I recently used an anti-spyware program to remove a heap of parasites from my
computer, one of which redirected the "search from internet explorer address
bar" feature to something like incredifind.com (I normally have it using MSN,
with "display results and go to most likely site")
Good: searching from the address bar no longer redirects to incredifind.com
Bad: searching from the address bar turns the search query into
"
http:///? " followed by the url-encoded search query (including the
keyword "Search" which is normaly deleted)
I've compared all relevent registry keys I could find with another computer
that does work, and they match. Any ideas?
Taneth,
Which anti-spyware product did you run? Some spyware is best handled by
multiple products - and they're all free, so you have nothing to lose but time.
HijackThis may be the key product here.
Start by downloading each of the following free tools:
AdAware <
http://www.lavasoftusa.com/>
CWShredder <
http://www.majorgeeks.com/download4086.html>
HijackThis <
http://www.majorgeeks.com/download.php?det=3155>
LSP-Fix and WinsockLSPFix <
http://www.cexx.org/lspfix.htm>
Spybot S&D <
http://www.safer-networking.org/index.php?page=download>
Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. AdAware and Spybot S&D have install routines - run them.
The other downloaded programs can be copied into, and run from, any convenient
folder.
Start by closing all Internet Explorer and Outlook windows, and running
CWShredder. Have the latter fix all.
Next, run AdAware. First update it ("Check for updates now"), configure for
full scan (<
http://www.lavahelp.com/howto/fullscan/>), then scan ("Start" - "Use
custom scanning options" - "Next"). When scanning finishes, select everything
identified a problems, and hit Next again.
Next, run Spybot S&D. First update it ("Search for updates"), then run a scan
("Check for problems"). Trust Spybot, and delete everything ("Fix Problems")
that is displayed in Red.
Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<
http://forums.spywareinfo.com/index.php?showtopic=227>
Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and post a link to your forum posts, here):
Aumha: <
http://forum.aumha.org/index.php>
Net-Integration: <
http://forums.net-integration.net/>
Spyware Info: <
http://forums.spywareinfo.com/>
Spyware Warrior: <
http://spywarewarrior.com/index.php>
Tom Coyote: <
http://forums.tomcoyote.org/>
If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.