Search help

[Reid]

several days ago I turned on my computer and my homepage
had changed. I reset it with no problem back to the msn
homepage. however, now I still have a couple of problems
i do not know how to solve. On the tool bar above the
webpage where you have "search" "favorites" "media" and
so forth if i click on "search" instead of the little
wizard guy that use to pop up and then I enter my search
info it sends me to a webpage called
http://if.searchcentix.com Also, if I am browsing and
click on a link a lot of times it starts sending me to
this webpage and it takes a couple of times of clicking
on "back" and reclicking on the link to get me to the
actual link I wanted to go to. Lastly, I also have the
same problems if I type in a URL in the address bar.
sometimes it will go to the URL and a lot of times it
goes to this same searchcentrix webpage. can someone tell
me how to restore my old search back where you get the
options of getting the little wizard guy (or other
characters) and how to stop this searchcentrix thing from
continuously taking me there when it is somewhere else I
want to go? i am not real computer literate, but if it is
something I have to remove if you give me the directions
i can follow them. i appreciate the help.
thanks,
Reid

 

[Jim Byrd]

Hi Reid -
Sounds like this might be a variant of some malware called CoolWebSearch (if
not, then see AdAware, SpyBot, and HijackThis, below). Do the following:

Download, UPDATE before running, and run:
http://www.merijn.org/files/cwshredder.zip to remove the parasite. Be sure
to close all instances of IE and OE. You may also get it here if that link
is blocked:
http://www.majorgeeks.com/downloadget.php?id=4086&file=3&evp=6742c4ccda2599a3d6c5901960cc6e24

Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove things
which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

If they don't fix it then start here:

Download HijackThis, free, here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip (Always download a
new fresh copy of HijackThis [and CWShredder also] - It's UPDATED
frequently.) You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

Unzip it to any convenient folder, start it then press Scan. Click on
SaveLog when it's finished which will create hijackthis.log. Now click the
Config button, then Misc Tools and click on Generate StartupList.log which
will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.wilderssecurity.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended




--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Mike Burgess]

Reid,
searchcentrix.com = Adware.SideBar

Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
[more info]
http://securityresponse.symantec.com/avcenter/venc/data/adware.sidebar.html
http://www.pestpatrol.com/PestInfo/s/searchcentrix.asp
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-18-04]
Please post replies to this Newsgroup, email address is invalid