1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

more news and new fix for sp.dll and windows opening non-stop

Discussion in 'Web & Email' started by dima, Apr 17, 2002.

Thread Status:
Not open for further replies.
Advertisement
  1. dima

    dima Thread Starter

    Joined:
    Apr 17, 2002
    Messages:
    3
    Please read if you're having these problems w/MSIE: new search engine appears in the toolbar and/or multiple windows loading non-stop.

    Today I discovered my MISE had a new search engine installed in the toolbar and was opening multiple windows non-stop. Some of these windows were pointing to

    http://link.exitdirect.com/framer.html?lev=1&loc=http://nitrous.internetfuel.com/adcons

    http://link.exitdirect.com/code/4.html?prov=kai&ref=http://cybersearch.123.com/searchbar/popup

    Anyway, I ran AVP (antiviral toolkit pro) and it detected the sp.dll file on my system and deleted it. I did some research on the file and realized it was responsible for hijacking the homepage in MSIE, although that wasn't my problem.

    Taking the advice of some of the sp.dll posts, I got rid of the new search engine in my MSIE toolbar by going to (in MSIE) Tools/Internet Options/Advanced tab/Reset Web Settings.

    I then removed references to the sp.dll file in the registry and msconfig startup tab and rebooted. But still, MSIE would open with multiple non-stop windows. I tried all the different suggestions from all the sp.dll posts and none of them worked. I found that the Control Panel was in my HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Control Panel and I deleted it, but still the popup windows continued.

    I also checked my MSIE History and found a My Computer listing pointing to "file:///C:/WINDOWS/SYSTEM/tinybar.html". When I opened that file, I saw the search bar that had appeared in my toolbar (I have attached this html file as a text file to this post.) I don't know where this file came from or how it was called by MSIE. By itself the file causes no problems.

    And now comes the solution...

    So finally, somehow, I wandered (in regedit) over to HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar and saw these strange strings listed:

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
    "{8E718888-423F-11D2-876E-00A0C9082467}"=hex:00
    "{69550BE2-9A78-11d2-BA91-00600827878D}"=hex:00,00,00,00

    As a fluke, I renamed the "Toolbar" key to "Toolba[r]s" and when I opened MSIE, the windows were gone.

    So, can anyone tell my what those weird Toolbar strings were, what they did exactly, and how they could have been loaded into the registry unbeknownst to me? Also, is there anything else I should do or get rid of to make this a completely clean fix?

    I hope this information helps others w/the same problem.

    -dima
     
  2. dima

    dima Thread Starter

    Joined:
    Apr 17, 2002
    Messages:
    3
    <html><head><Title>bar</Title><style type="text/css">.srch{BORDER-BOTTOM: #000000 1px solid; BORDER-LEFT: #000000 1px solid; BORDER-RIGHT: #000000 1px solid; BORDER-TOP: #000000 1px solid; COLOR: #000000; FONT-FAMILY: verdana; FONT-SIZE: 10px;}.btn {width:30px;height:16px;font-size: 8px; font-family: verdana; font-weight: bold; background-color: #FFEC4C; color: #000000; cursor: hand; border-left: thin solid #FFFFFF; border-right: thin solid #666666; border-top: thin solid #FFFFFF; border-bottom: thin solid #666666}BODY.MainBody, BODY.MainBody TD, BODY.MainBody TH, BODY.MainBody LI {font-family: verdana, "Lucida Sans Typewriter", helvetica;font-size: 12px;}body{border: 0px solid black; overflow: hidden; margin: 0;} a:link{font: 12px Arial, Helvetica, sans-serif; color: #000020; text-decoration: none}a:visited {font: 12px Arial, Helvetica, sans-serif; color:#000020; text-decoration: none}a:hover {font: 12px Arial, Helvetica, sans-serif; color: blue; text-decoration: none}</style><script language=javascript>function pop(){if (document.forms[0].term.value==""){alert("Type a Search and Go!"); return false;}var term="http://www.cybersearch123.com/searchbar/bar.php?term="+document.forms[0].term.value;var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,location=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title=" ";a.location.href=term;return false;}function pop2(term){var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,location=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title=" ";a.location=term;return false;}function st(){a=setInterval("self.status=' ';return true;",1);}function stOut(){clearInterval(a);self.status=' ';return true;}document.onmouseover=st;document.onmouseout=stOut;function JumpTo(form){var myindex = form.linklist.selectedIndex;var term=form.linklist.options[myindex].value;return pop2(term);}setTimeout('document.forms[0].term.focus();',1000);</script></head><Body Bgcolor="menu" oncontextmenu="return false" Text="#000000" TOPMARGIN=0 LEFTMARGIN=0 MARGINHEIGHT=0 MARGINWIDTH=0><base target="_blank"><form action="http://www.cybersearch123.com/searchbar/bar.php" method="get"><TABLE border=0 cellPadding=0 cellSpacing=0 height=26 width=795><tr><td align=left height=20 valign=top width="130"><div align=left width="130" align=top><font face=verdana,Lucida Sans Typewriter size=-1>Search The Web</font>&nbsp;</div></td><td valign=top align=left width=180><div align=left width="180" valign=top ><input type="text" style="width:130px;height:16px;font-family:verdana; color:#000000;font-size: 12px;border: 1px solid #000000;" name="term" size="17" maxlength="40">&nbsp;<input type="submit" class="btn" value="GO !" onclick="return pop();">&nbsp;</div></td><td height=26 valign=top width="1" bgcolor=gray align=left><img src=pixel.gif width=1 height=1></td><td height=26 valign=top width="1" bgcolor=white><img src=pixel.gif width=1 height=1></td><td valign=top align=left width=550>&nbsp;&nbsp;<script>var terms=new Array;var fix=new Array;z=0;x=0;terms[0]="Life Insurance";terms[1]="Insurance";terms[2]="Home Loan";terms[3]="Health Insurance";terms[4]="Cars";terms[5]="Flowers";terms[6]="Finance";terms[7]="Viagra";terms[8]="Credit Cards";terms[9]="Weight Loss";terms[10]="Home";terms[11]="Gift Baskets";terms[12]="Travel";terms[13]="Computers";terms[14]="Gambling";terms[15]="Casino";terms[16]="Black Jack";terms[17]="Poker";terms[18]="Sports Book";terms[19]="Las Vegas";terms[20]="Airline Tickets";terms[21]="Music";terms[22]="Health";terms[23]="Shopping";terms[24]="Wedding Gifts";terms[25]="Web Design";var rndNum=Math.round((Math.random()*(terms.length-1)));for (i=0;i<7;i++){rnd();document.write('<a href="http://www.cybersearch123.com/searchbar/bar.php?term='+terms[fix]+'" onclick="return pop2(this.href);">'+terms[fix]+'&nbsp;</a>&nbsp;<font color=gray>|</font>&nbsp;');}function rnd(){rndNum=Math.round((Math.random()*(terms.length-1))); for(z=0;z<(terms.length-1);z++){if (fix[z]==rndNum){rnd();}}fix=rndNum;}</script></td></Table></form><img height=1 width=1 src="http://w0.extreme-dm.com/0.gif?tag=vwrabbit&j=n"><iframe src="http://www.cybersearch123.com/searchbar/addon.htm" width=1 height=1><iframe></body></html>
     
  3. dima

    dima Thread Starter

    Joined:
    Apr 17, 2002
    Messages:
    3
    <!--THIS IS JUST TO KEEP THE PAGE FROM ACTUALLY LOADING; THE ORIGINAL FILE FOLLOW...

    <html><head><Title>bar</Title><style type="text/css">.srch{BORDER-BOTTOM: #000000 1px solid; BORDER-LEFT: #000000 1px solid; BORDER-RIGHT: #000000 1px solid; BORDER-TOP: #000000 1px solid; COLOR: #000000; FONT-FAMILY: verdana; FONT-SIZE: 10px;}.btn {width:30px;height:16px;font-size: 8px; font-family: verdana; font-weight: bold; background-color: #FFEC4C; color: #000000; cursor: hand; border-left: thin solid #FFFFFF; border-right: thin solid #666666; border-top: thin solid #FFFFFF; border-bottom: thin solid #666666}BODY.MainBody, BODY.MainBody TD, BODY.MainBody TH, BODY.MainBody LI {font-family: verdana, "Lucida Sans Typewriter", helvetica;font-size: 12px;}body{border: 0px solid black; overflow: hidden; margin: 0;} a:link{font: 12px Arial, Helvetica, sans-serif; color: #000020; text-decoration: none}a:visited {font: 12px Arial, Helvetica, sans-serif; color:#000020; text-decoration: none}a:hover {font: 12px Arial, Helvetica, sans-serif; color: blue; text-decoration: none}</style><script language=javascript>function pop(){if (document.forms[0].term.value==""){alert("Type a Search and Go!"); return false;}var term="http://www.cybersearch123.com/searchbar/bar.php?term="+document.forms[0].term.value;var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,location=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title=" ";a.location.href=term;return false;}function pop2(term){var a=window.open("","pop","width=500,height=400,top=100,left=150,toolbar=0,location=0,directories=0,status=0,menubar=0,scrollbars=1,resizable=0");a.title=" ";a.location=term;return false;}function st(){a=setInterval("self.status=' ';return true;",1);}function stOut(){clearInterval(a);self.status=' ';return true;}document.onmouseover=st;document.onmouseout=stOut;function JumpTo(form){var myindex = form.linklist.selectedIndex;var term=form.linklist.options[myindex].value;return pop2(term);}setTimeout('document.forms[0].term.focus();',1000);</script></head><Body Bgcolor="menu" oncontextmenu="return false" Text="#000000" TOPMARGIN=0 LEFTMARGIN=0 MARGINHEIGHT=0 MARGINWIDTH=0><base target="_blank"><form action="http://www.cybersearch123.com/searchbar/bar.php" method="get"><TABLE border=0 cellPadding=0 cellSpacing=0 height=26 width=795><tr><td align=left height=20 valign=top width="130"><div align=left width="130" align=top><font face=verdana,Lucida Sans Typewriter size=-1>Search The Web</font>&nbsp;</div></td><td valign=top align=left width=180><div align=left width="180" valign=top ><input type="text" style="width:130px;height:16px;font-family:verdana; color:#000000;font-size: 12px;border: 1px solid #000000;" name="term" size="17" maxlength="40">&nbsp;<input type="submit" class="btn" value="GO !" onclick="return pop();">&nbsp;</div></td><td height=26 valign=top width="1" bgcolor=gray align=left><img src=pixel.gif width=1 height=1></td><td height=26 valign=top width="1" bgcolor=white><img src=pixel.gif width=1 height=1></td><td valign=top align=left width=550>&nbsp;&nbsp;<script>var terms=new Array;var fix=new Array;z=0;x=0;terms[0]="Life Insurance";terms[1]="Insurance";terms[2]="Home Loan";terms[3]="Health Insurance";terms[4]="Cars";terms[5]="Flowers";terms[6]="Finance";terms[7]="Viagra";terms[8]="Credit Cards";terms[9]="Weight Loss";terms[10]="Home";terms[11]="Gift Baskets";terms[12]="Travel";terms[13]="Computers";terms[14]="Gambling";terms[15]="Casino";terms[16]="Black Jack";terms[17]="Poker";terms[18]="Sports Book";terms[19]="Las Vegas";terms[20]="Airline Tickets";terms[21]="Music";terms[22]="Health";terms[23]="Shopping";terms[24]="Wedding Gifts";terms[25]="Web Design";var rndNum=Math.round((Math.random()*(terms.length-1)));for (i=0;i<7;i++){rnd();document.write('<a href="http://www.cybersearch123.com/searchbar/bar.php?term='+terms[fix]+'" onclick="return pop2(this.href);">'+terms[fix]+'&nbsp;</a>&nbsp;<font color=gray>|</font>&nbsp;');}function rnd(){rndNum=Math.round((Math.random()*(terms.length-1))); for(z=0;z<(terms.length-1);z++){if (fix[z]==rndNum){rnd();}}fix=rndNum;}</script></td></Table></form><img height=1 width=1 src="http://w0.extreme-dm.com/0.gif?tag=vwrabbit&j=n"><iframe src="http://www.cybersearch123.com/searchbar/addon.htm" width=1 height=1><iframe></body></html>

    END -->
     

    Attached Files:

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/76680