Home Search Assistant...

Status
Not open for further replies.
search assistant gone? but more problems...

so i seem to have killed search assistant, but now i have problems with windows altogether...my add/remove programs no longer exists.

no icons appear and across the top is printed the following:

Change or Remove ProgramsAdd New ProgramsAdd Remove Windows ComponentsSet Program Access and Defaults

one line across the top that is what it reads...

further, when on the internet, many of the textual links to futher information no longer work. this is especially a pain in yahoo, i cannot delete, forward, reply, etc. through the button.

any answers out there?
 
i've sorted out the problems with home search assitant, reinstalled windows 2000 and things are CLOSE to normal, HOWEVER...now windows installer keeps informing me of an installing in progress, but i am not installing anything. what the hell?

turns out it wasn't me installing anything...i was hit again. a few precious moments my notebook and i were one again...and now we are screwed once more. here is my hijack this log...
 
Obviously, you did not read my post!
It says clearly, STOP using IE.
Having IE 5.0 on your PC also shows irresponsibility. Current would be IE 6.00/SP1.

My advise:
reinstall again, first W2K/SP4, then IE6/SP1, then Firefox 1.0, then the free AVG7, then the free Agnitum Outpost 1.0 Firewall.
Don't bother with that Norton/Symantec junk you have.

Only now should you go on the internet, straight to MS Windows update, and install EVERY available update for W2K and IE (except .NET and MediaPlayer 10).
Next update AVG7. Then install and update Adaware and Spybot. Let Spybot immunize your system.

And from now on DON'T use the effing IE, but Firefox instead.
Do NOT install any searchbars from anywhere, not even from Google. And stay away from any dodgy websites.
Only YOUR disciplin will keep your PC up and running.
 
i've followed your advice and SO FAR, it is a much more pleasureable internet experience. i don't claim to be computer savvy, but i know good advice when i see it. thanks!
 
I may have sounded a bit harsh, but I am glad I got you sorted.
Keep up the good work and the Internet will stay a breeze!.
 
Help!!

I am one of those computer illiterate people. i've tried doing what you guys have said to do, but i cant figure it out! help please!! I dotn know how to to delete the Home search thing!

I am one of those computer illiterate people. And I got that stupid Home assistant thing. I downloaded the hijack thing but I dont know what program to open it as! HELP PLEASE!!
 
continual problems

hey, ive read the forum on the home search assistant, and the link that was stated, got the programs and such, but i think i keep getting lost somewhere in there. ill provide my hijack log, but otherwise i have no clue what to do ,lol
 
xojie

First thing, MOVE HJT into its OWN directory, NOT in your Desktop.

Reboot in Safe Mode

Kill these running processes first with Task Manager, if you can:
C:\WINDOWS\winhh32.exe
C:\WINDOWS\system32\javala.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe

With NO other programs open, run HJT and let it FIX:
C:\WINDOWS\winhh32.exe
C:\WINDOWS\system32\javala.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {E6729088-50CA-1D40-3B9D-AA2D52D24BF7} - C:\WINDOWS\system32\ipyn32.dll
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [javala.exe] C:\WINDOWS\system32\javala.exe
O4 - HKLM\..\Run: [7.tmp] C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe 0 10001
O4 - HKLM\..\Run: [7.tmp.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe 0 10001
O4 - Global Startup: Windows Timer.hta
O16 - DPF: ChatSpace Full Java Client 3.1.0.235N - http://205.177.13.50/Java/cfsn31235.cab
O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CF2D61ED-985C-4DC8-910C-B635E43CB1B5} (FTCChat Control) - http://funteenchat.com/FTCChat.cab
O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\winhh32.exe

When done, delete the crap, whatever is left:
C:\WINDOWS\winhh32.exe
C:\WINDOWS\system32\javala.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp (anything in this directory!)
C:\WINDOWS\system32\cwsel.dll
C:\WINDOWS\system32\ipyn32.dll
C:\Program Files\WildTangent (anything in this DIR including the DIR itself)
Timer.hta (wherever that is)
 
Home Search Assistent, Search Extender, and Shopping Wizard

Hi I am new to this forum thing but I really need expert help on getting rid of these three programs I don't know how to uninstall them and I don't even know how they got on my computer in the first place. I tried using Ad-Aware but it don't even detect it. I also just bought Spy Sweeper by webroot but that don't get rid of them either please help.
 
I've been at this ALL DAY

Hate to bother y'all, however I've been victimized by the home search ASSistEnt, ShopppingWizard and Search ASSistent sh**t too.
Please find enclosed the txt [sorry tried to link]. It's at the bott of this mssg.

Thanks in advance.

-BT

See hijack list enclosed
thx!

This is one daunting task. I've tried a number of suggestions offered here [and around the net] and STILL no removal of this beast. I enclose the h'jack log for your perusal. Assistance would br GREATLY appreciated.
-BT
 
Go here first and follow EXACTLY
How to remove Begin2Search / Coolwebsearch
Most instructions are there.

After all that, boot again in safe mode and run HJT as described. Let it "fix" (if still there):

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {B8F62905-CBFE-CF1D-F738-6EC2FD2913F4} - C:\WINNT\system32\apprl32.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\~Downloads\BTdownloads\WinAmp\winampa.exe"
O4 - HKLM\..\Run: [javaxc32.exe] C:\WINNT\javaxc32.exe
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

Afterwards, delete the bold file if still there.
 
Did as was told....and more...Duh!

Update!
Well everything seems to be in order the bug appears to have gone, however.
I inadvertantly removed necessary dll files from winsock LSP:
calsp.dll (which showed up in the HJT scan, so thought to be safe.
BUT...
msafd.dll (which apparently is required to get online [on another PC right now]
rsvpsp.dll (not sure of the consequences of that one yet)
Is there any way to rectify my mistake?
I assume a reinstall of OS would be starters?!
Sorry for the hassle.

BT

---
Removed aklsp.dll yet HJT picks up more [see screenshot new HJTlog]
Is it safe to remove the remaining? { I goofed here and deleted some}
I am now "FireFoxed"
/Update!
----
...And it appears I still have it tracking my every move.

HJT cannot remove winsock LSP aklsp.dll. -It does, however refer me to
cexx-org-lspfix-h t m for that program to remove it.
Manual deletion is not possible -says it is running. See screenshots.

Outside of that I enclose my latest HJT log and appreciate all the help.
I PRAY we can get rid of this awful nuisance.

Thanks!

PS: I'll update my profile for a better handle on my system.
 
BTwonderZ

If I tell people to follow instructions EXACTLY, then that's what they SHOULD do.
You would have found the O10 - Unknown file in Winsock LSP: error message, including instructions on how to FIX them.
Having 2 of those, means you have to do it twice, once for each file. You are the first one to have 2, sorry if I overlooked that.
See if you can get those deleted (why?) files back from your CD, the dll-cache on your HD or from someone else with (non-infected) XP.

Anyway, based on hjt20.txt, boot in safe mode, let HJT "fix" this:
C:\WINNT\system32\userinit.exe

Run the LSPFIX for both
O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
and
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
DO NOT DELETE ANY OTHER FILES.

Based on hjt21.txt, boot in safe mode and only "run" HJT:

If this is still around, let LSPFIX this:
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll

Don't try to confuse the issue, only report 1 log at the time. Fix that, then report back with another, if you still have problems.
 
Following instructions

realdarkstuff,

Thanks for your patience. I do believe the search assistent problem is solved, however as you now know the is this LSP dillema.

Your instructions were clear and well appreciated, the LSPfix seemed the logical route to take based on the HJT discovery.
Missing a step and acting on impulse taught a lesson of restraint.

Ran HJT and neither C:\WINNT\system32\userinit.exe nor 010-Unknown file in Winsock LSP:C\winnt\system32\calsp.dll were listed to "fix" \userinit.exe -only shows in log21a.

Now, I did find a copies of msafd.dll and rsvpsp.dll in the cache, however now what/where do I go?

Not to confuse the issue but, is the application "winsockfix,exe" of any help?

I'll await your reponse regarding this new issue and hope it isn't too much trouble.

Thanks!

BT
 
BTwonderz

rnr20, msafd and rsvpsp.dll can be found in c:\winnt\servicpackfiles\i386
winrnr.dll in c:\winnt\system32\dllcache
Copy them into c:\winnt\system32 while in Safe Mode, then REBOOT.

Calsp.dll does NOT belong on your PC.

Your HJT-log is almost clean.
Have HJT fix: C:\WINNT\system32\userinit.exe but DON't delete that file.

You could try that winsockfix program, but AFAIK is only needed if you have lost your internet-connection. And success with it is not always guaranteed. It won't do any damage, so try it.
 
Re: "almost clean"

RealDarkStuff,
winnt\servicepackfiles [does not exist-as named] nor can mr20 be found
however there is a:
winnt\drivercache\j386
msafd & rsvpsp & winrnr.dll ARE in \system32...manually deleted calsp.dll

see enclosed
HJT 25
-log before scanning and "fix" with nothing checked
HJTb
-log after "fix" with nothing checked.
could not find...userinit.exe

BTW, I DO NOT have internet connection since LSPfix of msafd.dll & rsvpsp.dll

BT
 
It's RNR20.DLL find it attached in a ZIP-file (rightclick/save as to get it)

Try that winsockfix program after you have copied rnr20.dll into \system32

Your logs are clean.

If all else fails you may need to do a repair through the console.
See Readme at top of Windows OS forum
 

Attachments

  • RNR20.zip
    20.2 KB · Views: 5
Help!

okay i really don't know much about computers at all but i know i have this three virus-things (Home Search Assistant and SearchExtender and Shopping Wizard). i've been trying to remove them by the add/remove programs thing on windows, but the same thing happened that did with mhopeck. someone i know who knows computers told me to download hijackthis. i did and it told me to put my log on a forum for help so here i am. could someone please help me out with this?

(i cannot paste the log apparently though, because it says there are URLs and i need to remove them)












-Graye
 
Re: ""Pasting"" HJT Log

Graye,
You don't actually "paste" the log.
You must first convert the .log file to a .txt file.
Then, when you post a message there is an area called "additional options"
within that you will see a form button called "manage attachments"
after clicking that you are taken to a screen that will ask you to "browse"
for that file.
Once you've found the converted .txt file, select it; then you press the button
"upload". This will attach it to your message and the tech can then read it and get back to you on what to do next.
It is strongly suggested to only upload one (1) HJT file at a time to properly diagnos your problem.
Hope this helps,

BT
 
Re: RNR20

realblackstuff,

The rnr.dll is in system\32. Is this the only place it should be?

Tried the winsockfix--didn't work [just hit "Fix"]
I believe I'll look for threads regarding that; re: protocols, tcip, etc.
and the win OS forum to investigate my next task.

Thanks for the assistance in cleaning that horrible mess.

BT

realblackstuff said:
It's RNR20.DLL find it attached in a ZIP-file (rightclick/save as to get it)

Try that winsockfix program after you have copied rnr20.dll into \system32

Your logs are clean.

If all else fails you may need to do a repair through the console.
See Readme at top of Windows OS forum
Click to expand...
 
Status
Not open for further replies.

Similar threads

A
Google rolls out new shopping tools in Search and Chrome
Replies
1
Views
228
Theinsanegamer
T
E
Hackers can access your private, encrypted AI assistant chats
Replies
7
Views
220
erickmendes
erickmendes
D
Google is changing how it shows search results to European users
Replies
1
Views
156
Mr Majestyk
M

Latest posts

Back