Incredifind!!!!!

I

I give up!

Running WINXP and IE 6.0 with various updates:

First I went to Add and Remove files, but couldn't find
Incredifind, so I searched my computer for Incredifind
and deleted everything that related to it. Still had the
problem. Took me a while to figure a work around in
order to the search the Internet to find if there was a
workaround for Incredifind and followed this information:

Manual removal
Please follow the instructions below if you would like to
remove IncrediFind manually. Please notice that you must
follow the instructions very carefully and delete
everything that is mentioned. In most cases the removal
will fail if one single item is not deleted. If
IncrediFind remains on your system after stepping through
the removal instructions, please double-check by stepping
through them again.
1. Start the registry editor. This is done by
clicking Start then Run. (The Run dialog will appear.)
Type regedit and click OK. (The registry editor will
open.)
2. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \
CLSID \ {5D60FF48-95BE-4956-B4C6-6BB168A70310}', if it
exists.
3. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft
\ Windows \ CurrentVersion \ Explorer \ Browser Helper
Objects \ {5D60FF48-95BE-4956-B4C6-6BB168A70310}', if it
exists.
4. Exit the registry editor.
5. Restart your computer.
6. Start Windows Explorer (WINDOWS Explorer, not
INTERNET Explorer. Go to "Start", then "Accessories",
then click on "Windows Explorer") and delete:
%ProgramsDir%\IncrediFind\BHO\incfindbho.dll
Note: %ProgramsDir% is a variable (?). By default, this
is C:\Program Files.
7. Start Microsoft Internet Explorer.
8. In Internet Explorer, click Tools -> Internet
Options.
9. Click the Programs tab -> Reset Web Settings.
Problems uninstalling? Click here.
........................
Did all of that, but when it came to step 6., finding the
program to delete, of course it had already been deleted.

I continue to have the problem. I performed a search
again and find nothing under "Incredifind". Now I search
for "BHO" and one file is found: hosts.bho filed under
C:\WINDOWS\system32\drivers\etc (modified 5/8/2004) and
I'm wondering if that could be the root of the problem,
although none of the Spyware removed it from my system.

So okay, I performed the work around that Shenan Stanley
suggested as follows............... Empty your Temporary
Internet Files and shrink the size it stores to about
80 to 120MB (seems to be an optimal size for the normal
user)

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet
Files" section,
do the following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the
"Amount of disk space to use:" to something between
80MB
and 120MB. (Betting it is MUCH larger right now.)
- Click OK.
- Click on "Delete Files" and select to
"Delete all offline contents" (the checkbox) and click
OK. (If you had a LOT, this could take 2-10 minutes or
more.)
- Once it is done, click OK, close Internet Explorer
- Re-open Internet Explorer.
............

I have a firewall. My e-mail is controlled by Norton
(which is set to make automataic updates) and I run Ad-
Aware once a week. So now, thanks to Shenan's
recommendation, I've also downloaded Spybot. Now another
problem...Spybot is suggesting I remove 3 MS "holes" in
ports...scary business so I haven't removed them. Should
I?

Sorry for the long oration, but it's shorter than the 7
hours I've invested so far...THANKS IN ADVANCE FOR YOUR
ADVICE!
 
S

Shenan Stanley

I said:
Running WINXP and IE 6.0 with various updates:

First I went to Add and Remove files, but couldn't find
Incredifind, so I searched my computer for Incredifind
and deleted everything that related to it. Still had the
problem. Took me a while to figure a work around in
order to the search the Internet to find if there was a
workaround for Incredifind and followed this information:

Manual removal
Please follow the instructions below if you would like to
remove IncrediFind manually. Please notice that you must
follow the instructions very carefully and delete
everything that is mentioned. In most cases the removal
will fail if one single item is not deleted. If
IncrediFind remains on your system after stepping through
the removal instructions, please double-check by stepping
through them again.
1. Start the registry editor. This is done by
clicking Start then Run. (The Run dialog will appear.)
Type regedit and click OK. (The registry editor will
open.)
2. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \
CLSID \ {5D60FF48-95BE-4956-B4C6-6BB168A70310}', if it
exists.
3. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft
\ Windows \ CurrentVersion \ Explorer \ Browser Helper
Objects \ {5D60FF48-95BE-4956-B4C6-6BB168A70310}', if it
exists.
4. Exit the registry editor.
5. Restart your computer.
6. Start Windows Explorer (WINDOWS Explorer, not
INTERNET Explorer. Go to "Start", then "Accessories",
then click on "Windows Explorer") and delete:
%ProgramsDir%\IncrediFind\BHO\incfindbho.dll
Note: %ProgramsDir% is a variable (?). By default, this
is C:\Program Files.
7. Start Microsoft Internet Explorer.
8. In Internet Explorer, click Tools -> Internet
Options.
9. Click the Programs tab -> Reset Web Settings.
Problems uninstalling? Click here.
.......................
Did all of that, but when it came to step 6., finding the
program to delete, of course it had already been deleted.

I continue to have the problem. I performed a search
again and find nothing under "Incredifind". Now I search
for "BHO" and one file is found: hosts.bho filed under
C:\WINDOWS\system32\drivers\etc (modified 5/8/2004) and
I'm wondering if that could be the root of the problem,
although none of the Spyware removed it from my system.

So okay, I performed the work around that Shenan Stanley
suggested as follows............... Empty your Temporary
Internet Files and shrink the size it stores to about
80 to 120MB (seems to be an optimal size for the normal
user)

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet
Files" section,
do the following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the
"Amount of disk space to use:" to something between
80MB
and 120MB. (Betting it is MUCH larger right now.)
- Click OK.
- Click on "Delete Files" and select to
"Delete all offline contents" (the checkbox) and click
OK. (If you had a LOT, this could take 2-10 minutes or
more.)
- Once it is done, click OK, close Internet Explorer
- Re-open Internet Explorer.
...........

I have a firewall. My e-mail is controlled by Norton
(which is set to make automataic updates) and I run Ad-
Aware once a week. So now, thanks to Shenan's
recommendation, I've also downloaded Spybot. Now another
problem...Spybot is suggesting I remove 3 MS "holes" in
ports...scary business so I haven't removed them. Should
I?

Sorry for the long oration, but it's shorter than the 7
hours I've invested so far...THANKS IN ADVANCE FOR YOUR
ADVICE!
Click to expand...

In my opinion (and experience), unless you USE something like a P2P
application or GAIN/GATOR for some reason, the only harm Spybot S&D will do
(worse case, and it is bad) is (as a result of removing certain RELLY bad
guys) - mess up your internet connection. At which point the WinSock
entries get corrupted.

It doesn't happen often, but it does happen and the fix is here:
http://www.cexx.org/lspfix.htm

However, other than that glitch (and it may not even do that anymore and
thanks to RC5's registry backups and such, even if it does, it makes it
reversible.) I have always (on hundreds of heavily used and some heavily
infested system) trusted Spybot's decision (if it checks it, I remove it!)
 
I

I give up! -- Maybe there's still hope...

-----Original Message-----


In my opinion (and experience), unless you USE something like a P2P
application or GAIN/GATOR for some reason, the only harm Spybot S&D will do
(worse case, and it is bad) is (as a result of removing certain RELLY bad
guys) - mess up your internet connection. At which point the WinSock
entries get corrupted.

It doesn't happen often, but it does happen and the fix is here:
http://www.cexx.org/lspfix.htm

However, other than that glitch (and it may not even do that anymore and
thanks to RC5's registry backups and such, even if it does, it makes it
reversible.) I have always (on hundreds of heavily used and some heavily
infested system) trusted Spybot's decision (if it checks it, I remove it!)
Click to expand...
Thanks SO MUCH, Shenan! I went to
http://www.cexx.org/lspfix.htm
and was directed back to www.cexx.org ...can you please
tell me what to click on from there?
 
G

Guest

Wow, Shenan, I don't know what else to do. Although I
had Ad-Aware already installed, I also installed and ran
each of the following programs:
Spybot S&D
SpySweeper
BHODemon
TZ Spyware...and finally
HijackThis! -- where I went to their website to receive
their instructions for which items to remove.

I made all the suggested deletions and saved everything
in quarantine, but I still can't get my browser to direct
correctly.

I entered a search for "asd" and it comes back with "The
Page can't be displayed" The address bar reads "http:///?
%20asd"

I installed and
ran "http://members.shaw.ca/techcd/WinsockXPFix.exe" and
then finally got "http://www.cexx.org/lspfix.zip" and
installed and ran it. I didn't feel qualified to make
any changes here, but this is what came up in the left
column:
File: mswsock.dll Description: Tcpip
File: winrnr.dll Description: NTDS
File: mswsock.dll Description: Network Location
Awarene...
File: nwprovau.dll Description: NWLink IPX/SPX/NetBIO...
File: mswsock.dll Description: (Protocol handler)
File: rsvpsp.dll Description: (Protocol handler)

Got anything else in your bag of tricks???
 
K

Kent W. England [MVP]

Wow, Shenan, I don't know what else to do. Although I
had Ad-Aware already installed, I also installed and ran
each of the following programs:
Spybot S&D
SpySweeper
BHODemon
TZ Spyware...and finally
HijackThis! -- where I went to their website to receive
their instructions for which items to remove.

I made all the suggested deletions and saved everything
in quarantine, but I still can't get my browser to direct
correctly.

I entered a search for "asd" and it comes back with "The
Page can't be displayed" The address bar reads "http:///?
%20asd"

I installed and
ran "http://members.shaw.ca/techcd/WinsockXPFix.exe" and
then finally got "http://www.cexx.org/lspfix.zip" and
installed and ran it. I didn't feel qualified to make
any changes here, but this is what came up in the left
column:
File: mswsock.dll Description: Tcpip
File: winrnr.dll Description: NTDS
File: mswsock.dll Description: Network Location
Awarene...
File: nwprovau.dll Description: NWLink IPX/SPX/NetBIO...
File: mswsock.dll Description: (Protocol handler)
File: rsvpsp.dll Description: (Protocol handler)

Got anything else in your bag of tricks???
Click to expand...

I just got rid of incredifind/SAHAgent today and I used lspfix to remove
six entries from the LSP stack related to SAHAgent. The .dll file was
named lsp.dll and it was in the first six or seven entries in the stack
that needed to be removed since each referenced lsp.dll. You have to
identify the lsp.dll from the entries under each registry key as per the
manual removal instructions from your first post
(http://www.spyany.com/program/article_spy_rm_SAHAgent.html) and then
tell LSPfix (after you represent that "you know what you are doing") to
move that lsp.dll to the remove column. Then it will remove the missing
references and fix the numbering on the other entries to restore your
protocol stack.

Spybot will show you the LSP stack from the Tools tab, but it doesn't
let you fix the stack (and neither does Spybot repair the LSP stack).

Don't remove any other .dll entries from the stack, just lsp.dll.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

incredifind 1
Internet Explorer will not access any webpages, need help 5
Incredifind Problem 1
Incredifind Problem 2
Incredifind 7
IE extension file 3
IE pop-up ads 5
Administrator privileges 3

Top