Home Search Assistent Removal HELP !

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - the gpo was filtered I want to enable a screen saver policy (30 minutes timeout) for a specific OU. At the domain level we already have one screen saver policy (15 minutes timeout). Even after moving my computerto the specific OU, the policy is not applied (see gpresult below). Any idea? OS Type: Microsoft Windows XP Professional OS Configuration: Member Workstation OS Version: 5.1.2600 Domain Name: SANDISK.COM Domain Type: Windows 2000 Site Name: HQ Roaming Profile: Local Profile: C:\Documents and Settings Connected over a slow link?: No COMPUTER SETTINGS ------------------ CN=BD6DG31,OU=Conference Rooms,OU=XPtest,OU=OUTest,DC=sandisk,DC=loca Last time Group Policy was applied: 6/29/2004 at 4:37:50 PM Group Policy was applied from: Group Policy slow link threshold: 500 kbps Applied Group Policy Objects ----------------------------- Default Domain Policy XP security hardening Messenger Client settings Local Group Policy The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Screen Saver 30 minutes Filtering: Not Applied (Empty) The computer is a part of the following security groups: -------------------------------------------------------- BUILTIN\Administrators Everyone BUILTIN\Users BD6DG31$ Domain Computers NT AUTHORITY\NETWORK NT AUTHORITY\Authenticated Users USER SETTINGS -------------- CN=Eric Roul,OU=Users,OU=HQ,DC=sandisk,DC=local Last time Group Policy was applied: 6/29/2004 at 4:34:44 PM Group Policy was applied from: Group Policy slow link threshold: 500 kbps Applied Group Policy Objects ----------------------------- Default Domain Policy ScreenSaver_and_IE Local Group Policy The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Client settings Filtering: Not Applied (Empty) The user is a part of the following security groups: ---------------------------------------------------- Domain Users Everyone BUILTIN\Administrators Remote Desktop Users BUILTIN\Users Domain Recovery Agents SMSReporting_S06 Business Continuity Planning Group Trackit Staff UserAccess_Reporting SMSS00ReportingUsers Exchange Admins Domain Admins TeamServices Admin Tag: Home Search Assistent Removal HELP ! Tag: 56058
  - 2
    - How much security do I need on my home network? Using MN-700, and wireless network between a desktop (Win98se) and laptop (Win XP). I assume both computers are protected with the firewall in the MN700? Right? Do I need virus protection on each computer? I have McAfee online antivirus protection on the desktop which is connected to the modem and basestation. A Norton trial antivirus program came with the laptop. Should I keep it? Add the laptop to the McAfee coverage?? Thanks. I'm new to this networking stuff. Would appreciate any suggestions. -- hwhamilton Tag: Home Search Assistent Removal HELP ! Tag: 56039
  - 3
    - Difference between viruses, worms, and Trojans Connie, the article "What is the difference between viruses, worms, and Trojans?" can be found at here: http://service1.symantec.com/SUPPORT/nav.nsf/docid/19990412 09131106 Tag: Home Search Assistent Removal HELP ! Tag: 56038
  - 4
    - Spyware Removal I am a novice who sincerely needs help. Last Friday I ran a routine spyware scan on my computer which came back positive for adware/spyware called "CWS Xplugin" which, according to my spyware's knowledge base is: "a browser hijacker that may redirect Google search results to Cool Web Search domains." I immediately quarantined it until I could contact my spyware company's tech support team and decide what to do. I did this yesterday (weekend's off for their tech support...am awaiting their reply.) Please note: my anti-virus program doesn't register this software. Yesterday, I did routine maintenance on my computer (defragmenting and other things) and ran another spyware scan where I found another instance of CWS Xplugin...I quarantined that also. To be on the safe side, I ran another sweep today which also came back positive. Also, this past Sunday and quite by accident, I found a hidden folder on my task bar/start menu's properties dialog box (Customize Notification dialog box) for a folder called "Minibug Installer-100%". I can only imagine what that might be but don't know where it came from;I certainly didn't put it there. It apparently loads up/boots up everytime I start my computer or switch users. These revelations make me nervous, can anyone tell me, a novice user, how I can remove these? Any assistance and advice would be greatly appreciated. Thank you in advance. Tag: Home Search Assistent Removal HELP ! Tag: 56027
  - 5
    - Protect yourself and keep your personal files invisible! Protect yourself and keep your personal files invisible from prying eyes with the very latest Computer Privacy Software TrueCrypt-Gold: http://truecrypt-gold.tk ~~~~~~~~~~~~~~~~~~~~~ This message was posted via one or more anonymous remailing services. The message sender's identity is unknown, unlogged, and not replyable. Any address shown in the From header is unverified. For more information about this anonymous remailing service visit: http://cypherpunks.faithweb.com This anonymous remailer is a joint project of the Xandra International Freedom Association. Tag: Home Search Assistent Removal HELP ! Tag: 56022
  - 6
    - PLEASE HELP I log in my computers as an administrator. I recently restricted users from running specific programs.The problem is that it does not even allow me access any other program other than ieplore which I allowed the users to access. Reply may also be sent at jaymidha@shaw.ca Tag: Home Search Assistent Removal HELP ! Tag: 56017
  - 7
    - Virus vs. Trojan What is the difference between a virus and a trojan horse? I use AVG and Adware. I seldom have problems with viruses but I continually get pop ups advising me of trojans and to run AVG for Windows to remove. However, the pop ups continue even after running AVG. The latest one is called trojan horse downloader. VB.3.AF. Are these trojans harmful? Should I worry about them? Tag: Home Search Assistent Removal HELP ! Tag: 56016
  - 8
    - Mask email How do you cause your email address to be mask on this board? I thought I selected that option when I signed up but apparently not. How can I appear anonymous. TIA Tag: Home Search Assistent Removal HELP ! Tag: 56015
  - 9
    - spyware find can someone please tell me if this is ok to remove C:\WINNT\System32\apemm.dll it came up on a BHODemon scan, is it the cause or related to my spyware nightmare? Tag: Home Search Assistent Removal HELP ! Tag: 56013
  - 10
    - black icon-Norton Antivirus e-mail protection All of a sudden, I have a black icon down in the toolbar in the lower righthand corner of my screen (I never can remember what that toolbar is called). Any idea why and if I should be worried? Tag: Home Search Assistent Removal HELP ! Tag: 56010
  - 11
    - scripting disabled? On W2K3 with all updates, recently I am getting "scripting disabled" and "ActiveX prohibited" messages when browsing trusted sites. I have configured ZERO security for trusted sites and previously had uninstalled the IE Enhanced Security Config. It has only been doing this very recently, maybe since the last MS patches. Anybody see this? Tag: Home Search Assistent Removal HELP ! Tag: 56007
  - 12
    - urgent! certificates with serialNumber attribute in subject hi, We are using a microsoft certificate authority. We want to look into the possibility to issue certificates with use of the serialnumber attribute set in the subject of the certificate holder. I have tried to use the certificate enrollment API without success. The certificate server seems to ignore serialNumber field (and also dnQualifier field) and issue the certificate without these fields in it. I have allso tried to make a custom pkcs10 request with openssl, the same happens, the certificate is issued, but the serialNumber field is ignored when issued. QUESTION: How can i make the Windows Certificate Authority able to issue certificates with the serialNumber attribute set? best regards, kaare Tag: Home Search Assistent Removal HELP ! Tag: 56005
  - 13
    - Hijacked Browser Hey, I believe I have a hijacked browser, it freezes after 10 minutes of use and then it won't let me do anything else. It also affects my E-Mail (Office Outlook). I have run AdAware and Spybot, but both fail to help me and fix this problem. I am running IE6 on a XP PC. Any help would be GREATLY appreciated. Thanks everybody! Tag: Home Search Assistent Removal HELP ! Tag: 56004
  - 14
    - pop ups browser hijacks I have internet firewall on, ZA Pro running and Google toolbar set to block popups. I have just been to Sygates site to download the personal firewall and a pop up appeared that said would I like to block unwanted mail in Outlook to which I said yes (silly me thinking it was a part of the AV setup) I was then redirected to a hotbar site that started downloading something on my pc, fortunatly it said that my computer was not configured to accept this download. What is this all about? Why is my security letting me down and do I have a browser or toolbar hijacker? Tag: Home Search Assistent Removal HELP ! Tag: 55999
  - 15
    - am I safe? I have recently completely uninstalled NAV as it was severely slowing my startup even though I have quite a powerful system with 1gb DDRAM. Am I safe running my network with the firewall and ZA pro running with all security features set? Or is it essential that I have a Antivirus running? If so I will install the free Sygate personal firewall or AVG, which of the two is best? Tag: Home Search Assistent Removal HELP ! Tag: 55997
  - 16
    - GStartup.Ink How do I get rid of this? GStarup.Ink Tag: Home Search Assistent Removal HELP ! Tag: 55986
  - 17
    - GStartup.Ink How do I get rid of this at Startup? Tag: Home Search Assistent Removal HELP ! Tag: 55984
  - 18
    - homepage has been hijacked when i open ie 6.0, homepage goes to home search. The url for this is res://cbdkw.dll/index.html#37049. help! Tag: Home Search Assistent Removal HELP ! Tag: 55983
  - 19
    - W2K3 security configuration ?When browsing trusted sites, I get messages that "scripting is disabled" or "ActiveX controls are prohibited", despite configuring the trusted zone for minimum security and uninstalling Internet Exploer Enhanced Security Configuration. It was working well for some time and I don't know what happened. Was there a problem with the most recent W2K3 update? WHat else could it be? Thanks! Tag: Home Search Assistent Removal HELP ! Tag: 55981
  - 20
    - uploads and downloads near the same i have xp home,mcafee,and spyware installed, my uploads are near the same as downloads, eg down=13mg. up= 12mg.any ideas steve Tag: Home Search Assistent Removal HELP ! Tag: 55971
  - 21
    - unwanted toolbar in Internet explorer i have this HOTSEARCHBAR on my internet explorer and cannot get rid of it. i have run adadware, and spybot and it hasnt removed it, also it is not on the add remove programs list. i have tried to find online searches for the removal, but that hant come up with anything either, and i dont know how it got on here being my parents use this computer also. somebody please help me!!!!! Tag: Home Search Assistent Removal HELP ! Tag: 55969
  - 22
    - Firewall alert ... is it a problem????? I just got the following alert in my firewall:- From: host217-43-126-184.range217-43.btcentralplus.com IP: 217.43.126.184 Port: 500 To program: Isass.exe Description: LSA Shell (Export Version) Haven't had this one before. The firewall info on this is unhelpful (what else). Anybody know whether this was actually legitimate or not? (I refused the request). What does port 500 get used for anyway? All I could find were cryptic reference to "ISAKMP, pluto". Many thanks. Tag: Home Search Assistent Removal HELP ! Tag: 55963
  - 23
    - For Jurren Bouman (re my previous 6/22/04 post) Re: my post of 6/22/04 (Critical Security Update) and your answer 6/23/04 and my response of 6/24/04. Can you or someone post an answer to my response/post of 6/24/04? Thank you for your help. Tag: Home Search Assistent Removal HELP ! Tag: 55961
  - 24
    - How to avoid File Download warning in IE6 Hi, I'm doing a dynamic web application that will run on several laptop (stand alone - not in a LAN & without connection). I need to run/execute, from one of the page, a third party application which is on a CD-Rom, but when I click on the link that calls this exe file, of course, I get the usual File Download warning message (Some file can harm your computer ... OPEN / SAVE / CANCEL). I would like to avoid that message, so open the exe file immediatly when I click on the link. I already look for a solution for hours & hours (and becoming mad with this) with Director, Flash, ... without success. I suppose there's maybe a key somewhere in the registry ??? Please HELP. Thanks in advance Tag: Home Search Assistent Removal HELP ! Tag: 55959
  - 25
    - popups plse could some one give me a good sight to stop annoying popups which in the past have given me high billing (1.50 british pounds per minute) when i thought i was actually getting rid of it i was accepting it. plse help as these things are obtrusive, cheecky and annoying. Tag: Home Search Assistent Removal HELP ! Tag: 55958
- Next
  - 1
    - HELP!!! ***res://<random>.dll/<random>.html#<random>*** HELP!!! Hi. Trying to remove BRAND *NEW* VARIANT of CoolWebSearch Malware from my 75-year old Dad's PC. NOTHING WORKS. Do not suggest *ANYTHING* old. I REPEAT: DO NOT SUGGEST ANY OLD IDEAS!!! I've tried *EVERYTHING* that is *OLD*. OK? Don't tell me to use the shredder - it DOES NOT WORK. Don't tell me to use Ad-Aware or *ANY* of the current spyware removers -- THEY DO NOT WORK!!! DON'T SUGGEST ANYTHING THAT'S NOT BRAND NEW!!! So... with that in mind... this is a variant that DOES NOT have a current fix. Understand??? Could someone please develop one? SOON? And can we find the bastards that created this BRAND NEW CWS variant and try and convict and sentence them --- ASAP???!!! Cuz they suck. Here's the scan that hijackthis created: Logfile of HijackThis v1.97.7 Scan saved at 2:03:17 PM, on 6/28/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\winbu.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\WINDOWS\System32\hkcmd.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Winamp\Winampa.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\crkz32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\System32\HPZipm12.exe C:\PROGRA~1\Netscape\NETSCA~1\Netscp.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Documents and Settings\[name]\Local Settings\Temp\Temporary Directory 6 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\whwwf.dll/sp.html#96676 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://whwwf.dll/index.html#96676 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://whwwf.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\whwwf.dll/sp.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://whwwf.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\whwwf.dll/sp.html#96676 N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\[name]\Application Data\Mozilla\Profiles\default\w0kzwsxi.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\[name]\Application Data\Mozilla\Profiles\default\w0kzwsxi.slt\prefs.js) O2 - BHO: (no name) - OK, NOW WHAT???!!! Tag: Home Search Assistent Removal HELP ! Tag: 55949
  - 2
    - surfing the web routinely when surfing the web, after the first one or two sites visited, I get the "page can not be displayed" response when clicking links or attempting to visit other sites. I have checked with my ISP and no server problems. If I disconnect my dial up connection and reconnect, then I can browse again for the first couple of pages, and the routine starts again. anybody have any idea what is going on? thanks Tag: Home Search Assistent Removal HELP ! Tag: 55948
  - 3
    - MS Security Instructions for Outlook Plain Text Microsoft's recommendations for Browser and Email security give instructions to set up Outlook to read messages as plain text. However, the option doesn't appear as described on what I believe to be the latest version and service pack of Outlook: Microsoft Outlook 2002 (10.6515.6626) SP3 The checkbox "Read all standard mail in plain text" does not appear in the indicated location nor anywhere else I can find. I've had a number of people ask me about this in the past hour. When I try a Google search for instructions, all I can find for Outlook are registry editing instructions. So are Microsoft's instructions wrong or am I missing something? http://www.microsoft.com/security/incident/settings.mspx#XSLTsection127121120120 -- Gary Flynn Security Engineer James Madison University Tag: Home Search Assistent Removal HELP ! Tag: 55942
  - 4
    - MS Recommendations for Outlook Plain Text Microsoft's recommendations for Browser and Email security give instructions to set up Outlook to read messages as plain text. However, the option doesn't appear to work on what I believe to be the latest version and service pack of Outlook: Microsoft Outlook 2002 (10.6515.6626) SP3 When I try a Google search for instructions, all I can find for Outlook are registry editing instructions. So are Microsoft's instructions wrong or am I missing something? http://www.microsoft.com/security/incident/settings.mspx#XSLTsection127121120120 -- Gary Flynn Security Engineer James Madison University Tag: Home Search Assistent Removal HELP ! Tag: 55941
  - 5
    - hotmail hacked please can anyone help me, somebody has changed my hotmail password and secret question- is there any way of getting back control of the account or so i just have to let it be and not use that email address anymore? thanks x Tag: Home Search Assistent Removal HELP ! Tag: 55938
  - 6
    - help: site hacked This is a multi-part message in MIME format. ------=_NextPart_000_0043_01C45CFF.AC8AA600 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable hi someone was hacked my site i have 2 servers : web--> IIS 5 / w2k adv Srv IIS lockdown sql--> SQL2k / w2k adv Srv i found the web srv doing "beeps" soon i found it serves html pages but don't serves asp with an error like "Error in the server application" sql srv lost sa password and don't recognize the local admin then i can't access to sql applications except of that, servers appears to work normal the web srv log is saying that attacked the iwam_ and many "login misses" under DCOMSCM and then, "login hits" i go now to restore my backup and images but what can i do to prevent the next attack ? how can i protect better the site ? thanks --=20 atte, Hern=E1n Castelo SGA - UTN - FRBA ------=_NextPart_000_0043_01C45CFF.AC8AA600 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ebf3fc> <DIV> <DIV><FONT face=3DArial size=3D2>hi</FONT></DIV> <DIV><FONT face=3DArial size=3D2>someone was hacked my site</FONT></DIV> <DIV><FONT face=3DArial size=3D2>i have 2 servers :</FONT></DIV> <DIV><FONT face=3DArial size=3D2>web--> IIS 5 / w2k adv Srv IIS=20 lockdown</FONT></DIV> <DIV><FONT face=3DArial size=3D2>sql--> SQL2k / w2k adv = Srv</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>i found the web srv </FONT><FONT = face=3DArial=20 size=3D2>doing "beeps"</FONT></DIV> <DIV><FONT face=3DArial size=3D2>soon i found it serves html = pages</FONT></DIV> <DIV><FONT face=3DArial size=3D2>but don't serves asp with an error=20 like</FONT></DIV> <DIV><FONT face=3DArial size=3D2>"Error in the server = application"</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>sql srv lost sa password</FONT></DIV> <DIV><FONT face=3DArial size=3D2>and don't recognize the local = admin</FONT></DIV> <DIV><FONT face=3DArial size=3D2>then i can't access to sql=20 applications</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>except of that,</FONT></DIV> <DIV><FONT face=3DArial size=3D2>servers appears to work = normal</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2> <DIV><FONT face=3DArial size=3D2>the web srv log is saying</FONT></DIV> <DIV><FONT face=3DArial size=3D2>that attacked the iwam_</FONT></DIV> <DIV>and many "login misses" under DCOMSCM</DIV> <DIV>and then, "login hits"</DIV></FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>i go now to restore</FONT></DIV> <DIV><FONT face=3DArial size=3D2>my backup and images</FONT></DIV> <DIV><FONT face=3DArial size=3D2>but</FONT></DIV> <DIV><FONT face=3DArial size=3D2>what can i do to prevent the next = attack=20 ?</FONT></DIV> <DIV><FONT face=3DArial size=3D2>how can i protect better the site = ?</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>thanks</FONT></DIV> <DIV><FONT face=3DArial size=3D2> </DIV> <DIV><BR></DIV></FONT></DIV> <DIV><FONT face=3DArial size=3D2><BR>-- <BR>atte,<BR>Hern=E1n = Castelo<BR>SGA - UTN -=20 FRBA<BR></FONT></DIV></BODY></HTML> ------=_NextPart_000_0043_01C45CFF.AC8AA600-- Tag: Home Search Assistent Removal HELP ! Tag: 55933
  - 7
    - What are the best and most secure settings on XP I have lost a lot of research material and money to solve the problems hackers have caused me. How can I secure the services, configurations, etc. in such a way that only I can make changes. I have open the services folder to find out that hackers have changed things to the point that I have lost access to many permissions. Is there a "One" setting that will not allow anyone but me to change the settings and permissiions? What is the best practice for these area. I have had my own password changed. Thanks. Marty Tag: Home Search Assistent Removal HELP ! Tag: 55928
  - 8
    - Could anyone recommend me some sites prividing secure email services which is worthy to be trusted? Tag: Home Search Assistent Removal HELP ! Tag: 55927
  - 9
    - firewall how do i turn off personal firewalls and internet securities? Tag: Home Search Assistent Removal HELP ! Tag: 55916
  - 10
    - it's gotten worse! i posted below about my adwaheck trojan.. and my notepad probs. now i'm wondering if i have something else entirely. i've spent the past few hours *tinkering*. it appears that this fake(?) notepad.exe file in c:\windows\system32 extracts itself when run (by attempting to run notepad via any shortcut) into what norton pointed out to be the adwaheck trojan. eachtime you run it it takes a different file name (i've ran system restore quite a few times :) and tried it) now for what appears to get worse (or maybe i just don't know enough about xp) but if i run system tools sytem info and have if show me a history of changes there is a zillion changes timed and dated aprox when i started the program. nasty scarry looking stuff.. changing filenames.. manafacturers..users..versions.. device memory addresses. you name it. at the point i freaked and ran system restore (for the first time). it appears it's not as simple as deleting a file and what it puts in the registry. i deleted the fake(?) noteepad right after system restore then emptied recycle bin.. never ran notepad but still had the problems in system info. has anyone expirenced anything like this with their dissapearing notepad programs? any fixes? thanks Tag: Home Search Assistent Removal HELP ! Tag: 55915
  - 11
    - What is xrowxie.exe Does anybody know what the process "xrowxie.exe" does? I have found it in the XP Task Manager Process list but have no idea what it does or where it came from. I have searched the internet but have not found any reference. Tag: Home Search Assistent Removal HELP ! Tag: 55914
  - 12
    - What is xrowxie.exe? I have found the process "xrowxie.exe" in my task manager list. I don't remember seeing it before. I have run several programs to find out what it is (adware,spybot, etc) but none of the find it. A general search of the Internet also finds no reference to it. Does anybody know what it is? Tag: Home Search Assistent Removal HELP ! Tag: 55913
  - 13
    - IP Conflict msg but no reply Hi Everyone, Can anybody advise me please as we keep receiving an error msg of IP conflict but when u try to ping the IP you get no reply. Appreciate your thoughts pls. Thanks so much. Tag: Home Search Assistent Removal HELP ! Tag: 55910
  - 14
    - Can I trust this free encrypted email site? www.hushmail.com This site provide free encrypted email service and do not need to use digital certificate.Can I trust the site? Is there other site worthy to be trusted which privides free content-encrypted email service? Thank you. Tag: Home Search Assistent Removal HELP ! Tag: 55909
  - 15
    - key generator what could it be used for i have several of them in my win temp file Tag: Home Search Assistent Removal HELP ! Tag: 55908
  - 16
    - key generator anyone know wha this is Tag: Home Search Assistent Removal HELP ! Tag: 55906
  - 17
    - GrrrArgh. Oh, I get it now.... I have to load so many anti-adware/hijack, anti- worm/trojan programs that there will be NO ROOM on my hard drive for the pests! I have to laugh, otherwise I would be tearing my hair out - I had a bout with Cool Web Search a while back and now I'm hit with this VX2 and "about:blank". I know...I'll blame it on my husband...he'll open anything! M. Tag: Home Search Assistent Removal HELP ! Tag: 55890
  - 18
    - virtual bouncer!!! how do you get rid of it in ME!!.... Tag: Home Search Assistent Removal HELP ! Tag: 55889
  - 19
    - Change of Administrtaor for Windows XP pro I am Administrator of Home office PC with Windoes XP pro. My daughter, who is limited user, has somehow changed herself to administrator and cancelled my login. I can now no longer access my own PC How can I get back in?? Tag: Home Search Assistent Removal HELP ! Tag: 55880
  - 20
    - desperate help with backdoor.prorat My computer got infected with that trojan. I tried everything listed on Symantec page - but after deleting from registry - it keeps coming back and i cannot open norton anti virus. I ran adaware 6, spybot, i cleaned all internet and cookies files - but still it keeps coming back all the time. Can someone suggest to me what to do other then reformating the hard disk ? THANKS Tag: Home Search Assistent Removal HELP ! Tag: 55870
  - 21
    - newbie - pls help with removing trojan had nortons site scan me.. found trojan adwaheck in c:\windows\system32\opengl32.exe says to delete file and registry entry. found registry entry in hkey_current_user\software\microsoft\windows\currentversion\run where norton said it would be. also after reading this forum looked and found it checked in msconfig startup i guess my questions are.. is opengl32.exe a real file i need? as in need to replace it after i delete the trojan one? if so where do i find it. or is it just a fake, un-needed file i can zap? oh and yes it's loaded and running.. can i still delete it while windows thinks it wants to use it? (xp pro btw). if i zap the file, delete the registry entry, and uncheck the startup box is that all i need to do or do i need to look at other things? btw.. also (as i've seen mentioned in threads here) i too had weird problems with my notepad.. couldn't open it...checked properties and the target path was set to something weird (actmovie?) in one user profile and in the other a path that didn't exist. i DID find notepad in c:\windows and set the paths to that. all works ok but i did findsomething else that is something i'm not sure is right.... there is a line in my win.ini file under programs notepad=c:\windows\notepad.exe that is the ONLY program listed there... thought it was odd cuz of my notepad prob. is it supposed to be there???? thanks so much in advance. Tag: Home Search Assistent Removal HELP ! Tag: 55869
  - 22
    - Hacked I hav an email that has been hacked since April 2004 and the hacker is usin it for his own purposes...i'm juz worried cuz some of my friends still send emails to that email and i'm not sure wt the hacker could be up to next..it's probably the same hacker that has hacked this email last time but managed to get it bak with the help of my fren... And another problem is that this email(wei_jan11@hotmail.com) is used by someone else...even my msn messenger contacts said they saw my account online when on that day,I was not even online! And those ppl that chatted with my account while that person was usin my account blocked them..and this person even deleted my contacts juz to add his own! I changed my password many times and the same thing happens..so i really need help here... I hope there will be an answer fast. Tag: Home Search Assistent Removal HELP ! Tag: 55859
  - 23
    - Hacked Well...not exactly hacked...but my account is often used by someone i dunno and he deletes my messenger contacts to add his own...i changed my password from time to time but it still happens.(the account is wei_jan11@hotmail.com) My other email got hacked and i still can't get it bak...(sclub_forever@hotmail.com) That email was hacked around April till now... But then,i hav to solve this problem about the person usin my account...I'm juz worried that he might change my password someday... So i really need some help right now. Tag: Home Search Assistent Removal HELP ! Tag: 55857
  - 24
    - secure email There are some companies providing free secure(encrpted) email. I have a question --why hotmail service still has so many users though hotmail doesn't provide users secure email services? We send non-encrypted hotmail which is easily captured by hackers. Tag: Home Search Assistent Removal HELP ! Tag: 55852
  - 25
    - Reverse DNS & security It is said that if your ISP provides you Reverse DNS,your IP is less secure. Would anyone like to explain it to me in details? Tag: Home Search Assistent Removal HELP ! Tag: 55849

Hello,

I have XP SP1 with all the latest updates. I also have
AdAware and several other removal tools. None of them can
not remove Home Search Assistent. The spyware just keeps
generating .dll and .exe files with various names.
Also, my computer CAN NOT boot in safe mode!
Please advice with the cleaning of this nasty spyware.

Thank you.

Top

Re: Home Search Assistent Removal HELP ! by FreeWilly

FreeWilly
Wed Jun 30 15:26:55 CDT 2004

There are a lot of variants to this. There is a public thread here:
http://www.majorgeeks.com/vb/showthread.php?t=34941

Good Luck.

"Adzia Cyber Messiah" <anonymous@discussions.microsoft.com> wrote in message
news:231c401c45e43$8e4123f0$a301280a@phx.gbl...
> Hello,
>
> I have XP SP1 with all the latest updates. I also have
> AdAware and several other removal tools. None of them can
> not remove Home Search Assistent. The spyware just keeps
> generating .dll and .exe files with various names.
> Also, my computer CAN NOT boot in safe mode!
> Please advice with the cleaning of this nasty spyware.
>
> Thank you.

Top