Yahoo Search Engine

[Ricky]

A friend of mine used my computer and downloaded Yahoo
Messenger. In doing so, my search engine is now Yahoo.
I went to START-SEARCH-INTERNET SEARCH options and
changed it back to MSN, but it still searches using Yahoo.

What have I done wrong ??

Also, is there a way to remove Yahoo Messenger and all
it's components ?

Thanks !

 

[war17]

Click on the Search icon in the IE toolbar. Then click Customize and see if
you can it back to MSN.

If no joy, download HijackThis from Spywareinfo download page

http://www.spywareinfo.com/downloads.php

Run the program and you will find many entries. Most are OK. Post the log. I
will find the problem for you.

 

[Jim Byrd]

Hi Ricky - From: http://help.yahoo.com/help/us/mesg/phone/phone-10.html

1.. Important -- Make sure to exit Yahoo! Messenger completely. If you
don't, the un-installation will fail. To do so:
1.. Click the Login tab at the top of your Yahoo! Messenger client and
select Sign Out of Yahoo! and Close.
2.. Also, you will see the Yahoo! Messenger icon (the red Y! with the
offline face on it) in the lower-right corner of your screen (also called
the system tray). You must right-click this icon with your mouse and select
Exit. Yahoo! Messenger will then be closed completely.
2.. Click the Start button on the taskbar.
3.. Select Programs, then Yahoo! Messenger.
4.. Click on Uninstall Yahoo! Messenger.
5.. Choose Automatic, then click the Next button.
6.. Click the Finish button.
(You can also uninstall it from Add-Remove Programs after you shut it down.)

After you've uninstalled it, download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your seach function to nominal.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Ricky]

Thanks Jim. I had already uninstalled Yahoo as you
recommended. It still left bits and pieces on my system,
despite having completely shut it down before
uninstalling. Is there any way to remove all the
remnants of programs that have been removed?? I think
there must be many bits and pieces of programs that I
have removed in the past ????

As for the search engine problem, That did it. Seems the
search was changed to Oseen or something similar, but
http://www.kellys-korner-
xp.com/regs_edits/RestoreSearch2.REG seems to have fixed
it.

Thanks again !

-----Original Message-----
Hi Ricky - From: http://help.yahoo.com/help/us/mesg/phone/phone-10.html

1.. Important -- Make sure to exit Yahoo! Messenger completely. If you
don't, the un-installation will fail. To do so:
1.. Click the Login tab at the top of your Yahoo! Messenger client and
select Sign Out of Yahoo! and Close.
2.. Also, you will see the Yahoo! Messenger icon (the red Y! with the
offline face on it) in the lower-right corner of your screen (also called
the system tray). You must right-click this icon with your mouse and select
Exit. Yahoo! Messenger will then be closed completely.
2.. Click the Start button on the taskbar.
3.. Select Programs, then Yahoo! Messenger.
4.. Click on Uninstall Yahoo! Messenger.
5.. Choose Automatic, then click the Next button.
6.. Click the Finish button.
(You can also uninstall it from Add-Remove Programs after you shut it down.)

After you've uninstalled it, download and run:
http://www.kellys-korner-

xp.com/regs_edits/RestoreSearch2.REG to restore

 

[Guest]

Thanks Warren, I also followed Jim Byrds suggestion. See
above posting.

Heres what Hijack This found...............

Logfile of HijackThis v1.97.7
Scan saved at 12:48:45 AM, on 1/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\APC\PowerChute Business
Edition\agent\pbeagent.exe
C:\Program Files\APC\PowerChute Business
Edition\server\pbeserver.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft
Shared\VS7Debug\mdm.exe
C:\Program Files\Norton SystemWorks\Norton
AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton
Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\PROGRA~1\WinFax\WFXSWTCH.exe
C:\WINDOWS\System32\wfxsnt40.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Norton SystemWorks\Norton
CleanSweep\csinsmnt.exe
C:\Program Files\WinFax\WFXCTL32.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Intuit\QuickBooks Premier - Accountant
Edition\Components\QBAgent\qbdagent2002.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0
\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-
174F-4872-96B5-0B27DDD11DB2} - C:\Program
Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - C:\Program Files\Norton
SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
7859DF00B1D6} - C:\Program Files\Norton
SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB
Diagnostics] "C:\Program Files\Alcatel\SpeedTouch
USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common
Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program
Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program
Files\Corel\WordPerfect Office 2002
\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0
\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1
\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1
\WinFax\WFXSWTCH.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program
Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Xerox WorkCentre 470cx Monitor]
RUNDLL32.EXE C:\WINDOWS\System32
\X470SHLL.DLL,AutoUpdatePnPValue
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6
\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1
\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler]
C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32
\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program
Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!
\Messenger\ypager.exe -quiet
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: SpywareGuard.lnk = C:\Program
Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk =
C:\Program Files\Common Files\Adobe\Calibration\Adobe
Gamma Loader.exe
O4 - Global Startup: Billminder.lnk =
C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: CleanSweep Smart Sweep-Internet
Sweep.LNK = C:\Program Files\Norton SystemWorks\Norton
CleanSweep\csinsmnt.exe
O4 - Global Startup: Controller.LNK = C:\Program
Files\WinFax\WFXCTL32.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk =
C:\Program Files\Norton SystemWorks\Norton
Utilities\SYSDOC32.EXE
O4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk =
C:\Program Files\Intuit\QuickBooks Premier - Accountant
Edition\Components\QBAgent\qbdagent2002.exe
O4 - Global Startup: Quicken Startup.lnk =
C:\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary -
file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search -
file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O12 - Plugin for .pdf: C:\Program Files\Internet
Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
(YInstStarter Class) -
http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office
Update Installation Engine) -
http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {4BEE3896-4820-48D1-85EA-5A9A9ECD3D95}
(OPUCatalog Class) -
http://office.microsoft.com/productupdates/content/opuc.ca
b
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update
Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuct
l.CAB?37861.7501967593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/sw
flash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE}
(Microsoft Office Tools on the Web Control) -
http://officeupdate.microsoft.com/TemplateGallery/download
s/outc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A946A166-4F8A-
4C1A-99D8-B889C1881C6B}: NameServer = 205.152.144.235
205.152.132.235

 

[Jim Byrd]

Hi Ricky - YW - Glad you got it restored. As for cleanup - here's my
standard post on that:

"In my experience all of these Reg cleaners, even the best, are fraught with
danger. I advise against using them except in one specific instance, that
is when you have one that is capable of doing specific Reg searches, and
you NEED (not just WANT) to remove the remaining traces of something that
didn't get uninstalled correctly. (and you didn't have foresight enough to
install it using Total Uninstall,
http://www.geocities.com/ggmartau/projects/projects.html, in the first
place.)

Lastly, if you must screw around with your Registry, then at least get
Erunt/Erdnt, and run it before you do the Reg clean. You'll then have a
true restore available to you. Read below to see why you might not just
using the Reg cleaner's restore:

Get Erunt here for all NT-based computers including XP:
http://home.t-online.de/home/lars.hederer/erunt/index.htm I've set it up to
take a scheduled backup each night at 12:01AM on a weekly round-robin basis,
and a Monthly on the 1st of each month. See here for how to set that up:
http://home.t-online.de/home/lars.hederer/erunt/erunt.txt, and for some
useful information about this subject.

This program is one of the best things around - saved my butt on many
occasions, and will also run very nicely from a DOS prompt (in case you've
done something that won't let you boot any more and need to revert to a
previous Registry) IF you're FAT32 OR have a DOS startup disk with NTFS
write drivers in an NTFS system. (There is also a way using the Recovery
Console to get back to being "bootable" even without separate DOS write NTFS
drivers, after which you can do a "normal" Erdnt restore.) (BTW, it also
includes a Registry defragger program). Free, and very, very highly
recommended.

FYI, quoting from the above document:

Note: The "Export registry" function in Regedit is USELESS (!) to make a
complete backup of the registry. Neither does it export the whole registry
(for example, no information from the "SECURITY" hive is saved), nor can the
exported file be used later to replace the current registry with the old
one. Instead, if you re-import the file, it is
merged with the current registry, leaving you with an absolute mess of old
and new registry keys."



Now, having said all that, AT YOUR OWN RISK you can try searching the
Registry for specific Yahoo Messenger related entries using something like
RegSeeker, here: http://www.hoverdesk.net/freeware.htm AFTER backing up
with ERUNT. And/or you can use it to do a Registry Clean operation, again,
after backing up first with ERUNT. Select ONLY "Green" entries (you may
find many hundreds), and for these look VERY CAREFULLY and select
specifically things to delete. As a general rule, if you don't know what
something is or what it does, leave it alone.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In