Searching from Address Bar Stopped Working

[Burnthot]

Hi all. This was the only forum that looked like the right place for this.
If I should post somewhere else, please let me know.

I've run into a problem that I didn't see in the forum. Some time in the
last few days, the ability to search from the address bar in IE has stopped
working. For example, entering "lima beans" in the address bar and pressing
enter or clicking go gives me: http:///? "lima beans" in the address bar and
the "page cannot be displayed" result page.

I've run Adaware, Spybot, and done a virus scan (all up to date), and
nothing came up. I'm running IE 6.02 (completely up to date) on Windows XP
Home (also completely up to date). I do have "just display results in the
main window" checked under the advanced tab and have not changed any options
in IE. Also, I have not installed any new software or made any hardware
changes in the past couple of months.

I'd really appreciate some thoughts on how to fix this. I really liked
entering the search terms in the address bar and just hitting enter, and
having the results come up in the main window. I am comfortable with
editing the registry, if that's what it takes.

Thank you all for your time and help.

 

[Jan Il]

Hi Burnthot

Hi all. This was the only forum that looked like the right place for this.
If I should post somewhere else, please let me know.

I've run into a problem that I didn't see in the forum. Some time in the
last few days, the ability to search from the address bar in IE has stopped
working. For example, entering "lima beans" in the address bar and pressing
enter or clicking go gives me: http:///? "lima beans" in the address bar and
the "page cannot be displayed" result page.

I've run Adaware, Spybot, and done a virus scan (all up to date), and
nothing came up. I'm running IE 6.02 (completely up to date) on Windows XP
Home (also completely up to date). I do have "just display results in the
main window" checked under the advanced tab and have not changed any options
in IE. Also, I have not installed any new software or made any hardware
changes in the past couple of months.

I'd really appreciate some thoughts on how to fix this. I really liked
entering the search terms in the address bar and just hitting enter, and
having the results come up in the main window. I am comfortable with
editing the registry, if that's what it takes.

Thank you all for your time and help.

Try the programs below and see if they will help:

It is possible you may have parasites, spyware, adware,
malware, or hijackware on your system causing the problem.
Download and install, you *must* update the programs prior
to running to be sure they have the latest definitions, then
run the programs below. They are free and very effective. Be
sure to run both SpyBot and Adaware, as what one does
not detect the other may. It is important that you follow all
directions carefully:

CWShredder: Free
http://tinyurl.com/2l9kl
or
http://www.majorgeeks.com/download4086.html

SpyBot Search & Destroy: Free
http://download.com.com/3000-8022-10289035.html?tag=lst-0-2
or
http://majorgeeks.com/download2471.html

AdAware: Free
http://www.lavasoftusa.com/support/download/
or
http://www.majorgeeks.com/downloads31.html

AdAware Free:
Manual updates: Scroll down to Updates Available -
http://lavasoft.element5.com/support/download

(Check for Product Updates http://tinyurl.com/23lv4)


HiJackThis: - Free

Go to
http://computercops.biz/downloads-cat-14.html ,
or
http://tinyurl.com/2oce8
or
http://tinyurl.com/2atxk

and download HiJackThis. Unzip to a folder other than your Desktop or the
Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is. Most
of
what it lists will be harmless or even required, so DO NOT fix anything yet.

Open a the copy of your log in NotePad and made a copy. Then you can go here
to post you log:
http://forum.aumha.org/

Go to the HiJackThis section on the forum list and click to open. You can
post as a guest. It's also a good site to keep for reference. The experts
there will analyze the log and report back the results. Please allow at
least a few hours or a days time for a response.

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

Help with Hijackware & Scumware Information:

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html
also
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm

Here is information on how to help protect your system:

Practice Safe Hex
http://www.claymania.com/safe-hex.html

This program helps control parasites, spyware, adware, and malware that may
get on your system:

SpywareBlaster: Free
http://www.javacoolsoftware.com/spywareblaster.html

Hope this helps.

Jan

 

[Burnthot]

Thank you, Jan. I believe if you read my message again, you will seen that
I'd run those programs. Except for CWShredder and Hijack This. I've
received virus alerts when downloading them, so will not use them.

This is a function in IE that has obviously stopped working. I need to know
how to fix it. Thank you.

 

[Jim Byrd]

Hi Burnthot - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

You will need to show Hidden files first and then at the end disable System
Restore and then reboot your system in order to clear the malware garbage
from the backups after you've cleaned up. It's best to perform CWShredder
(and most other malware fixers too) from Safe mode and then reboot. After
cleaning things up, then you can disable and then re-enable System Restore.
See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jan Il]

Hi Jim

Hi Burnthot - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

You will need to show Hidden files first and then at the end disable System
Restore and then reboot your system in order to clear the malware garbage
from the backups after you've cleaned up. It's best to perform CWShredder
(and most other malware fixers too) from Safe mode and then reboot. After
cleaning things up, then you can disable and then re-enable System Restore.
See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode

HOW TO Enable Hidden Files

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning)

(WinXP)

(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended

Burnhot states below that "Except for CWShredder and Hijack This. I've
received virus alerts when downloading them, so will not use them."

I am wondering why he might get virus alerts from downloading these
programs. Would the variant cause this reaction to these files? I am
assuming they are zipped files. I ask as I have never seen or heard a poster
reporting this kind of virus reaction to these files before.

I would truly appreciate your information on this, as if indeed it is an act
of the variant, then the poster, and perhaps some others, may be reluctant
to use the tool that might be the cure because of it.

Thank you,

Jan

 

[Jan Il]

Hi Burnhot

Thank you, Jan. I believe if you read my message again, you will seen that
I'd run those programs. Except for CWShredder and Hijack This. I've
received virus alerts when downloading them, so will not use them.

This is a function in IE that has obviously stopped working. I need to know
how to fix it. Thank you.

I am very surprised at your getting a virus alert while downloading the
CWSHredder and HiJackThis. I am never heard of this before, and these
programs are very well trusted and highly recommended by the MS MVP's and
other experts and professionals here and on many other newsgroups and
forums. I am just really confused.

Would you please give a little more information on the type of message or
wording you received with these virus alerts? It might be very helpful. As
Mr. Byrd has also suggested, the problem appears to be one that may require
use of the CWShedder program to clean your machine in order to resolve your
problem. I am not an expert, but, if you read through the many other posts
here, Mr. Byrd, an MS MVP, is very knowledgeable of these matters, and is
very highly respected, and I have asked him please clarify if such a report
could be caused by the variant he mentioned, in order to throw people off of
using them, as it has you, when it may in fact be the ones they really need.
I have heard of some things that would prevent you from opening the website
of programs such as these, but, not causing a false virus alert.

I am in hopes that MR. Byrd will be able to clear up this matter so that you
will feel comfortable in using these programs, as they are very effective
tools for cleaning many types of junk, and often, the only way.

Thank you very much for letting us know of this situation, I truly
appreciate it.

Jan

 

[Burnthot]

I thank you all for your help. But please read my original post. I have
scanned for viruses and spy/mal/ad ware with updated programs. I am not
infected.

The only problem I have with IE6 is that I can no longer search from the
address bar. My home page has not been hijacked and there are no other
problems.

Thank you.
Brent

 

[Jim Byrd]

Hi Burnthol - CWS is a special breed of malware that in some cases isn't
detected by AdAware and/or SpyBot. You really need to run CWShredder, v.
158 or later. However, since you insist that you're clean, to answer your
specific request:

http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG will restore
your default Search functionality. You'll need to manually reinstall any
Customizations you may have had, however.

I would appreciate it very much if you would try and download CWShredder
from each of the following links and post back here any messages that you
receive regarding possible virus infections from each. Also, what AV are
you using which generates these messages? TIA

http://209.133.47.200/~merijn/files/CWShredder.exe (v.158, 144896 bytes)
http://www.zerosrealm.com/downloads/CWShredder.zip (this is currently
v.157, so don't use until UPDATED, 128877 bytes)
http://aumha.org/downloads/cwshredder.zip (v.158, 135421 bytes)
http://aumha.org/downloads/cwshredder.exe (v.158, 144896 bytes)



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jim Byrd]

Hi Jan - To answer your question in at least a general way, then Yes, there
is malware which will block the download of these programs. This is,
however, the first I've heard of any indicated virus infection associated
with downloading them. I've asked him in another post to test the download
of CWS from three sources, zipped and not, and to post back with some
additional info. We'll see what comes of that.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jan Il]

Hi Jim

Hi Jan - To answer your question in at least a general way, then Yes, there
is malware which will block the download of these programs. This is,
however, the first I've heard of any indicated virus infection associated
with downloading them. I've asked him in another post to test the download
of CWS from three sources, zipped and not, and to post back with some
additional info. We'll see what comes of that.

Thank you very much for the information. I would be most interested in
knowing the outcome of this test. As I have not heard of this as well, it
will be very interesting to see the results. I'll monitor this post for
your update.

Jan