1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

one for the experts !

Discussion in 'Web & Email' started by Marlo, Feb 18, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. Marlo

    Marlo Thread Starter

    Joined:
    Feb 23, 1999
    Messages:
    54
    In IE6, my homepage is set to my website, www.cityofcanton.com All of a sudden, when I open IE, this bogus "searchex.com" page opens.

    I dumped all cookies, tem, temp internet, content IE files, emptied auto complete and dumped all hidden urls in index.dat files. Even re-booted.

    It still comes up. I went into Tools + Internet Options + General and when I deleted my homepage and tried to re-enter it, I see that www.searchex.com is in the drop down box. I can't delete it.

    once I bring the browser up, if I hit "HOME" then my home page comes up, but I get this bogus page every time I open the browser.

    I had someone search my registry and they didn't find anything in there. It is in the temp internets files under Content IE, but when I delete the whole file, it comes back as soon as I open my browser. I think if I can delete it from the area where you set your homepage, I can get rid of it. Any way to delete that?

    My OS is W98, Norton doesn't detect any virul and I have the free version of Zone Alarm, so I'm not sure what this is or how to get rid of it. Any help is appreciated. Thanks

    Marlo
    [email protected]
     
  2. Corrosive

    Corrosive

    Joined:
    Jan 9, 2003
    Messages:
    1,058
    Sounds to me like a so-called Browser Helper Object, or BHO.

    If you havn't already, download "Hijack This!". Just run the app and post the log here, and we should be able to find this.
     
  3. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
  4. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    SearchEx actually installs 3 different BHOs.

    Please do this:

    Go to http://www.spywareinfo.com/downloads.php#det , and download 'Hijack This!'.
    Unzip, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log somewhere, and please show us its contents.
     
  5. Marlo

    Marlo Thread Starter

    Joined:
    Feb 23, 1999
    Messages:
    54
    One of our computer techs at work found some info on my problem. Searchex is a homepage and search-hijacker.

    It is bundled with "NetSpeed" software from winstream.com, who are believed to be the authors of Searchex.

    He had instructions that said spybot S&D will automatically remove it, and then there were also instructions on which files to remove to get rid of it manually.

    He removed all the files, thoroughly searched the registry, and still, this annoying page kept coming up.

    Still stumped, he went into IE Tools + options + Advanced and started looking at the items there. Under Browsing, the option "Enable third-party browsing extensions" was checked. He unchecked it, restarted, and the searchex.com demon was gone. It now goes to my home page as set in options.

    So anyone with hijack/parasite problems might try that first. I know it sounds simple, but we've rebooted several times and so far so good. I will get your recommended download so that I dont have to deal with this again. Thanks for your time.

    Marlo
     
  6. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Disabling third party browser extensions disables all BHOs, which may not be what you want.

    SpyBot detects two of the three SearchEX BHOs, but detection for the Hotlink.dll is upcoming.

    If you post a Hijack This log as explained before, we can get rid of those three BHOs in a minute, and you can re-enable third party browser extensions.

    Alternatively, download the attached bho.txt, and save as (rename to) bho.reg .

    Doubleclick bho.reg, and answer YES to add its contents to the Registry.

    Reboot and that will be the end of your SearchEX hijack.

    Cheers,
     

    Attached Files:

    • bho.txt
      File size:
      425 bytes
      Views:
      86
  7. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/119529

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice