Hijacked IE

My i.e has been hijacked by mysearch/find manager toolbar. I cannot use i.e without this thing creating merry hell, redirecting me and continually putting up find managers toolbar.

I have gone through the add/remove programs, nothing, including hidden files.
I have searched the hd, nothing
I have run adware, nothing
I have run spybot, nothing, except it notifies me that i.e has been altered by mysearch.
I have run avg, nothing.

The thing is there, how do I remove it and the damn toolbar when everything fails to see find them? Any ideas on how to remove it from my system, it even has tendrils wrapped into my outlook express?

I have been forced to use Avant which is not suitable and has even caused me problems with this site. Mozilla and I do not get on period. I.e for all it's faults suits my needs and I'd love to have it back to normal.

Thanks.

http://www.kephyr.com/spywarescanner...ar/index.phtml See if that helps.

I've seen this before. I don't believe Ad-Aware or Spybot consider it spyware, because I believe it has to be installed by the user. Not positive on that.

Regards,
Xierox

/edit - remembered something.

Thanks I am checking the files, I am unsure and unsettled about delving into the registery.


This thing I believe came via a popup I had to click the 'close' button on to get rid of it. Then this appeared. Very sneaky.

Go to your control panel > add remove programs > remove MySearch toolbar.

Then run adaware and spybot to see if there are lingering processes from the uninstall.

Reboot!

:)

Have you updated Ad-aware and Spybot? Both programs are very much similar to virus scanners and should be updated with the lasted reference files or definition files. Both have the function to check for, download updates, and install them pretty much automatically. Sometimes for one reason or another this feature can stop working and you have to download the updates manualy and install them. You will also want to make sure you AVG as well.

To update adaware Automatiacly open adaware and click on the open web update button that should be located at the upper right of of the program. Have it check to see if there are any updates needed. It will then tell you if any updates are needed. If for some reason this does not work You will want to install them manually.

Adaware updates can be found here: http://www.lavasoftusa.com/support/download/
The most current update as of right now is: 01R334 24.07.2004
Its a zip file that you will have to decompress and install the new definitions by moving the reflist.ref file to the ad-aware folder, I would suggest renaming the old one to reflist.old first.
I also would suggest using the immunize featue of spybot.


To update Spybot Automatiacly, open it, and search for updates. You will want detection rules if show there is a newer version(if it shows up it's newer.)
Spybot updates can be found here: http://www.safer-networking.org/en/download/index.html
The most current update as of right now is:Detection updates 2004-07-29
Manually updating spybot is a little more simple. The update is an executible file that you just download and run.


Updates for AVG can be found here: http://www.grisoft.com/us/us_updt7.php I would go with the full update. Just pick the version of AVG you have and copy the new definitions to the AVG folder in the programs folder.

If after updating and scanning if the problem still remains, run Hijack this and post it in the forum. Somebody should look it over to see where the problem is more than likey at. HijackThis can be downloaded from here:
http://www.majorgeeks.com/download3155.html

The My search tool bar has been known to come with file sharing programs and other programs such as smiley central. disabling it will probley cause the program it came with to stop working. Theres also many diffrent varients of it.

Quote:

---

Originally posted here by pooh sun tzu
Go to your control panel > add remove programs > remove MySearch toolbar.

Then run adaware and spybot to see if there are lingering processes from the uninstall.

Reboot!

:)

---

I have gone through the add/remove programs, nothing, including hidden files.
I have searched the hd, nothing
I have run adware, nothing
I have run spybot, nothing, except it notifies me that i.e has been altered by mysearch.
I have run avg, nothing.

Quote:

---

I have gone through the add/remove programs, nothing, including hidden files.

---

Odd, I just installed and uninstalled MySearch doing that. I say it's something deeper than just one thing, and in all possibility another peice of spyware could be handling MySearch to protect it.


AVG is a waste of time and resources. Give this a shot: http://housecall.antivirus.com


(Deep inside of me I hope this ends up being a format and reinstall, simply because if you are determined to stick to IE then problems WILL happen repeatedly and this problem was expected. Even the US government issued a warning about switching over to Mozilla/Firefox/Opera because of the recent IE exploits)

Quote:

---

Originally posted here by spamdies
Have you updated Ad-aware and Spybot? Both programs are very much similar to virus scanners and should be updated with the lasted reference files or definition files. Both have the function to check for, download updates, and install them pretty much automatically. Sometimes for one reason or another this feature can stop working and you have to download the updates manualy and install them. You will also want to make sure you AVG as well.

To update adaware Automatiacly open adaware and click on the open web update button that should be located at the upper right of of the program. Have it check to see if there are any updates needed. It will then tell you if any updates are needed. If for some reason this does not work You will want to install them manually.

Adaware updates can be found here: http://www.lavasoftusa.com/support/download/
The most current update as of right now is: 01R334 24.07.2004
Its a zip file that you will have to decompress and install the new definitions by moving the reflist.ref file to the ad-aware folder, I would suggest renaming the old one to reflist.old first.
I also would suggest using the immunize featue of spybot.


To update Spybot Automatiacly, open it, and search for updates. You will want detection rules if show there is a newer version(if it shows up it's newer.)
Spybot updates can be found here: http://www.safer-networking.org/en/download/index.html
The most current update as of right now is:Detection updates 2004-07-29
Manually updating spybot is a little more simple. The update is an executible file that you just download and run.


Updates for AVG can be found here: http://www.grisoft.com/us/us_updt7.php I would go with the full update. Just pick the version of AVG you have and copy the new definitions to the AVG folder in the programs folder.

If after updating and scanning if the problem still remains, run Hijack this and post it in the forum. Somebody should look it over to see where the problem is more than likey at. HijackThis can be downloaded from here:
http://www.majorgeeks.com/download3155.html

The My search tool bar has been known to come with file sharing programs and other programs such as smiley central. disabling it will probley cause the program it came with to stop working. Theres also many diffrent varients of it.

---

Everything is upto date and the same applies nothing is located. Find manger is the toolbar and I can see it pop up everytime i.e myserach popss up to hijack the homepage and serach engine everytime it is launched . Yet nothing is found by any program or searching even in the hidden files.

So far I have found 2 registry elements(deleted) from the site that xierox kindly gave, and that is it.

Quote:

---

Originally posted here by pooh sun tzu
Odd, I just installed and uninstalled MySearch doing that. I say it's something deeper than just one thing, and in all possibility another peice of spyware could be handling MySearch to protect it.


AVG is a waste of time and resources. Give this a shot: http://housecall.antivirus.com


(Deep inside of me I hope this ends up being a format and reinstall, simply because if you are determined to stick to IE then problems WILL happen repeatedly and this problem was expected. Even the US government issued a warning about switching over to Mozilla/Firefox/Opera because of the recent IE exploits)

---

Tried housecall, nothing.

This thing is tricky, at least I have found some parts of it in the registery and wiped them out(hopefully). If that fails to remove the darn thing it is a reformat which will be the first time using XP.

I think what may have happend is my power failed as this thing went in so I got a part of it and the part I needed to unistall failed to get in. Thats my view on what happened unless mysearch got damn sneakier.

ok spybot 'can' find my search, at least the updated 1.3 version can. They put it as ignored. IMHO going into the ignored settings and unchecking the box to ignore 'my search' might help if this has not already been done.

Instead of doing a format and reinstall why dont you try doing a restore back to a date when my search wasnt infecting your computer programs/accesories/system tools/restore this might get rid of it without reinstalling windows

Vampiress, if you had a power failure while installing software, you could have more of a problem than just a hijacker.....and it sounds like it.

If you have and/or are willing to make backups of any important data you might have, then a reformat and reinstall of you OS might be the best thing to do.

I would highly suggest though that you consider another browser besides IE6, at least untill they get some of the more recent bugs out of it. You said you didn't like mozilla, but did you try the mozzila Firefox? It is a small light wieght browser that you can install extension in that cover almost any need you may have. It is also very quick and dependable. Also less succeptable to hijacks and maleware that IE6.

It is quite easy to do a complete reformat and reinstall, but all told it takes a couple of hours, if you have broadband, and considerably longer if you have dial up. And it is the Microsoft updates that take most of the time.

If you have a cd burner, than it would be advisable to down load a good av and firewall before you start and install those before you even go online the first time. Personally I would suggest AVG by Grisoft for your av and the Kerio firewall as your firewall.....both are free.

Also install the newest Spybot S&D and then update it and run the immuninizations section of it. Also as a complimentry program, SpywareBlaster is excellent for stopping alot of maleware from ever being loaded.

What ever way you decide to go -- reinstalling or working it out -- Good Luck

Seems nobody recommended HijackThis! and I would think it should handle the problem. If you're not sure what the scan log's all about then post it here and somebody will be more than happy to help out. HjT! will also take away the problem of digging into the registry as it would do it on its own and bring up the relevant keys.

Anyway you could remove stuf fon your own but again it might result in more problems than you already have. So if you're not sure bring the log here.

Quote:

---

Originally posted here by cytex
Instead of doing a format and reinstall why don't you try doing a restore back to a date when my search wasn't infecting your computer programs/accessories/system tools/restore this might get rid of it without reinstalling windows

---

I turned that feature off when I walked into virus.

It all seems ok now. I got rid of a few registry bugs, and deleted the folder, re-set the home page again. Rebooted Then found find manger is actually lop.com. Went there and found the un-installer and bingo I seem to have (touch wood) hijack free.

Ie unfortunately is in a sorry state, it needs repair but XP hasn't got the repair feature Me used to have, but is functioning. The passwords are shot to hell, so I may yet do a re-install.A fresh machine to start loading useless programs onmight be a better move yet.

I'll check out firefox.

Thanks all for the help.