Spyware is killing me

[jcandiff]

SPy ware or some other type of program is changing my search engine when i click on Search. i am behind a firewall and i cannot see which search engine it is actually being change to ,but its obviously a site that my firewall does not like because i get the "Forbidden" mesage. Everytime i go into IE for the first time after rebooting it take me to this site for my searches.I am forced to run the Google.com registry file to change it to googles search.This is very annoying and would apreciate any help in identifying the culprit.
Ive already ran multiple spyware programs and reg cleaners.

What have i done:Ive checked startup(msconfig), win.ini(load and run=) and registry however there are so many services and programs running that i cannot identify all of them.

Below are a few of the posible culprits that i canot identify.

Startup:

Atipaxx.exe
Loadqm.exe
dpmw32.exe
wnad.exe
qttask.exe
instantaccess.exe /h
.lnk

I am especially confused about the last one.

 

[SavvyLady]

hi jcansiff,

Of the spyware removers that you used ... was Ad-Aware one of them?
If not I suggest w/ all the faith in the world .. this is the one to use.


http://www.lavasoftusa.com

try it if you haven't already ... its great!!


Savvy

 

[jbcalg]

is it a personal or corporate firewall?
if personal - turn it off and see where you go, that will help remove the reference in your registry, or look at the firewall log

what does ie have as a start up, is it as simple as changing the start page ?

otherwise:
dl ad aware (if you haven't already) and latest pattern and run it, delete all spyware components, then see what you get
http://www.lavasoftusa.com/index.html

http://www.pacs-portal.co.uk/startup_content.htm#Select is a useful site for some of these references

all references found through http://www.google.com - the best little search engine around

some of these you can remove:

Atipaxx.exe = video card

Loadqm.exe = Loads the MSN Explorer Query Manager - a waste of resources and bandwidth. Not required

dpmw32.exe = Novell Distributed Printer Services - part of Novell's Netware Client and Groupwise products. Not needed if you don't use this feature

wnad.exe = Run regedit. Edit, find, enter WNAD. when it finds it, toss it. BACK UP YOUR REGISTRY FIRST - some osama game crap

qttask.exe =Apple's "Quick Time" viewer from version 5 onwards. Not required

instantaccess.exe /h = Xerox Textbridge OCR software (uncheck it, don't need it loaded to start)

.lnk = ?

you might want to try regclean or another registry cleaner again too: (although you've run them already)
http://download.cnet.com/downloads/...rch&qt=registry+cleaner&cn=Utilities&ca=10001
or
http://hotfiles.zdnet.com/cgi-bin/t...uk&link=1&search_max=12&Utext=registry&UTcat=

 

[jcandiff]

Ive used Adware already.
Its not my start up page , it is the search page that apears on the left when i click the search button.
I am behind a corporate firewall.
I do not know the name of the searchengine it is trying to use but i suppose i can look at it in the registry before running the reg file i made however, that will still not tell me where it is comming from?
Can any of you eliminate any of those programs i listed above as possible culprits?

 

[jbcalg]

Atipaxx.exe = prob not culprit
Loadqm.exe = may be culprit, uncheck and see
dpmw32.exe = prob not culprit
wnad.exe = may be, just uncheck it in msconfig, but try to get rid of it in registry
qttask.exe = prob not culprit, uncheck it
instantaccess.exe /h = prob not culprit, uncheck anyways
.lnk = ? = may be, just uncheck it in msconfig

them's my guesses

i use the google toolbar and it's search engine, and remove the search button from the main toolbar through right click, customize
- never liked the built in search anyways

 

[Rollin' Rog]

I thought Ad-aware was supposed to get rid if Wnad, but if not, see this link for instructions -- it is "spyware"

http://www.cexx.org/osama.htm

The search problem may be related to the issue discussed in this thread -- do you see an entry for sp.dll ?

http://forums.techguy.org/showthread.php?s=&threadid=57776&highlight=sp.dll

By the way, .lnk is an extension indicating a shortcut. There should be more to the name. The shortcut will probably be in your Programs\Startup folder. These are often used to run files which modify the registry or do other things regarding homepages and such.

Office programs like Find Fast also use them.

 

[SavvyLady]

when you click on search does the search engine become memobook?

 

[jcandiff]

Thanks for all of your replys.
I did find the origion of the .lnk file.It ws for an online backup program that my company uses.
When i click on the Search button a Memo pad does not open.It actually is attempting to access a search page.I remember seeing it in the registry but i donot remember the origion.I will check it next time i reboot.
Also,if i dont immediately run the Google reg file, i get pop ups from blocked sites