Home Search Assistant...

By mhopeck ยท 80 replies
Aug 3, 2004
  1. geoffworks76

    geoffworks76 TS Rookie

    search assistant gone? but more problems...

    so i seem to have killed search assistant, but now i have problems with windows altogether...my add/remove programs no longer exists.

    no icons appear and across the top is printed the following:

    Change or Remove ProgramsAdd New ProgramsAdd Remove Windows ComponentsSet Program Access and Defaults

    one line across the top that is what it reads...

    further, when on the internet, many of the textual links to futher information no longer work. this is especially a pain in yahoo, i cannot delete, forward, reply, etc. through the button.

    any answers out there?
  2. geoffworks76

    geoffworks76 TS Rookie

    i've sorted out the problems with home search assitant, reinstalled windows 2000 and things are CLOSE to normal, HOWEVER...now windows installer keeps informing me of an installing in progress, but i am not installing anything. what the hell?

    turns out it wasn't me installing anything...i was hit again. a few precious moments my notebook and i were one again...and now we are screwed once more. here is my hijack this log...
  3. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Obviously, you did not read my post!
    It says clearly, STOP using IE.
    Having IE 5.0 on your PC also shows irresponsibility. Current would be IE 6.00/SP1.

    My advise:
    reinstall again, first W2K/SP4, then IE6/SP1, then Firefox 1.0, then the free AVG7, then the free Agnitum Outpost 1.0 Firewall.
    Don't bother with that Norton/Symantec junk you have.

    Only now should you go on the internet, straight to MS Windows update, and install EVERY available update for W2K and IE (except .NET and MediaPlayer 10).
    Next update AVG7. Then install and update Adaware and Spybot. Let Spybot immunize your system.

    And from now on DON'T use the effing IE, but Firefox instead.
    Do NOT install any searchbars from anywhere, not even from Google. And stay away from any dodgy websites.
    Only YOUR disciplin will keep your PC up and running.
  4. geoffworks76

    geoffworks76 TS Rookie

    i've followed your advice and SO FAR, it is a much more pleasureable internet experience. i don't claim to be computer savvy, but i know good advice when i see it. thanks!
  5. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    I may have sounded a bit harsh, but I am glad I got you sorted.
    Keep up the good work and the Internet will stay a breeze!.
  6. hasian

    hasian TS Rookie


    I am one of those computer illiterate people. i've tried doing what you guys have said to do, but i cant figure it out! help please!! I dotn know how to to delete the Home search thing!

    I am one of those computer illiterate people. And I got that stupid Home assistant thing. I downloaded the hijack thing but I dont know what program to open it as! HELP PLEASE!!
  7. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

  8. xojie

    xojie TS Rookie

    continual problems

    hey, ive read the forum on the home search assistant, and the link that was stated, got the programs and such, but i think i keep getting lost somewhere in there. ill provide my hijack log, but otherwise i have no clue what to do ,lol
  9. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503


    First thing, MOVE HJT into its OWN directory, NOT in your Desktop.

    Reboot in Safe Mode

    Kill these running processes first with Task Manager, if you can:

    With NO other programs open, run HJT and let it FIX:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cwsel.dll/sp.html#93256
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us4nb.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {E6729088-50CA-1D40-3B9D-AA2D52D24BF7} - C:\WINDOWS\system32\ipyn32.dll
    O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
    O4 - HKLM\..\Run: [javala.exe] C:\WINDOWS\system32\javala.exe
    O4 - HKLM\..\Run: [7.tmp] C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe 0 10001
    O4 - HKLM\..\Run: [7.tmp.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\7.tmp.exe 0 10001
    O4 - Global Startup: Windows Timer.hta
    O16 - DPF: ChatSpace Full Java Client -
    O16 - DPF: {2B36F775-8CF5-4489-B454-2D1B80984CF2} (FXPluginCtl Object) - http://www.powerflasher.de/plugin/powerres.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CF2D61ED-985C-4DC8-910C-B635E43CB1B5} (FTCChat Control) - http://funteenchat.com/FTCChat.cab
    O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\winhh32.exe

    When done, delete the crap, whatever is left:
    C:\DOCUME~1\Owner\LOCALS~1\Temp (anything in this directory!)
    C:\Program Files\WildTangent (anything in this DIR including the DIR itself)
    Timer.hta (wherever that is)
  10. scsa316tt

    scsa316tt TS Rookie

    Home Search Assistent, Search Extender, and Shopping Wizard

    Hi I am new to this forum thing but I really need expert help on getting rid of these three programs I don't know how to uninstall them and I don't even know how they got on my computer in the first place. I tried using Ad-Aware but it don't even detect it. I also just bought Spy Sweeper by webroot but that don't get rid of them either please help.
  11. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    And based on what are we supposed to do that? Chrystal ball technology? Mind control?
  12. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503


    If you take the finger out and READ this and similar posts, you would have found this thread LONG ago:
    How to remove Begin2Search / Coolwebsearch

    Go there and follow exactly, then report back with HJT.txt if there are still problems.
  13. BTwonderz

    BTwonderz TS Rookie

    I've been at this ALL DAY

    Hate to bother y'all, however I've been victimized by the home search ASSistEnt, ShopppingWizard and Search ASSistent sh**t too.
    Please find enclosed the txt [sorry tried to link]. It's at the bott of this mssg.

    Thanks in advance.


    See hijack list enclosed

    This is one daunting task. I've tried a number of suggestions offered here [and around the net] and STILL no removal of this beast. I enclose the h'jack log for your perusal. Assistance would br GREATLY appreciated.
  14. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Go here first and follow EXACTLY
    How to remove Begin2Search / Coolwebsearch
    Most instructions are there.

    After all that, boot again in safe mode and run HJT as described. Let it "fix" (if still there):

    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {B8F62905-CBFE-CF1D-F738-6EC2FD2913F4} - C:\WINNT\system32\apprl32.dll
    O4 - HKLM\..\Run: [WinampAgent] "C:\~Downloads\BTdownloads\WinAmp\winampa.exe"
    O4 - HKLM\..\Run: [javaxc32.exe] C:\WINNT\javaxc32.exe
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

    Afterwards, delete the bold file if still there.
  15. BTwonderz

    BTwonderz TS Rookie

    Did as was told....and more...Duh!

    Well everything seems to be in order the bug appears to have gone, however.
    I inadvertantly removed necessary dll files from winsock LSP:
    calsp.dll (which showed up in the HJT scan, so thought to be safe.
    msafd.dll (which apparently is required to get online [on another PC right now]
    rsvpsp.dll (not sure of the consequences of that one yet)
    Is there any way to rectify my mistake?
    I assume a reinstall of OS would be starters?!
    Sorry for the hassle.


    Removed aklsp.dll yet HJT picks up more [see screenshot new HJTlog]
    Is it safe to remove the remaining? { I goofed here and deleted some}
    I am now "FireFoxed"
    ...And it appears I still have it tracking my every move.

    HJT cannot remove winsock LSP aklsp.dll. -It does, however refer me to
    cexx-org-lspfix-h t m for that program to remove it.
    Manual deletion is not possible -says it is running. See screenshots.

    Outside of that I enclose my latest HJT log and appreciate all the help.
    I PRAY we can get rid of this awful nuisance.


    PS: I'll update my profile for a better handle on my system.
  16. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503


    If I tell people to follow instructions EXACTLY, then that's what they SHOULD do.
    You would have found the O10 - Unknown file in Winsock LSP: error message, including instructions on how to FIX them.
    Having 2 of those, means you have to do it twice, once for each file. You are the first one to have 2, sorry if I overlooked that.
    See if you can get those deleted (why?) files back from your CD, the dll-cache on your HD or from someone else with (non-infected) XP.

    Anyway, based on hjt20.txt, boot in safe mode, let HJT "fix" this:

    Run the LSPFIX for both
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\aklsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll

    Based on hjt21.txt, boot in safe mode and only "run" HJT:

    If this is still around, let LSPFIX this:
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll

    Don't try to confuse the issue, only report 1 log at the time. Fix that, then report back with another, if you still have problems.
  17. BTwonderz

    BTwonderz TS Rookie

    Following instructions


    Thanks for your patience. I do believe the search assistent problem is solved, however as you now know the is this LSP dillema.

    Your instructions were clear and well appreciated, the LSPfix seemed the logical route to take based on the HJT discovery.
    Missing a step and acting on impulse taught a lesson of restraint.

    Ran HJT and neither C:\WINNT\system32\userinit.exe nor 010-Unknown file in Winsock LSP:C\winnt\system32\calsp.dll were listed to "fix" \userinit.exe -only shows in log21a.

    Now, I did find a copies of msafd.dll and rsvpsp.dll in the cache, however now what/where do I go?

    Not to confuse the issue but, is the application "winsockfix,exe" of any help?

    I'll await your reponse regarding this new issue and hope it isn't too much trouble.


  18. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503


    rnr20, msafd and rsvpsp.dll can be found in c:\winnt\servicpackfiles\i386
    winrnr.dll in c:\winnt\system32\dllcache
    Copy them into c:\winnt\system32 while in Safe Mode, then REBOOT.

    Calsp.dll does NOT belong on your PC.

    Your HJT-log is almost clean.
    Have HJT fix: C:\WINNT\system32\userinit.exe but DON't delete that file.

    You could try that winsockfix program, but AFAIK is only needed if you have lost your internet-connection. And success with it is not always guaranteed. It won't do any damage, so try it.
  19. BTwonderz

    BTwonderz TS Rookie

    Re: "almost clean"

    winnt\servicepackfiles [does not exist-as named] nor can mr20 be found
    however there is a:
    msafd & rsvpsp & winrnr.dll ARE in \system32...manually deleted calsp.dll

    see enclosed
    HJT 25
    -log before scanning and "fix" with nothing checked
    -log after "fix" with nothing checked.
    could not find...userinit.exe

    BTW, I DO NOT have internet connection since LSPfix of msafd.dll & rsvpsp.dll

  20. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    It's RNR20.DLL find it attached in a ZIP-file (rightclick/save as to get it)

    Try that winsockfix program after you have copied rnr20.dll into \system32

    Your logs are clean.

    If all else fails you may need to do a repair through the console.
    See Readme at top of Windows OS forum

    Attached Files:

  21. Graye

    Graye TS Rookie


    okay i really don't know much about computers at all but i know i have this three virus-things (Home Search Assistant and SearchExtender and Shopping Wizard). i've been trying to remove them by the add/remove programs thing on windows, but the same thing happened that did with mhopeck. someone i know who knows computers told me to download hijackthis. i did and it told me to put my log on a forum for help so here i am. could someone please help me out with this?

    (i cannot paste the log apparently though, because it says there are URLs and i need to remove them)

  22. BTwonderz

    BTwonderz TS Rookie

    Re: ""Pasting"" HJT Log

    You don't actually "paste" the log.
    You must first convert the .log file to a .txt file.
    Then, when you post a message there is an area called "additional options"
    within that you will see a form button called "manage attachments"
    after clicking that you are taken to a screen that will ask you to "browse"
    for that file.
    Once you've found the converted .txt file, select it; then you press the button
    "upload". This will attach it to your message and the tech can then read it and get back to you on what to do next.
    It is strongly suggested to only upload one (1) HJT file at a time to properly diagnos your problem.
    Hope this helps,

  23. BTwonderz

    BTwonderz TS Rookie

    Re: RNR20


    The rnr.dll is in system\32. Is this the only place it should be?

    Tried the winsockfix--didn't work [just hit "Fix"]
    I believe I'll look for threads regarding that; re: protocols, tcip, etc.
    and the win OS forum to investigate my next task.

    Thanks for the assistance in cleaning that horrible mess.


  24. Graye

    Graye TS Rookie

    aah i see. thanx, BTwonderz.

    so can anyone help?
  25. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Before you do anything take a look at the following thread by RBS and follow the instructions.

    How to remove begin2search / coolwebsearch

    It Might be a good idea to print it out.

    Regards Howard :wave: :wave:
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...