search engines

[Joah]

Whenever I try to do a search on any search engine, my
explorer pauses, looks like the program will close (end
now) and then after about a minute completes its search.
Please email me if you can help me.

Thanks,
Josh

 

[Jan Il]

Hi Joah

Try this first:

Unable to search from IE 6.0 address bar

From Internet Explorer click on tools>internet options>advanced. Scroll down
to "search from the address bar" and check appropriate boxes. Another way is
to put the Google tool bar on I.E. Go to www.google.com and click on
"services and tools" then click "google toolbar". I don't know whose search
engine is best. I use Google.
In fact I didn't know about the search from address bar of I.E. until I read
your post.

Also, check the Registry to see if this file is there. Sometime during
removal of hijackers or spyware files in the Registry can get corrupted or
removed as well. If not, try adding this line to this part of the registry.

(watch for the wrap, it should be all on one line)

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

or.............

*************************************************************
Can't Search From Addres Bar

Try the following Courtesy of Tony Klien - MS MVP.

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all files',
and doubleclick.
Answer 'yes' when prompted to add the contents of Search.reg to the
Registry:

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

This will restore the Windows defaults for a whole lot of Search related
registry entries.
**************************************

Hope this helps.

Jan

 

[Jan Il]

Hi Joah

If the first steps did not resolve your problem, then do the following.

It is likely you have parasites, spyware, adware, malware, or hijackware on
your system causing the problem, which your antivirus will not detect, as it
does not have the same definitions. Download and install, then you *MUST*
update the programs prior to running to be sure they have the latest
definitions, then run the programs below. They are free and very effective.
Be sure to run both SpyBot and Adaware, as what one does not detect the
other may. It is important that you do all the steps and follow all
directions carefully:

You can go to the links below to check your system for parasites
http://aumha.org/a/noads.htm
http://inetexplorer.mvps.org/parasite.htm

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm

It is important that you run the programs in the order that they are listed
here. The first three programs will clear your machine of all other items so
that you can have a clear HiJackThis Log for the experts to read and analyze
for you.

(NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them. After you have IE access again, update all programs where
possible to get the latest definitions and run them again to be sure there
are no lingering items on the system.

CWShredder: Free
http://tinyurl.com/2l9kl
or
http://www.majorgeeks.com/download4086.html

SpyBot Search & Destroy: Free
http://download.com.com/3000-8022-10289035.html?tag=lst-0-2
or
http://majorgeeks.com/download2471.html

AdAware: Free
http://www.lavasoftusa.com/support/download/
or
http://www.majorgeeks.com/downloads31.html

(If needed: AdAware Manual updates only):
Scroll down to Updates Available -
http://lavasoft.element5.com/support/download

HiJackThis: - Free

Go to
http://computercops.biz/downloads-cat-14.html ,
or
http://tinyurl.com/2oce8
and download HiJackThis. Unzip to a folder other than your Desktop or the
Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open a the copy of your log in NotePad and made a copy. Then you can go here
to post you log:
http://forum.aumha.org/ or http://forums.spywareinfo.com/

<<DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer


Here is information on how to help protect your system:

Practice Safe Hex
http://www.claymania.com/safe-hex.html

"So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051

This program helps control parasites, spyware, adware, and malware that may
get on your system:

SpywareBlaster: Free
http://www.javacoolsoftware.com/spywareblaster.html

Hope this helps.

Jan

 

[Rich]

I believe we have the same exact problem. Whenever I go
to google.com, yahoo or whatever and enter a search topic,
click search, it freezes or hangs. The result will be
posted in 30 secs or so but this is getting very
annoying. I have tried everything that your responder has
said to do with no luck whatsoever. I'm an avid adaware
and spybot user so my system is always clean. The
parasite websites showed nothng as well. If you get an
answer to this aggrevating problem please let me know as
if I find out, I will return the favor.

Regards,
Rich

 

[Jan Il]

Hi Rich

What Windows version are you running? What firewall do you have? What
anti-virus program do you have? What other programs do you have running in
the background? It seems that this problem is prominent with those who are
going to Yahoo, Google and such, so there may be some similar activity
connection. It may not be the only reason, but, it could be one. It can also
be any number of malware out there that SpyBot and AdAware won't detect, or
only by running them in Safe Mode. Have you tried running SpyBot and AdAware
and HiJackThis in Safe Mode?

HTH

Jan

 

[Rich]

Jan,

I have tried those programs in safe mode. They showed no
errors and/or spyware. MY OS is WinXP Pro (w/all current
updates) and my antivirus program is Norton Corporate
Edition. The only program I normally keep in the
background is AOL's Instant Messenger. I have even closed
these programs to test if they were creating problems
while using the search function on the search engines.
They did not affect the result. If I search for something
on the search engines (I've tried them all Altavista,
Yahoo, MSN, Google etc...) it appears that IE decides to
freeze/hang for 30 seconds before giving me my results
page. I have also noticed that is sucks up about 30%
processing power(mine is a P4 3.0 ghz) while freezing. If
I close the window(closing and minimizing are the only 2
options I have, nothing else is clickable), it gives my
the "IE is not responding" deal. So I click "END NOW"
and before I send and error report, I like to see what it
sends to microsoft. And here is what the error report
says:

"szAppName : iexplore.exe szAppVer : 6.0.2800.1106
szModName : hungapp
szModVer : 0.0.0.0 offset : 00000000"

I have viewed as much as I could in this public forum and
it appears that there are a few posts to this same problem
everyday. Is this an error on Microsoft or is it on my
part? Should I just wait till Microsoft hopefully patches
this issue or do you have another trick up your sleeve?
You are the only person I have came in contact with that
has posted any responses to attempt to solve this problem.

Many Thanx,

Rich

 

[Rich]

By the way, this problem has only occured as of three
weeks or so ago...

Regards,
Rich

 

[Jan Il]

Hi Rich

Jan,

I have tried those programs in safe mode. They showed no
errors and/or spyware. MY OS is WinXP Pro (w/all current
updates) and my antivirus program is Norton Corporate
Edition. The only program I normally keep in the
background is AOL's Instant Messenger. I have even closed
these programs to test if they were creating problems
while using the search function on the search engines.
They did not affect the result. If I search for something
on the search engines (I've tried them all Altavista,
Yahoo, MSN, Google etc...) it appears that IE decides to
freeze/hang for 30 seconds before giving me my results
page. I have also noticed that is sucks up about 30%
processing power(mine is a P4 3.0 ghz) while freezing. If
I close the window(closing and minimizing are the only 2
options I have, nothing else is clickable), it gives my
the "IE is not responding" deal. So I click "END NOW"
and before I send and error report, I like to see what it
sends to microsoft. And here is what the error report
says:

"szAppName : iexplore.exe szAppVer : 6.0.2800.1106
szModName : hungapp
szModVer : 0.0.0.0 offset : 00000000"

I have viewed as much as I could in this public forum and
it appears that there are a few posts to this same problem
everyday. Is this an error on Microsoft or is it on my
part? Should I just wait till Microsoft hopefully patches
this issue or do you have another trick up your sleeve?
You are the only person I have came in contact with that
has posted any responses to attempt to solve this problem.

Many Thanx,

Your're very welcome, Rich, I'm sorry that I could not be of more help. I
have one last suggestion, and I'll also put it in your new post, but, I was
having problems just a couple of days ago with my IE home page being slow to
load, and it would hang in the progress bar, but, the page I went to would
load ok. So, I asked a question at the AumHa forum, where I am a Gold Club
Member, to see if they had any idea what was making it hang so. James
Fisher, MS MVP, told me about the Speed Test and Tweak Test that helped with
my IE. I didn't think of it sooner, and I don't really know how to explain
all myself,but, here is the link to that thread, which is still to some
extent in monitor mode, and if you have any questions or want to try the
tests yourself, please feel free. James will be happy to help you. My Avatar
is the Smiley Sunshine.

Scroll down to this part, or read the whole wazoolie :
......."go to this site and use the Speed Test and Tweak Test tools. "
http://www.dslreports.com/tools
http://forum.aumha.org/viewtopic.php?t=5833&start=0&postdays=0&postorder=asc&highlight=

I'll peek in and see if I can help too. Good luck.

Jan

 

[Jim Byrd]

Hi Jan - Just an FYI in case you're unaware of it - http://www.cablenut.com/
Be sure to get the Add On package also for 98/2000/XP Highly recommended.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jim Byrd]

Hi Rich - I don't think there's a definitive answer to this one yet, since
there are a number of possible causes. First, clean up (delete) your
Temporary Internet Files (including Off-Line content) and your History. If
that doesn't help, you can check the following concerning ActiveX components
trying to reach defunct servers. If these particular ones don't show up,
check for any other anomalous entries:


Take a look in %SYSTEMDRIVE%\%SystemRoot%\Downloaded Program Files (these
are ActiveX components), and see if you have something there called Tracker
Class. If so, right click and click Remove (don't just delete it). This is
a hi-jack program that's trying to reach a server that's no longer working,
so it hangs up.

There are some others that are similar in effect also, so if you don't have
Tracker Class, right click on each thing in this folder then select
Properties. The Codebase line will often give you a clue as to where
something came from. If it looks like it might not belong, try Remove.
Things like Sun Java Runtimes and Macromedia stuff like Shockwave or Apple
Quicktime are normal, so use some judgement about what you eliminate.
Mostly you'll be asked to re-download them if you Remove something that's
actually needed.

Also check in Add-Remove Programs for Surfchoice 1.1 and remove it. It is
also tracker software to a defunct server.

Additonal important information about removing ActiveX controls is in the
following Microsoft articles:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q240797
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q154850


See if that helps.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jan Il]

Hi Jim

Hi Jan - Just an FYI in case you're unaware of it -
http://www.cablenut.com/ Be sure to get the Add On package also for
98/2000/XP Highly recommended.

No, I was not aware of it. Thank you very much for the information, I truly
appreciate it.

Jan

 

[Rich]

I haven't used the DR.TCP program in a while. I ran the
report and found that I needed some minor tweaking. My
pages overall load a lot faster. Still have the same
problem though. I read the post you listed for me to read
but it is not the problem I have. This problem only
occurs on search engine pages while using the search
function. I get no progress bar usage or anything. The
whole page just freezes. Thanx for your help.

Rich

 

[Rich]

Jim,

I looked into the ActiveX route. I found some things that
didnt belong and I removed them. I check for the
program "Surfchoice" as well, I did not have it. After
removing the ActiveX problems, I still seem to have the
same problem. I have a cable connection, just tested the
lines and all appears fine. My pages load very fast but
for some reason when I enter something on a search engine
and click "Search", IE just loves to freeze up for 10-20
seconds and suck up about 30% of my processing power.
Thank you for the help though.

Regards,
Rich

 

[Jim Byrd]

OK, Rich, try this. Download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your default Search functionality. You'll have to manually re-select any
Customizations you may have had, however. See if that helps, since it
appears to be particularly associated with the Search functionality. If
that doesn't help:

You said you'd run AdAware and SpyBot, but you didn't mention CWS. Try
this. Don't omit any steps:

If CWShredder doesn't fix it, then see AdAware, SpyBot, and HijackThis,
below, in that order. Do the following:



Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)


The process of removing certain malware may kill your internet connection.
If this should occur, this program, LSPFIX, will enable you to regain your
connection. The process of removing certain malware may kill your internet
connection. If this should occur, this program, LSPFIX, will enable you to
regain your connection.


Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up if
you're on ME or WinXP. It's best to perform CWShredder (and most other
malware fixers too) from Safe mode and then reboot. AFTER cleaning things
up, then you can disable and then re-enable System Restore. See ********
below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.



However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

Both of these programs should normally be UPDATED and run after doing any
other fix such as CWShredder and, as a minimum, normally at least once a
week.



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

or Jim Eshelman's site here: http://forum.aumha.org/



Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended


Finally, go to Windows Update and ensure that ALL Critical updates are
installed.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In