Home Search Assistant...

By mhopeck
Aug 3, 2004
Topic Status:
Not open for further replies.
  1. geoffworks76

    geoffworks76 Newcomer, in training

    search assistant gone? but more problems...

    so i seem to have killed search assistant, but now i have problems with windows altogether...my add/remove programs no longer exists.

    no icons appear and across the top is printed the following:

    Change or Remove ProgramsAdd New ProgramsAdd Remove Windows ComponentsSet Program Access and Defaults

    one line across the top that is what it reads...

    further, when on the internet, many of the textual links to futher information no longer work. this is especially a pain in yahoo, i cannot delete, forward, reply, etc. through the button.

    any answers out there?
  2. geoffworks76

    geoffworks76 Newcomer, in training

    i've sorted out the problems with home search assitant, reinstalled windows 2000 and things are CLOSE to normal, HOWEVER...now windows installer keeps informing me of an installing in progress, but i am not installing anything. what the hell?

    turns out it wasn't me installing anything...i was hit again. a few precious moments my notebook and i were one again...and now we are screwed once more. here is my hijack this log...
  3. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    Obviously, you did not read my post!
    It says clearly, STOP using IE.
    Having IE 5.0 on your PC also shows irresponsibility. Current would be IE 6.00/SP1.

    My advise:
    reinstall again, first W2K/SP4, then IE6/SP1, then Firefox 1.0, then the free AVG7, then the free Agnitum Outpost 1.0 Firewall.
    Don't bother with that Norton/Symantec junk you have.

    Only now should you go on the internet, straight to MS Windows update, and install EVERY available update for W2K and IE (except .NET and MediaPlayer 10).
    Next update AVG7. Then install and update Adaware and Spybot. Let Spybot immunize your system.

    And from now on DON'T use the effing IE, but Firefox instead.
    Do NOT install any searchbars from anywhere, not even from Google. And stay away from any dodgy websites.
    Only YOUR disciplin will keep your PC up and running.
  4. geoffworks76

    geoffworks76 Newcomer, in training

    i've followed your advice and SO FAR, it is a much more pleasureable internet experience. i don't claim to be computer savvy, but i know good advice when i see it. thanks!
  5. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    I may have sounded a bit harsh, but I am glad I got you sorted.
    Keep up the good work and the Internet will stay a breeze!.
  6. hasian

    hasian Newcomer, in training

    Help!!

    I am one of those computer illiterate people. i've tried doing what you guys have said to do, but i cant figure it out! help please!! I dotn know how to to delete the Home search thing!

    I am one of those computer illiterate people. And I got that stupid Home assistant thing. I downloaded the hijack thing but I dont know what program to open it as! HELP PLEASE!!
  7. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

  8. xojie

    xojie Newcomer, in training

    continual problems

    hey, ive read the forum on the home search assistant, and the link that was stated, got the programs and such, but i think i keep getting lost somewhere in there. ill provide my hijack log, but otherwise i have no clue what to do ,lol
  9. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    xojie

    First thing, MOVE HJT into its OWN directory, NOT in your Desktop.

    Reboot in Safe Mode

    Kill these running processes first with Task Manager, if you can:
    C:\WINDOWS\winhh32.exe
    C:\WINDOWS\system32\javala.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe

    With NO other programs open, run HJT and let it FIX:
    C:\WINDOWS\winhh32.exe
    C:\WINDOWS\system32\javala.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us4nb.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {E6729088-50CA-1D40-3B9D-AA2D52D24BF7} - C:\WINDOWS\system32\ipyn32.dll
    O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
    O4 - HKLM\..\Run: [javala.exe] C:\WINDOWS\system32\javala.exe
    O4 - HKLM\..\Run: [7.tmp] C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe 0 10001
    O4 - HKLM\..\Run: [7.tmp.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe 0 10001
    O4 - Global Startup: Windows Timer.hta
    O16 - DPF: ChatSpace Full Java Client 3.1.0.235N - http://205.177.13.50/Java/cfsn31235.cab
    O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CF2D61ED-985C-4DC8-910C-B635E43CB1B5} (FTCChat Control) - http://funteenchat.com/FTCChat.cab
    O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\winhh32.exe

    When done, delete the crap, whatever is left:
    C:\WINDOWS\winhh32.exe
    C:\WINDOWS\system32\javala.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp (anything in this directory!)
    C:\WINDOWS\system32\cwsel.dll
    C:\WINDOWS\system32\ipyn32.dll
    C:\Program Files\WildTangent (anything in this DIR including the DIR itself)
    Timer.hta (wherever that is)
  10. scsa316tt

    scsa316tt Newcomer, in training

    Home Search Assistent, Search Extender, and Shopping Wizard

    Hi I am new to this forum thing but I really need expert help on getting rid of these three programs I don't know how to uninstall them and I don't even know how they got on my computer in the first place. I tried using Ad-Aware but it don't even detect it. I also just bought Spy Sweeper by webroot but that don't get rid of them either please help.
  11. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    And based on what are we supposed to do that? Chrystal ball technology? Mind control?
     
  12. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    scsa316tt

    If you take the finger out and READ this and similar posts, you would have found this thread LONG ago:
    How to remove Begin2Search / Coolwebsearch

    Go there and follow exactly, then report back with HJT.txt if there are still problems.
  13. BTwonderz

    BTwonderz Newcomer, in training

    I've been at this ALL DAY

    Hate to bother y'all, however I've been victimized by the home search ASSistEnt, ShopppingWizard and Search ASSistent sh**t too.
    Please find enclosed the txt [sorry tried to link]. It's at the bott of this mssg.

    Thanks in advance.

    -BT

    See hijack list enclosed
    thx!

    This is one daunting task. I've tried a number of suggestions offered here [and around the net] and STILL no removal of this beast. I enclose the h'jack log for your perusal. Assistance would br GREATLY appreciated.
    -BT
  14. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    Go here first and follow EXACTLY
    How to remove Begin2Search / Coolwebsearch
    Most instructions are there.

    After all that, boot again in safe mode and run HJT as described. Let it "fix" (if still there):

    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {B8F62905-CBFE-CF1D-F738-6EC2FD2913F4} - C:\WINNT\system32\apprl32.dll
    O4 - HKLM\..\Run: [WinampAgent] "C:\~Downloads\BTdownloads\WinAmp\winampa.exe"
    O4 - HKLM\..\Run: [javaxc32.exe] C:\WINNT\javaxc32.exe
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

    Afterwards, delete the bold file if still there.
  15. BTwonderz

    BTwonderz Newcomer, in training

    Did as was told....and more...Duh!

    Update!
    Well everything seems to be in order the bug appears to have gone, however.
    I inadvertantly removed necessary dll files from winsock LSP:
    calsp.dll (which showed up in the HJT scan, so thought to be safe.
    BUT...
    msafd.dll (which apparently is required to get online [on another PC right now]
    rsvpsp.dll (not sure of the consequences of that one yet)
    Is there any way to rectify my mistake?
    I assume a reinstall of OS would be starters?!
    Sorry for the hassle.

    BT

    ---
    Removed aklsp.dll yet HJT picks up more [see screenshot new HJTlog]
    Is it safe to remove the remaining? { I goofed here and deleted some}
    I am now "FireFoxed"
    /Update!
    ----
    ...And it appears I still have it tracking my every move.

    HJT cannot remove winsock LSP aklsp.dll. -It does, however refer me to
    cexx-org-lspfix-h t m for that program to remove it.
    Manual deletion is not possible -says it is running. See screenshots.

    Outside of that I enclose my latest HJT log and appreciate all the help.
    I PRAY we can get rid of this awful nuisance.

    Thanks!

    PS: I'll update my profile for a better handle on my system.
  16. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    BTwonderZ

    If I tell people to follow instructions EXACTLY, then that's what they SHOULD do.
    You would have found the O10 - Unknown file in Winsock LSP: error message, including instructions on how to FIX them.
    Having 2 of those, means you have to do it twice, once for each file. You are the first one to have 2, sorry if I overlooked that.
    See if you can get those deleted (why?) files back from your CD, the dll-cache on your HD or from someone else with (non-infected) XP.

    Anyway, based on hjt20.txt, boot in safe mode, let HJT "fix" this:
    C:\WINNT\system32\userinit.exe

    Run the LSPFIX for both
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    and
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    DO NOT DELETE ANY OTHER FILES.

    Based on hjt21.txt, boot in safe mode and only "run" HJT:

    If this is still around, let LSPFIX this:
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll

    Don't try to confuse the issue, only report 1 log at the time. Fix that, then report back with another, if you still have problems.
  17. BTwonderz

    BTwonderz Newcomer, in training

    Following instructions

    realdarkstuff,

    Thanks for your patience. I do believe the search assistent problem is solved, however as you now know the is this LSP dillema.

    Your instructions were clear and well appreciated, the LSPfix seemed the logical route to take based on the HJT discovery.
    Missing a step and acting on impulse taught a lesson of restraint.

    Ran HJT and neither C:\WINNT\system32\userinit.exe nor 010-Unknown file in Winsock LSP:C\winnt\system32\calsp.dll were listed to "fix" \userinit.exe -only shows in log21a.

    Now, I did find a copies of msafd.dll and rsvpsp.dll in the cache, however now what/where do I go?

    Not to confuse the issue but, is the application "winsockfix,exe" of any help?

    I'll await your reponse regarding this new issue and hope it isn't too much trouble.

    Thanks!

    BT
  18. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    BTwonderz

    rnr20, msafd and rsvpsp.dll can be found in c:\winnt\servicpackfiles\i386
    winrnr.dll in c:\winnt\system32\dllcache
    Copy them into c:\winnt\system32 while in Safe Mode, then REBOOT.

    Calsp.dll does NOT belong on your PC.

    Your HJT-log is almost clean.
    Have HJT fix: C:\WINNT\system32\userinit.exe but DON't delete that file.

    You could try that winsockfix program, but AFAIK is only needed if you have lost your internet-connection. And success with it is not always guaranteed. It won't do any damage, so try it.
  19. BTwonderz

    BTwonderz Newcomer, in training

    Re: "almost clean"

    RealDarkStuff,
    winnt\servicepackfiles [does not exist-as named] nor can mr20 be found
    however there is a:
    winnt\drivercache\j386
    msafd & rsvpsp & winrnr.dll ARE in \system32...manually deleted calsp.dll

    see enclosed
    HJT 25
    -log before scanning and "fix" with nothing checked
    HJTb
    -log after "fix" with nothing checked.
    could not find...userinit.exe

    BTW, I DO NOT have internet connection since LSPfix of msafd.dll & rsvpsp.dll

    BT
  20. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    It's RNR20.DLL find it attached in a ZIP-file (rightclick/save as to get it)

    Try that winsockfix program after you have copied rnr20.dll into \system32

    Your logs are clean.

    If all else fails you may need to do a repair through the console.
    See Readme at top of Windows OS forum

    Attached Files:

  21. Graye

    Graye Newcomer, in training

    Help!

    okay i really don't know much about computers at all but i know i have this three virus-things (Home Search Assistant and SearchExtender and Shopping Wizard). i've been trying to remove them by the add/remove programs thing on windows, but the same thing happened that did with mhopeck. someone i know who knows computers told me to download hijackthis. i did and it told me to put my log on a forum for help so here i am. could someone please help me out with this?

    (i cannot paste the log apparently though, because it says there are URLs and i need to remove them)












    -Graye
  22. BTwonderz

    BTwonderz Newcomer, in training

    Re: ""Pasting"" HJT Log

    Graye,
    You don't actually "paste" the log.
    You must first convert the .log file to a .txt file.
    Then, when you post a message there is an area called "additional options"
    within that you will see a form button called "manage attachments"
    after clicking that you are taken to a screen that will ask you to "browse"
    for that file.
    Once you've found the converted .txt file, select it; then you press the button
    "upload". This will attach it to your message and the tech can then read it and get back to you on what to do next.
    It is strongly suggested to only upload one (1) HJT file at a time to properly diagnos your problem.
    Hope this helps,

    BT
  23. BTwonderz

    BTwonderz Newcomer, in training

    Re: RNR20

    realblackstuff,

    The rnr.dll is in system\32. Is this the only place it should be?

    Tried the winsockfix--didn't work [just hit "Fix"]
    I believe I'll look for threads regarding that; re: protocols, tcip, etc.
    and the win OS forum to investigate my next task.

    Thanks for the assistance in cleaning that horrible mess.

    BT

  24. Graye

    Graye Newcomer, in training

    aah i see. thanx, BTwonderz.

    so can anyone help?
  25. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Hello and welcome to Techspot.

    Before you do anything take a look at the following thread by RBS and follow the instructions.

    How to remove begin2search / coolwebsearch

    It Might be a good idea to print it out.

    Regards Howard :wave: :wave:
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.