Archived from groups: microsoft.public.windowsme.general (More info?)

My Interner Explorer 6.0 have been hijacked by the
hotsearchbar / Isearch. I have tried spyware doctor, Ad-
Aware SE and Spybot S&D but can't remove this. Someone
please help me !!!

Thanks in advance

Archived from groups: microsoft.public.windowsme.general (More info?)

Try CWShredder.

Alias

"George" <anonymous@discussions.microsoft.com> wrote
>
>
> My Interner Explorer 6.0 have been hijacked by the
> hotsearchbar / Isearch. I have tried spyware doctor, Ad-
> Aware SE and Spybot S&D but can't remove this. Someone
> please help me !!!
>
> Thanks in advance

Archived from groups: microsoft.public.windowsme.general (More info?)

CWshredder isnn't helping either !!


>-----Original Message-----
>Try CWShredder.
>
>Alias
>
>"George" <anonymous@discussions.microsoft.com> wrote
>>
>>
>> My Interner Explorer 6.0 have been hijacked by the
>> hotsearchbar / Isearch. I have tried ﷯spyware﷯ doctor, ﷯Ad﷯-
>> Aware SE and Spybot S&D but can't remove this. Someone
>> please help me !!!
>>
>> Thanks in advance
>
>
>.
>

Archived from groups: microsoft.public.windowsme.general (More info?)

What version of CWShredder? The latest is 2.13.

Alias

"George" <anonymous@discussions.microsoft.com> wrote

CWshredder isnn't helping either !!


>-----Original Message-----
>Try CWShredder.
>
>Alias
>
>"George" <anonymous@discussions.microsoft.com> wrote
>>
>>
>> My Interner Explorer 6.0 have been hijacked by the
>> hotsearchbar / Isearch. I have tried ﷯spyware﷯ doctor,
>> ﷯Ad﷯-
>> Aware SE and Spybot S&D but can't remove this. Someone
>> please help me !!!
>>
>> Thanks in advance
>
>
>.
>

Archived from groups: microsoft.public.windowsme.general (More info?)

I have downloaded the latest one. But still the Isearch
looks invincible. Please help me guys !!!


>-----Original Message-----
>What version of CWShredder? The latest is 2.13.
>
>Alias
>
>"George" <anonymous@discussions.microsoft.com> wrote
>
>CWshredder isnn't helping either !!
>
>
>>-----Original Message-----
>>Try CWShredder.
>>
>>Alias
>>
>>"George" <anonymous@discussions.microsoft.com> wrote
>>>
>>>
>>> My Interner Explorer 6.0 have been hijacked by the
>>> hotsearchbar / Isearch. I have tried ?spyware? doctor,
>>> ?Ad?-
>>> Aware SE and Spybot S&D but can't remove this. Someone
>>> please help me !!!
>>>
>>> Thanks in advance
>>
>>
>>.
>>
>
>
>.
>

Archived from groups: microsoft.public.windowsme.general (More info?)

George wrote:
> My Interner Explorer 6.0 have been hijacked by the
> hotsearchbar / Isearch. I have tried spyware doctor, Ad-
> Aware SE and Spybot S&D but can't remove this. Someone
> please help me !!!

Follow these steps: http://aumha.org/a/quickfix.htm

You will need to do the HijackThis log at the end, but do the other steps
first.


--
Jim Eshelman, MS-MVP Windows Shell/User, Windows Security
Windows Support Center: http://aumha.org/
AumHa Forums: http://aumha.net/

Archived from groups: microsoft.public.windowsme.general (More info?)

"George" wrote:
>
> My Interner Explorer 6.0 have been hijacked by the
> hotsearchbar / Isearch. I have tried spyware doctor, Ad-
> Aware SE and Spybot S&D but can't remove this. Someone
> please help me !!!

George,
Your last resort if Ad-aware, SpyBot, CWShredder, etc don't work
is 'HijackThis'.

FAQ and download here;
http://www.mvps.org/winhelp2002/unwanted.htm
You'll need to scroll down the page to find the information.
Make sure you install the application to a "dedicated" Programs Files
Directory! Like this: [C:\Program Files\HijackThis]

Post your HijackThis log here, for expert analysis.
http://forum.aumha.org/viewforum.php?f=30

Good luck!

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security (AH-VSOP)
__________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

Archived from groups: microsoft.public.windowsme.general (More info?)

> "George" wrote:
>>
>> My Interner Explorer 6.0 have been hijacked by the
>> hotsearchbar / Isearch. I have tried spyware doctor, Ad-
>> Aware SE and Spybot S&D but can't remove this. Someone
>> please help me !!!



Another idea is to look in the folder C:\Windows\ Look for a file called
"toolbar.dll". With IE closed, delete the file.

I had this same problem and found that my spyware programs were not deleting
this vital file used for the ISearch toolbar. The only spyware program that I
have found that will correctly delete this file is Webroot's Spysweeper.

To keep from having this problem again, I created a new text file and then
named it "toolbar.dll" and under "Properties" made it "Read Only". At zero
bytes, spyware programs will not recognize the "dummy" file as a threat & it
can keep any new installation of the ISearch bar from being fully installed
on your PC. However, you will still need to remove the registry entries when
they appear in your spyware detections.

~Theta Sigma

Archived from groups: microsoft.public.windowsme.general (More info?)

Good god !! Seems like the thing was finally removed
using the Spybot....but my Windows won't start up now. It
keeps on showing the message "updating system settings"
forever ! I tried 'alt+ctrl+del' during that time and
found peculiar things like "Removal Tool" "Kill" etc.
along with the regular things in the task manager.

Pleeeeaaase HELP me !!!


>-----Original Message-----
>"George" wrote:
>>
>> My Interner Explorer 6.0 have been hijacked by the
>> hotsearchbar / Isearch. I have tried spyware doctor,
Ad-
>> Aware SE and Spybot S&D but can't remove this. Someone
>> please help me !!!
>
>George,
>Your last resort if Ad-aware, SpyBot, CWShredder, etc
don't work
>is 'HijackThis'.
>
>FAQ and download here;
>http://www.mvps.org/winhelp2002/unwanted.htm
>You'll need to scroll down the page to find the
information.
>Make sure you install the application to a "dedicated"
Programs Files
>Directory! Like this: [C:\Program Files\HijackThis]
>
>Post your HijackThis log here, for expert analysis.
>http://forum.aumha.org/viewforum.php?f=30
>
>Good luck!
>
>Silj
>
>--
>siljaline
>
>MS - MVP Windows (IE/OE) & Security (AH-VSOP)
>__________________________________________
>Security Tools Updates
>http://aumha.net/viewforum.php?f=31
>
>(Reply to group, as return address
>is invalid - that we may all benefit)
>
>
>.
>

Archived from groups: microsoft.public.windowsme.general (More info?)

Try booting once into Safe Mode (you may need to hold down the Ctrl key or
tap the F8 key repeatedly to get there) and see if the computer will start
up. If so, immediately restart it and let it start normally. Does that
sort things out?

--
Richard G. Harper [MVP Shell/User] rgharper@gmail.com
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Geroge" <anonymous@discussions.microsoft.com> wrote in message
news:089d01c517f4$77743250$a401280a@phx.gbl...
> Good god !! Seems like the thing was finally removed
> using the Spybot....but my Windows won't start up now. It
> keeps on showing the message "updating system settings"
> forever ! I tried 'alt+ctrl+del' during that time and
> found peculiar things like "Removal Tool" "Kill" etc.
> along with the regular things in the task manager.
>
> Pleeeeaaase HELP me !!!
>
>
>>-----Original Message-----
>>"George" wrote:
>>>
>>> My Interner Explorer 6.0 have been hijacked by the
>>> hotsearchbar / Isearch. I have tried spyware doctor,
> Ad-
>>> Aware SE and Spybot S&D but can't remove this. Someone
>>> please help me !!!
>>
>>George,
>>Your last resort if Ad-aware, SpyBot, CWShredder, etc
> don't work
>>is 'HijackThis'.
>>
>>FAQ and download here;
>>http://www.mvps.org/winhelp2002/unwanted.htm
>>You'll need to scroll down the page to find the
> information.
>>Make sure you install the application to a "dedicated"
> Programs Files
>>Directory! Like this: [C:\Program Files\HijackThis]
>>
>>Post your HijackThis log here, for expert analysis.
>>http://forum.aumha.org/viewforum.php?f=30
>>
>>Good luck!
>>
>>Silj
>>
>>--
>>siljaline
>>
>>MS - MVP Windows (IE/OE) & Security (AH-VSOP)
>>__________________________________________
>>Security Tools Updates
>>http://aumha.net/viewforum.php?f=31
>>
>>(Reply to group, as return address
>>is invalid - that we may all benefit)
>>
>>
>>.
>>

Archived from groups: microsoft.public.windowsme.general (More info?)

"Geroge" <anonymous@discussions.microsoft.com> wrote in
news:089d01c517f4$77743250$a401280a@phx.gbl:

> Good god !! Seems like the thing was finally removed
> using the Spybot....but my Windows won't start up now. It
> keeps on showing the message "updating system settings"
> forever ! I tried 'alt+ctrl+del' during that time and
> found peculiar things like "Removal Tool" "Kill" etc.
> along with the regular things in the task manager.
>
> Pleeeeaaase HELP me !!!


Before a suggestion, a question...when you last run Spybot, at the end of the
search, did you get a message stating something to the effect of "Spybot
could not completely remove a particular piece of Spyware. Do you wish to
have Spybot start with Windows during your next startup?" (or something to
that effect) If so and you selected yes, SpyBot may be causing problems with
your startup.

The clues are in the "Removal Tool" & "Kill" that you mentioned. When there
is spyware running in memory during a spyware scan, these files cannot be
unloaded while they are running with the operating system in most cases. The
"Removal Tool" & "Kill" processes are run by SpyBot S&D before Windows
completely loads during a reboot in order to remove these files before they
get loaded into memory again.

The solution to this problem...

Reboot>
F8 into Safe Mode at startup (before Windows begins to load)>
Click Start>
Click Run>
Type MSCONFIG>
Select the STARTUP tab>
Uncheck anything that looks suspicious to you and/or relates to SpyBot>
Click Apply>
Click OK>
Restart the PC normally>

If you are unsure what to uncheck, copy the list of ALL of the items under
the STARTUP tab and post them here. I can identify each one and tell what to
leave checked or to uncheck. This may also help get rid of the ISearch bar if
it has files that are loading with Windows. Any ISearch toolbar files that
are in this list needs to be unchecked, found using Start->Search, and then
deleted manually.

If this works (which it should), you may need to also reinstall SpyBot S&D as
it sounds like one of SB's "tools" is causing problems during reboot after
scans.

Hope this helps.

~Theta Sigma

Archived from groups: microsoft.public.windowsme.general (More info?)

Alright....the computer is booting up in Safe Mode. But
restarting it in normal mode after that (as per Richard's
suggestion) did not work. Follwoing Theta, I looked into
the 'Msconfig'->Startup Tab-> and nothing really looked
suspicious ! But I will put the list of the processes
here today/tomorrow. By the way, in the safe mode, I ran
Spybot and Ad-Aware and the found and removed 'DSO
Exploit' and "Isearch Reg Key' respectively. I
uninstalled the Spybot under the safe mode and tried to
reboot normally.....but it's still not working. This
feels so frustrating !!

>-----Original Message-----
>"Geroge" <anonymous@discussions.microsoft.com> wrote in
>news:089d01c517f4$77743250$a401280a@phx.gbl:
>
>> Good god !! Seems like the thing was finally removed
>> using the Spybot....but my Windows won't start up now.
It
>> keeps on showing the message "updating system
settings"
>> forever ! I tried 'alt+ctrl+del' during that time and
>> found peculiar things like "Removal Tool" "Kill" etc.
>> along with the regular things in the task manager.
>>
>> Pleeeeaaase HELP me !!!
>
>
>Before a suggestion, a question...when you last run
Spybot, at the end of the
>search, did you get a message stating something to the
effect of "Spybot
>could not completely remove a particular piece of
Spyware. Do you wish to
>have Spybot start with Windows during your next
startup?" (or something to
>that effect) If so and you selected yes, SpyBot may be
causing problems with
>your startup.
>
>The clues are in the "Removal Tool" & "Kill" that you
mentioned. When there
>is spyware running in memory during a spyware scan,
these files cannot be
>unloaded while they are running with the operating
system in most cases. The
>"Removal Tool" & "Kill" processes are run by SpyBot S&D
before Windows
>completely loads during a reboot in order to remove
these files before they
>get loaded into memory again.
>
>The solution to this problem...
>
>Reboot>
>F8 into Safe Mode at startup (before Windows begins to
load)>
>Click Start>
>Click Run>
>Type MSCONFIG>
>Select the STARTUP tab>
>Uncheck anything that looks suspicious to you and/or
relates to SpyBot>
>Click Apply>
>Click OK>
>Restart the PC normally>
>
>If you are unsure what to uncheck, copy the list of ALL
of the items under
>the STARTUP tab and post them here. I can identify each
one and tell what to
>leave checked or to uncheck. This may also help get rid
of the ISearch bar if
>it has files that are loading with Windows. Any ISearch
toolbar files that
>are in this list needs to be unchecked, found using
Start->Search, and then
>deleted manually.
>
>If this works (which it should), you may need to also
reinstall SpyBot S&D as
>it sounds like one of SB's "tools" is causing problems
during reboot after
>scans.
>
>Hope this helps.
>
>~Theta Sigma
>.
>

Archived from groups: microsoft.public.windowsme.general (More info?)

"George" <anonymous@discussions.microsoft.com> wrote in
news:0f9201c518d3$11793790$a401280a@phx.gbl:

> Alright....the computer is booting up in Safe Mode. But
> restarting it in normal mode after that (as per Richard's
> suggestion) did not work. Follwoing Theta, I looked into
> the 'Msconfig'->Startup Tab-> and nothing really looked
> suspicious ! But I will put the list of the processes
> here today/tomorrow. By the way, in the safe mode, I ran
> Spybot and Ad-Aware and the found and removed 'DSO
> Exploit' and "Isearch Reg Key' respectively. I
> uninstalled the Spybot under the safe mode and tried to
> reboot normally.....but it's still not working. This
> feels so frustrating !!
>

I know how frustrating it can be. My PC was completely inoperative for over
two months simply because one minor setting was unexplainably changed in my
system BIOS. It took patience and a lot of troubleshooting to find the
problem but everything is fine now. Just as with mine, your descriptions of
the problem suggest that it is nothing major and you will just need to be
patient and run through a few checks to determine the cause of the problem.

The first thing you might try involves process of elimination. Go into Safe
Mode-> Start-> Run-> MSCONFIG-> Startup Tab and then uncheck EVERYTHING
except items that obviously relate to your video display, mouse, and/or
keyboard (if applicable). Keep in mind that any firewall and/or anti-virus
programs will now be completely disabled unless started manually, so I would
not surf the web unguarded! With all unchecked (except as noted), reboot
normally and if your PC now successfully loads Windows, you can try Start->
Run-> MSCONFIG-> Startup tab and checking items one at a time and rebooting
after each one until Windows begins to hang again at startup. This may give
you a clue as to what may be causing the problem.

Also, in Safe Mode you may try Start-> Control Panel-> System-> Device
Manager and check for any hardware conflicts (as noted by a yellow
exclamation mark). These can pop up sometimes when you least expect it and
can be caused by a number of things (such as a corrupt/missing driver or
corrupt/missing system file).

If the above doesn't work, you should post the entire startup list here and
one other thing...the boot log. Between these two, they should pinpoint where
your problem lies.

To have your PC create a boot log, restart and F8 but instead of Safe Mode,
choose the Logged Boot selection. After selecting it, your PC will try to
boot normally but due to your problem, it will probably not make into
Windows. Before rebooting and while Windows is still attempting to load, you
may try waiting about two minutes & then CTRL+ALT+DELETE. Take note of
everything that is running in the list and take special note of anything that
may say (Not Responding).

From here, go ahead and reboot back into Safe Mode. The Boot Log should have
been created and saved in My Computer-> C:\ If it is not there, use Start-
>Search and search for BOOTLOG.TXT

Post it and the startup list from MSCONFIG here. Between the two, that should
give an indication as to what is causing the problem. In the meantime, I
would also suggest running a full virus scan to be on the safe side.

Try the above first. If the above checks do not work or the information you
post here doesn't indicate the problem, we can go from there. The next steps
after the above would involve running scanreg from Start->Run, running a full
scandisk, possibly restoring the registry from an earlier point via Safe Mode
or command prompt, and/or using system restore to restore to an earlier point
when the PC was booting correctly. However, I believe that the info I asked
you to post should indicate the problem.

Just a side note, a DSO Exploit is virtually harmless if you have updated
Internet Explorer in the past 9 months or so from Microsoft but I would
remove it anyways. If you surf the web often, you can pretty much expect it
to pop up just about every time you run SpyBot. As for the ISearch regkeys,
it is a good thing that they were removed, but I can't see ISearch having a
bearing on why your PC won't boot normally unless there is still an ISearch
toolbar file that is trying to load and causing problems at startup. The
startup list will indicate if this is the case.

~Theta Sigma

Archived from groups: microsoft.public.windowsme.general (More info?)

"George" <anonymous@discussions.microsoft.com> wrote in
news:0f9201c518d3$11793790$a401280a@phx.gbl:

> Alright....the computer is booting up in Safe Mode. But
> restarting it in normal mode after that (as per Richard's
> suggestion) did not work. Follwoing Theta, I looked into
> the 'Msconfig'->Startup Tab-> and nothing really looked
> suspicious ! But I will put the list of the processes
> here today/tomorrow. By the way, in the safe mode, I ran
> Spybot and Ad-Aware and the found and removed 'DSO
> Exploit' and "Isearch Reg Key' respectively. I
> uninstalled the Spybot under the safe mode and tried to
> reboot normally.....but it's still not working. This
> feels so frustrating !!
>


One more quick question for you and one more suggestion...

Seeing as how your startup problem first occured after a spyware
scan/removal, this leads me to believe that your problem either lies in the
startup list (as stated in my previous post) or in the registry itself. The
registry is a very sensitive area and spyware programs, while rare, are
capable of detecting false-positives and as a result end up deleting vital
registry keys or values by mistake.

Just about every spyware program that I am aware of has the ability to
restore information that it has quarantined during detections. In Safe Mode,
reinstall SpyBot into the exact same folder where it originally was. (SpyBot
will not delete items in quarantine during an uninstall. The folder should
still be there). Using SpyBot, find the quarantine option and restore the
items from your most recent detections or from the time at which your boot
problem began. Now reboot. Did this fix your problem? If not, do the same
with Ad-Aware.

If either of these fixes the problem, you are receiving a "false-positive"
from that particular program and need to determine what is causing it. Update
that program and then run another scan but carefully scrutinize every single
file and/or regkey in the list. If you see one that you do not think is
actually spyware or are not sure about an entry, uncheck it (or them) and
delete the rest. You may also Google for any item(s) in question to give you
a better idea.

If you are not able to directly identify the false-positive, your boot
problem will happen again after a scan, you may have to use process of
elimination by scanning, deleting, and restoring one regkey or file at a time
until you find the false-positive. When you find it, right-click and select
"Add This Entry To The Ignore List". This could take quite a while but is
necessary, otherwise, you will encounter this problem every time you run a
spyware scan with that program.

My other post in this thread will also help determine the exact problem but I
wanted to bring this up as the problem originated here.

~Theta Sigma

Archived from groups: microsoft.public.windowsme.general (More info?)

Heeyyy Theta.....my PC is working again !! I am so
happy !! Tons of thanks to you and all the guys here !!!!

I remembered one little thing that I did. Frustrated with
Adaware and Spybot, I downloaded one little tool to
remove Isearch from the Isaerch website a few days back.
My goodness, that tool itself was a malware. It kept
running two programs, "Removal Tool" and "Kill" on
startup. Hijackthis finally found those out under the
safe mode. The things were marked with options
like "NOCANCEL" and "NORESTART" which made them
impossible to kill at the startup using the task manager.

Long live Hijackthis ! Long live anti-spyware well
wishers!

>-----Original Message-----
>"George" <anonymous@discussions.microsoft.com> wrote in
>news:0f9201c518d3$11793790$a401280a@phx.gbl:
>
>> Alright....the computer is booting up in Safe Mode.
But
>> restarting it in normal mode after that (as per
Richard's
>> suggestion) did not work. Follwoing Theta, I looked
into
>> the 'Msconfig'->Startup Tab-> and nothing really
looked
>> suspicious ! But I will put the list of the processes
>> here today/tomorrow. By the way, in the safe mode, I
ran
>> Spybot and Ad-Aware and the found and removed 'DSO
>> Exploit' and "Isearch Reg Key' respectively. I
>> uninstalled the Spybot under the safe mode and tried
to
>> reboot normally.....but it's still not working. This
>> feels so frustrating !!
>>
>
>
>One more quick question for you and one more
suggestion...
>
>Seeing as how your startup problem first occured after a
spyware
>scan/removal, this leads me to believe that your problem
either lies in the
>startup list (as stated in my previous post) or in the
registry itself. The
>registry is a very sensitive area and spyware programs,
while rare, are
>capable of detecting false-positives and as a result end
up deleting vital
>registry keys or values by mistake.
>
>Just about every spyware program that I am aware of has
the ability to
>restore information that it has quarantined during
detections. In Safe Mode,
>reinstall SpyBot into the exact same folder where it
originally was. (SpyBot
>will not delete items in quarantine during an uninstall.
The folder should
>still be there). Using SpyBot, find the quarantine
option and restore the
>items from your most recent detections or from the time
at which your boot
>problem began. Now reboot. Did this fix your problem? If
not, do the same
>with Ad-Aware.
>
>If either of these fixes the problem, you are receiving
a "false-positive"
>from that particular program and need to determine what
is causing it. Update
>that program and then run another scan but carefully
scrutinize every single
>file and/or regkey in the list. If you see one that you
do not think is
>actually spyware or are not sure about an entry, uncheck
it (or them) and
>delete the rest. You may also Google for any item(s) in
question to give you
>a better idea.
>
>If you are not able to directly identify the false-
positive, your boot
>problem will happen again after a scan, you may have to
use process of
>elimination by scanning, deleting, and restoring one
regkey or file at a time
>until you find the false-positive. When you find it,
right-click and select
>"Add This Entry To The Ignore List". This could take
quite a while but is
>necessary, otherwise, you will encounter this problem
every time you run a
>spyware scan with that program.
>
>My other post in this thread will also help determine
the exact problem but I
>wanted to bring this up as the problem originated here.
>
>~Theta Sigma
>
>
>
>.
>

Archived from groups: microsoft.public.windowsme.general (More info?)

"George" <anonymous@discussions.microsoft.com> wrote in
news:036701c51960$2b030460$a401280a@phx.gbl:

> Heeyyy Theta.....my PC is working again !! I am so
> happy !! Tons of thanks to you and all the guys here !!!!
>
> I remembered one little thing that I did. Frustrated with
> Adaware and Spybot, I downloaded one little tool to
> remove Isearch from the Isaerch website a few days back.
> My goodness, that tool itself was a malware. It kept
> running two programs, "Removal Tool" and "Kill" on
> startup. Hijackthis finally found those out under the
> safe mode. The things were marked with options
> like "NOCANCEL" and "NORESTART" which made them
> impossible to kill at the startup using the task manager.
>
> Long live Hijackthis ! Long live anti-spyware well
> wishers!
>


Glad to hear it George :-)

Be sure to work towards removing all of the entries in the registry for both
the spyware and the malware itself. From multiple personal experiences,
Webroot's Spysweeper seems to be much more effective at dealing with Isearch
than either AdAware or SpyBot. The trial version is available at
http://www.webroot.com

It's a trial (no updates) but after using it the first time, all traces of
Isearch & the Isearch malware should be completely eliminated (along with
many other spyware traces that AdAware & SpyBot will not detect).

Also, my personal preference for web browsers is Mozilla's Firefox. It is
fully customizable (via customizable plugins), more options, security, and
faster than Internet Explorer, built in popup blocker, built in ad-blocker,
and is virtually immune to spyware/adware. If you'd like to give it a try:
http://www.mozilla.org

~Theta Sigma