O4 - HKLM\..\RunOnce: [SpyBotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: winlgn.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct1_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt0_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...ctor/swdir.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.fizzlewizzle.com/installfiles/popblocker.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/co...20/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

And to top it off, my Norton Antivirus is coming up with a bunch of trojans detected and it is quartine the files. here is a list of the files:

Filename
ntkw32.exe
atlyp32.exe
crdf.exe
sdkwa32.exe
addaf32.exe
winph.exe
msfs32.exe
netmk.exe
winyz32.exe
d3mg.exe
netdu32.exe
msov.exe
mfcgg32.exe
ipvc32.exe
crsg.exe
mfcxu.exe
atlee.exe
ntpq32.exe
sysju32.exe
mfcep32.exe
ntgk32.exe
ipmr.exe
ntbj.exe
apipn.exe
javaks.exe
iptl32.exe
mfcgj.exe
sysyu32.exe
apits.exe
apptg.exe
ntuh32.exe
mfclu32.exe
iesx.exe
atloj32.exe
ntds32.exe
msqy32.exe
appcq.exe
ipxo32.exe
apixq32.exe
javarv.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
d3tq32.exe
netxj.exe
A0012666.exe
iehr.dll
outl32l.exe
load[1].html
EXPLOIT[1].CHM
iehr.dll
main[1].chm
main[1].chm
main[1].chm
outl32l.exe
load[1].html
A0012666.exe
A0012666.exe
A0012666.exe


Anybody Please help me out it is driving me crazy!!!

To be honest, I haven't read everything you included. But I guess Ad-aware and/or Spybot should solve the problem. Just make sure you update them before scanning.
BTW, welcome to our forum!

Pardon me! I made a mistake; neither Ad-aware nor Spybot can remove this type of spyware. You must install HSRemove (http://www.majorgeeks.com/download4286.html) instead.

hello...i'm gladly wanna tell u that just now i was able to fix the problem like we together faced. actually after few days, i eventually found the key of the problem. try this: go to task manager, select the processes tab bar, find winlgn.exe. after that, stop that process. then open the registry editor window (run->regedit) and find key "your-searcher". after u find the string at "start page" key (start page: dword value: http://your-searcher.com/index.htm), delete that entire key. then restart ur computer. it sholud be working then... thank you....

or you can download cwshredder to wipe out the boogers that adaware and spybot refuse to find.

I keep trying to download CWShredder because I have the same problem this user had but it doesn't let me. The page will show up as "This page cannot be displayed." Please help me! I don't know what to do!

check this post http://www.techzonez.com/forums/showthread.php?t=11161

I am having the same problem, I have Search Extender and it shows the aim messanger icon next to it, then there is Shopping Wizard, and Home Search Assistent, and when I go to remove them this website comes up http://looking-for.cc/uninstall/Home...Assistant.html same for each thing but a different title how do I get rid of this pest

Have a look at Egghead's Spyware Removal Thread:

http://www.techzonez.com/forums/showthread.php?t=9739

how do I get rid of these pests I looked at the following above and didnt clearly understand it I tried somethings but it still didnt work?


*edit* deleted...Please read the rules regarding warez and pirated software.

I have the same problem.. Been reading the posts and downloading for the past 4 hours. I seem to have Home Search Assistent problem that you cannot uninstall.. sends a message with a bad webpage ( http://looking-for.cc/uninstall/Hom...hAssistant.html same ). Also seems to ADD favorites, add things to desktop, when I go to search online a second search page pops up too.. the most annnoying thing is the damn search toolbar..and freeze-ups during usage of my computer.. How do I get rid if this! I have downloaded and run:

Ad-aware:
http://www.lavasoftusa.com/software/adaware/

Spybot - Search & Destroy:
http://security.kolla.de/index.php?...n&page=download

Bazooka Adware and Spyware Scanner:
http://www.kephyr.com/spywarescanner/

http://www.spywareinfo.com/~merijn/files/CWShredder.exe


I have read on a lot of sites that this slips by all of the software. Can someone PLEASE help! I have got to get rid of Web Search!

This was helpful http://www.techzonez.com/forums/showthread.php?t=9739 But did not solve the problem... HELP!!

[email protected]

Try downloading and running CWShredder from this link

http://www.downloads.subratam.org/CWShredder.exe

Let us know if you have problems downloading the file or removing the spyware.

an important thing to remember is to stop surfing the internet with internet explorer....


how do these spyware programs get into my computer if i am not downloading and installing programs?

answer:
spyware is getting into your computer by exploits found in internet explorer. just visiting a website that has a bad advertisement from an ad company can trigger your computer to download and install spyware onto your computer with no user intervention. you will not know it has been installed.
( you will know cause your computer will be slower and crash all the time and websites fail to load... even windowsupdate can stop working leaving you vulnerable and consulting expensive computer shops to solve the problem.)

the current solution is not to use intetrnet explorer at all.....

use an alternative like firefox
http://www.mozilla.org/products/firefox/

more info about keeping internet explorer safe can be found here,
http://star-techcentral.com/tech/sto...&sec=itfeature

Wise words from Egghead -

Even using software that locks down your browser settings (search and destroy) hijackers were still able to penetrate, which is quite amazing considering I didn't even have manual option controls myself.

Like Egghead said,

Quote:

---

Originally Posted by Egghead

the current solution is not to use intetrnet explorer at all.....

---

We strongly suggest getting Firefox installed and up and running, and then work on washing down that dirty ol' browser called IE.

Download it from here or here

Please Help! I have no idea of how to do things when it comes to Computers, I have the same problem that you all are having with those three stuborn programs. . . if anyone could help me out? I read what finocero posted back in Aug. 2004, and it sounds like it could work but really have no idea how to go about it. Anyone think they can help please!!

here is the home search removal tool,
http://www.majorgeeks.com/download4286.html

important steps to getting this tool to work properly:

1: Boot into safe mode by tapping the f8 key as your computer boots. You should do this before you see the Windows splash screen.

2: Also, make sure you can see hidden files; Open My Computer and choose Tools, then click on Folder Options, click on the View tab and under Advanced Setting, choose Show Hidden Files and Folders, then click on OK and close My Computer.

3: Right-click on My Computer, Choose Manage, Double-click on Services and Applications, Click on Services. In the righthand column find "Network Security Service", and double-click on it. (In Safe Mode this may already be stopped) Choose Stop and then write down the name and path of the file in the "Path to Executable" section. Set the Startup Type to Disabled. Click Ok. Close the Computer Management window


Limitations: When finished, you will get a web page saying it worked as your home page. This is normal. You will need to reset your home page manually via tools, internet options. We have run the tool, it is spyware free and appears to not cause any problems. That said, you should have your computer backed up when installing any third party applications.

Hey all,
I have the Home Search Assistant problem myself, so i got Firefox, and all is well. Except that HSA seems to run deeper than Internet Explorer. I can't send any messages on AOL Instant Messenger without it crashing, and I found out that one of the main causes of that error is have HSA! I've downloaded AD-Aware SE, Spybot Search & Destroy, HijackThis, AboutBuster, and other spyware removal things and used them in succession without any change...Can anyone suggest another method?

Thanks,
MrSilent

P.S. I curse the makers of HSA to hell to let them rot and burn in flames.

I'd say if all you guy's can't get rid of this pest after all this info then it's time for a system restore or format clean OS. Sorry but that's a whole lot easier and faster than racking your head for days on end trying to fix.

This thing sounds real bad and worst than a virus.....

Quote:

---

Originally Posted by egghead

here is the home search removal tool,
http://www.majorgeeks.com/download4286.html/

---

I said that in the 3rd post, but no one was paying me any attention :D