IE shuts down after search - clue

[Rick]

I believe something called xmlsearchenhancer is hosing up
the browser whenever a search is requested. I don't know
how I got infected with this and I don't know how to
remove it. Supposedly xmlsearchenhancer.com has a
removal tool available, but the link isn't working right
now.

Anyone have any ideas?

 

[PA Bear]

xmlsearchenhancer is most likely aFlingstone-variant hijackware/Downloader
Trojan.

Check your system for "hijackware":

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
http://aumha.org/a/parasite.htm

CoolWebSearch Chronicles
http://www.merijn.org/cwschronicles.html

You *must* seek updates for Ad-Aware, Spybot, etc., before each and every
use, even "right out of the box". But even then, they can't catch
everything. When all else fails, HijackThis
(http://www.merijn.org/files/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your files to http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**

Also update your virus definitions and then run a full system scan. From
now on, do both daily.
--
HTH...Please post back to this thread

~Robear Dyer (aka PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Protect Your PC
http://www.microsoft.com/security/protect/

 

[Rick]

Latest Spybot missed it, but Hijackthis nailed it.
Thanks!

 

[PA Bear]

And in less than 30 minutes no less! YW, Rick.

 

[Hopeless76]

It only took me 2 days, but I was able to track down the nasty bugger
from xmlsearchenhancer that's been giving my search results headaches.
Here it is:

C:\WINNT\system32\aypcgufp.dll

If anyone sees this driver when they run HijackThis, kill it!

Thanks for all of your help!

Matt

p.s. BHO's suck!

 

[PA Bear]

YW, Matt.

It only took me 2 days, but I was able to track down the nasty bugger
from xmlsearchenhancer that's been giving my search results headaches.
Here it is:

C:\WINNT\system32\aypcgufp.dll

If anyone sees this driver when they run HijackThis, kill it!

Thanks for all of your help!

Matt

p.s. BHO's suck!