1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

the search was changed, then "fixed" but it still dont work

Discussion in 'Virus & Other Malware Removal' started by Dude21, Feb 7, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. Dude21

    Dude21 Thread Starter

    Joined:
    Feb 7, 2004
    Messages:
    113
    I used to be able to type in a word in the search bar and it would take me to google search, untill some spyware was somehow installed on my computer so now when ever I type in something in the address bar like for an example test will take me too http:///?%20test and if I do Search test it takes me too http:///?%20Search%20test I tried doing this to restore it but it didnt work, so I went on over to the google site looked up help with my default search redid everything there and still no luck,
    I even tried editing my registry and nothing, the only thing thats different in it (HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main) is Search Page_bak
    I didnt see anything wrong or strange in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search or in Main either :confused: Any help?
     
  2. tsunam

    tsunam

    Joined:
    Sep 14, 2003
    Messages:
    1,240
    Alright do us a favor, download hijackthis and copy the log for us to look, its most likely some spyware thats taken over you ie from you. http://www.merijn.org/downloads.html thats the link for the hjt program.
     
  3. Dude21

    Dude21 Thread Starter

    Joined:
    Feb 7, 2004
    Messages:
    113
    Ok thanks, and heres the log file:
     
  4. Dude21

    Dude21 Thread Starter

    Joined:
    Feb 7, 2004
    Messages:
    113
    Hi, can anyone help? much thanks.
     
  5. dvk01

    dvk01 Derek Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    47,890
    nothing obvious there

    have you got more than one user acccount on the computer, if so post a log from each account.

    I've seen this behaviour affect all accounts, but only appear in one
     
  6. Dude21

    Dude21 Thread Starter

    Joined:
    Feb 7, 2004
    Messages:
    113
    No I only use one and thats owner
     
  7. Dude21

    Dude21 Thread Starter

    Joined:
    Feb 7, 2004
    Messages:
    113
    If it helps... here is everything I have in HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

    "NoUpdateCheck"=dword:00000001
    "NoJITSetup"=dword:00000001
    "Disable Script Debugger"="yes"
    "Show_ChannelBand"="No"
    "Anchor Underline"="yes"
    "Cache_Update_Frequency"="Once_Per_Session"
    "Display Inline Images"="yes"
    "Do404Search"=hex:01,00,00,00
    "Local Page"="C:\\WINDOWS\\System32\\blank.htm"
    "Save_Session_History_On_Exit"="no"
    "Show_FullURL"="no"
    "Show_StatusBar"="yes"
    "Show_ToolBar"="yes"
    "Show_URLinStatusBar"="yes"
    "Show_URLToolBar"="yes"
    "Start Page"="http://www.phpground.net/"
    "Use_DlgBox_Colors"="yes"
    "Search Page"="http://www.google.com"
    "Default_Page_URL"="http://qus8.hpwis.com/"
    "Default_Search_URL"="http://srch-qus8.hpwis.com/"
    "Search Bar"="http://g.msn.com/0SEENUS/SAOS01"
    "Use Custom Search URL"=dword:00000001
    "AddToFavoritesExpanded"=dword:00000001
    "FormSuggest PW Ask"="no"
    "Window_Placement"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,00,83,ff,ff,00,83,\
    ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,00,00,00,00,00,04,00,00,e2,02,00,\
    00
    "FullScreen"="no"
    "AutoSearch"=dword:00000004
    "NotifyDownloadComplete"="no"
    "Use FormSuggest"="no"
    "Use Search Asst"="no"
    "HistoryViewType"=hex:08,00,66,63,03,00,00,00,00,00
    "Error Dlg Displayed On Every Error"="no"
    "Error Dlg Details Pane Open"="yes"
    "HistoryTopNSitesView"=dword:00000014
    "Expand Alt Text"="no"
    "Move System Caret"="no"
    "NscSingleExpand"=dword:00000001
    "NoWebJITSetup"=dword:00000000
    "Page_Transitions"=dword:00000000
    "FavIntelliMenus"="no"
    "Enable Browser Extensions"="no"
    "UseThemes"=dword:00000000
    "Force Offscreen Composition"=dword:00000000
    "AllowWindowReuse"=dword:00000001
    "Friendly http errors"="yes"
    "ShowGoButton"="no"
    "SmoothScroll"=dword:00000000
    "Enable AutoImageResize"="no"
    "Enable_MyPics_Hoverbar"="yes"
    "Play_Animations"="yes"
    "Play_Background_Sounds"="yes"
    "Display Inline Videos"="yes"
    "Show image placeholders"=dword:00000000
    "Print_Background"="no"
    "Window Title"=""
    "Save Directory"="C:\\Documents and Settings\\Owner\\Desktop\\"
    "BandRest"="Never"
    "Start Page_bak"="http://www.phpground.net/"
    "Search Bar_bak"="http://www.google.com/ie"
    "Search Page_bak"="http://www.google.com"
    "Use Search Assistant"="no"

    and in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

    "Default_Page_URL"="http://qus8.hpwis.com/"
    "Default_Search_URL"="http://srch-qus8.hpwis.com/"
    "Search Page"="http://srch-qus8.hpwis.com/"
    "Enable_Disk_Cache"="yes"
    "Cache_Percent_of_Disk"=hex:0a,00,00,00
    "Delete_Temp_Files_On_Exit"="yes"
    "Local Page"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
    00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
    62,00,6c,00,61,00,6e,00,6b,00,2e,00,68,00,74,00,6d,00,00,00
    "Anchor_Visitation_Horizon"=hex:01,00,00,00
    "Use_Async_DNS"="yes"
    "Placeholder_Width"=hex:1a,00,00,00
    "Placeholder_Height"=hex:1a,00,00,00
    "Start Page"="http://qus8.hpwis.com/"
    "CompanyName"="Microsoft Corporation"
    "Custom_Key"="MICROSO"
    "Wizard_Version"="6.00.2800.1017"
    "Search Bar"="http://srch-qus8.hpwis.com/"
    "FullScreen"="no"
    "BandRest"="Never"
     
  8. cybertech

    cybertech Moderator

    Joined:
    Apr 16, 2002
    Messages:
    69,451
    Use HJT to fix this one:

    R3 - Default URLSearchHook is missing
     
  9. VirtualMe

    VirtualMe

    Joined:
    Sep 27, 2002
    Messages:
    867
    If cybertechs suggestion don't fix it then try this.


    Re: Help! I can't search from my Address Bar anymore! :(

    or download the attachment

    urlsearchhooks.txt

    Note: Only use attachment for Win XP only!


    to the desktop and and change it to

    urlsearchhooks.reg

    when ask if you want to change this file click YES

    double click it and click Yes and/or OK

    Then reset your seach page if need be.
     

    Attached Files:

  10. Dude21

    Dude21 Thread Starter

    Joined:
    Feb 7, 2004
    Messages:
    113
    @cybertech - I'm not sure what HJT or R3 is

    @VirtualMe - it worked! Thanks alot :D (y)
     
  11. Adam_Black

    Adam_Black

    Joined:
    Aug 12, 2003
    Messages:
    141
    Ugh.

    HJT = HijackThis

    R3 = type of suspicious registry key that HJT detects
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/201564