Page 1 of 2 12 LastLast
Results 1 to 15 of 19

Thread: Unable to Change Home Page (Home Search Assistant Problem)

  1. #1
    Junior Member
    Join Date
    Jun 2004
    Posts
    3

    Unhappy Unable to Change Home Page (Home Search Assistant Problem)

    I'm currently having a problem changing my homepage in Internet explorer. And There are three items in the control Panel that I cannot remove. The Three programs are Home Search Assistant, Search Extender, and Shopping wizard. I have run the latest adaware, and spybot refrence file, and still doesn't fix the issue. I downloaded a program called Hijackthis, and this is the information displayed in the file:

    Logfile of HijackThis v1.97.7
    Scan saved at 10:49:32 AM, on 7/16/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\LEXBCES.EXE
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\system32\LEXPPS.EXE
    C:\Program Files\NavNT\defwatch.exe
    C:\Program Files\NavNT\rtvscan.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\slserv.exe
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\System32\MsgSys.EXE
    C:\Program Files\NavNT\vptray.exe
    C:\Program Files\ASUS\Probe\AsusProb.exe
    C:\WINNT\System32\hpawoo.exe
    C:\WINNT\system32\sdkyr32.exe
    C:\WINNT\System32\gnar.exe
    C:\WINNT\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlgn.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\DOCUME~1\ANTHON~1\LOCALS~1\Temp\ns_temp\jre140_02i.exe
    C:\DOCUME~1\ANTHON~1\LOCALS~1\Temp\pft33~tmp\Disk1\manualwrapper.exe
    C:\DOCUME~1\ANTHON~1\LOCALS~1\Temp\pft33~tmp\Disk1\setup.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
    C:\Program Files\Java\j2re1.4.1_02\lib\unpack.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINNT\system32\rundll32.exe
    E:\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://your-searcher.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\owacx.dll/sp.html#96676
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://owacx.dll/index.html#96676
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.internet-search.info/searchbar
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://owacx.dll/index.html#96676
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\owacx.dll/sp.html#96676
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://owacx.dll/index.html#96676
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\owacx.dll/sp.html#96676
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://your-searcher.com/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://your-searcher.com/index.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.we1.attbb.net:8000
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.we1.attbb.net;<local>
    N3 - Netscape 7: user_pref("browser.startup.homepage", "www.comcast.net"); (C:\Documents and Settings\Anthony Forney\Application Data\Mozilla\Profiles\default\wsypr9mj.slt\prefs.js)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {CE69A8BF-C2B1-CB51-B3FE-9C25B7ADBFBA} - C:\WINNT\system32\ipju32.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\3\printray.exe
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [kripurilnno] C:\WINNT\System32\hpawoo.exe
    O4 - HKLM\..\Run: [sdkyr32.exe] C:\WINNT\system32\sdkyr32.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKLM\..\RunOnce: [ntpq32.exe] C:\WINNT\system32\ntpq32.exe
    O4 - HKLM\..\RunOnce: [SpyBotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: winlgn.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct1_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt0_x.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...ctor/swdir.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
    O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.fizzlewizzle.com/installfiles/popblocker.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/co...20/SassCln.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

    And to top it off, my Norton Antivirus is coming up with a bunch of trojans detected and it is quartine the files. here is a list of the files:

    Filename
    ntkw32.exe
    atlyp32.exe
    crdf.exe
    sdkwa32.exe
    addaf32.exe
    winph.exe
    msfs32.exe
    netmk.exe
    winyz32.exe
    d3mg.exe
    netdu32.exe
    msov.exe
    mfcgg32.exe
    ipvc32.exe
    crsg.exe
    mfcxu.exe
    atlee.exe
    ntpq32.exe
    sysju32.exe
    mfcep32.exe
    ntgk32.exe
    ipmr.exe
    ntbj.exe
    apipn.exe
    javaks.exe
    iptl32.exe
    mfcgj.exe
    sysyu32.exe
    apits.exe
    apptg.exe
    ntuh32.exe
    mfclu32.exe
    iesx.exe
    atloj32.exe
    ntds32.exe
    msqy32.exe
    appcq.exe
    ipxo32.exe
    apixq32.exe
    javarv.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    d3tq32.exe
    netxj.exe
    A0012666.exe
    iehr.dll
    outl32l.exe
    load[1].html
    EXPLOIT[1].CHM
    iehr.dll
    main[1].chm
    main[1].chm
    main[1].chm
    outl32l.exe
    load[1].html
    A0012666.exe
    A0012666.exe
    A0012666.exe


    Anybody Please help me out it is driving me crazy!!!

  2. #2
    Triple Platinum Member hotmale's Avatar
    Join Date
    Mar 2004
    Location
    Lebanon
    Posts
    867
    To be honest, I haven't read everything you included. But I guess Ad-aware and/or Spybot should solve the problem. Just make sure you update them before scanning.
    BTW, welcome to our forum!

  3. #3
    Triple Platinum Member hotmale's Avatar
    Join Date
    Mar 2004
    Location
    Lebanon
    Posts
    867
    Pardon me! I made a mistake; neither Ad-aware nor Spybot can remove this type of spyware. You must install HSRemove (http://www.majorgeeks.com/download4286.html) instead.

  4. #4
    Junior Member
    Join Date
    Aug 2004
    Posts
    1

    i just fixed it...

    hello...i'm gladly wanna tell u that just now i was able to fix the problem like we together faced. actually after few days, i eventually found the key of the problem. try this: go to task manager, select the processes tab bar, find winlgn.exe. after that, stop that process. then open the registry editor window (run->regedit) and find key "your-searcher". after u find the string at "start page" key (start page: dword value: http://your-searcher.com/index.htm), delete that entire key. then restart ur computer. it sholud be working then... thank you....

  5. #5
    Friendly Neighborhood Super Moderator phishhead's Avatar
    Join Date
    Apr 2002
    Location
    San Diego, Ca.
    Posts
    3,409
    or you can download cwshredder to wipe out the boogers that adaware and spybot refuse to find.



  6. #6
    Junior Member
    Join Date
    Aug 2004
    Posts
    6
    I keep trying to download CWShredder because I have the same problem this user had but it doesn't let me. The page will show up as "This page cannot be displayed." Please help me! I don't know what to do!

  7. #7
    Friendly Neighborhood Super Moderator phishhead's Avatar
    Join Date
    Apr 2002
    Location
    San Diego, Ca.
    Posts
    3,409



  8. #8
    Junior Member
    Join Date
    Aug 2004
    Posts
    2
    I am having the same problem, I have Search Extender and it shows the aim messanger icon next to it, then there is Shopping Wizard, and Home Search Assistent, and when I go to remove them this website comes up http://looking-for.cc/uninstall/Home...Assistant.html same for each thing but a different title how do I get rid of this pest

  9. #9
    Techzonez Governor Super Moderator Conan's Avatar
    Join Date
    Apr 2002
    Location
    Philippines
    Posts
    3,920
    Have a look at Egghead's Spyware Removal Thread:

    http://www.techzonez.com/forums/showthread.php?t=9739

  10. #10
    Junior Member
    Join Date
    Aug 2004
    Posts
    2

    Its still not gone....Home Search Assistent,Shopping Wizard, and Search Extender

    how do I get rid of these pests I looked at the following above and didnt clearly understand it I tried somethings but it still didnt work?


    *edit* deleted...Please read the rules regarding warez and pirated software.
    Last edited by phishhead; August 30th, 2004 at 17:21 PM.

  11. #11
    Junior Member
    Join Date
    Sep 2004
    Location
    Dallas TX USA
    Posts
    1
    I have the same problem.. Been reading the posts and downloading for the past 4 hours. I seem to have Home Search Assistent problem that you cannot uninstall.. sends a message with a bad webpage ( http://looking-for.cc/uninstall/Hom...hAssistant.html same ). Also seems to ADD favorites, add things to desktop, when I go to search online a second search page pops up too.. the most annnoying thing is the damn search toolbar..and freeze-ups during usage of my computer.. How do I get rid if this! I have downloaded and run:

    Ad-aware:
    http://www.lavasoftusa.com/software/adaware/

    Spybot - Search & Destroy:
    http://security.kolla.de/index.php?...n&page=download

    Bazooka Adware and Spyware Scanner:
    http://www.kephyr.com/spywarescanner/

    http://www.spywareinfo.com/~merijn/files/CWShredder.exe


    I have read on a lot of sites that this slips by all of the software. Can someone PLEASE help! I have got to get rid of Web Search!

    This was helpful http://www.techzonez.com/forums/showthread.php?t=9739 But did not solve the problem... HELP!!

    [email protected]

  12. #12
    Old and Cranky Super Moderator rik's Avatar
    Join Date
    Aug 2003
    Location
    Watching Your every move...
    Posts
    4,303
    Try downloading and running CWShredder from this link

    http://www.downloads.subratam.org/CWShredder.exe

    Let us know if you have problems downloading the file or removing the spyware.

  13. #13
    Precision Processor Super Moderator egghead's Avatar
    Join Date
    May 2002
    Location
    In Your Monitor
    Posts
    3,212
    an important thing to remember is to stop surfing the internet with internet explorer....


    how do these spyware programs get into my computer if i am not downloading and installing programs?

    answer:
    spyware is getting into your computer by exploits found in internet explorer. just visiting a website that has a bad advertisement from an ad company can trigger your computer to download and install spyware onto your computer with no user intervention. you will not know it has been installed.
    ( you will know cause your computer will be slower and crash all the time and websites fail to load... even windowsupdate can stop working leaving you vulnerable and consulting expensive computer shops to solve the problem.)

    the current solution is not to use intetrnet explorer at all.....

    use an alternative like firefox
    http://www.mozilla.org/products/firefox/

    more info about keeping internet explorer safe can be found here,
    http://star-techcentral.com/tech/sto...&sec=itfeature
    ------------------------------------------------------------



  14. #14
    Platinum+ Member z3n's Avatar
    Join Date
    May 2004
    Location
    Australia
    Posts
    580
    Wise words from Egghead -

    Even using software that locks down your browser settings (search and destroy) hijackers were still able to penetrate, which is quite amazing considering I didn't even have manual option controls myself.

    Like Egghead said,
    Quote Originally Posted by Egghead
    the current solution is not to use intetrnet explorer at all.....
    We strongly suggest getting Firefox installed and up and running, and then work on washing down that dirty ol' browser called IE.

    Download it from here or here

    Time flies like an arrow. Fruit flies like a banana.~ Groucho

  15. #15
    Junior Member
    Join Date
    Nov 2004
    Posts
    1
    Please Help! I have no idea of how to do things when it comes to Computers, I have the same problem that you all are having with those three stuborn programs. . . if anyone could help me out? I read what finocero posted back in Aug. 2004, and it sounds like it could work but really have no idea how to go about it. Anyone think they can help please!!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •