PDA

View Full Version : Please help to remove hotsearchbox.com.

weyoun21
15 Apr 2004, 11:27pm
Thanks to all the wonderful help and advice I've found on this site, I was able to get rid of the Omegasearch.com spyware. However, when I opened a browser window after a reboot, I found out that my computer still seems to be "infected" by spyware. I ran HijackThis and it turned out that hotsearchbox.com seemingly took the place of the Omegasearch.com spyware. When trying to fix it with HijackThis, it works for the time being but all the hotsearchbox.com files are back after another reboot.

This is the HijackThis log:

1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1C050EE9-F851-7B21-5AA2-0D36EDE58F0C} - C:\PROGRA~1\CAKEBO~1\Atomonce.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\system32\cdplayer.exe -tray
O4 - HKLM\..\Run: [SystemSearch] C:/WINNT/REGEDIT.EXE -s C:/WINNT/system.reg
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [AIM] C:\Programme\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Semagic.lnk = C:\Programme\Semagic\LiveJournal.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {11111111-1111-1111-1111-111300000000} - mhtml:C:\\NO_SUCH_MHT.MHT!http://216.240.137.40/go.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38029.5034837963
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

I'd be grateful for help. Thanks in advance!!
Dexter
15 Apr 2004, 11:43pm
Welcome to Short-Media.

I recommend you restart your computer in SAFE MODE, and re-run HJT to remove:


1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online

O2 - BHO: (no name) - {1C050EE9-F851-7B21-5AA2-0D36EDE58F0C} - C:\PROGRA~1\CAKEBO~1\Atomonce.dll


Also, search for this file on your hard drive:

C:\PROGRA~1\CAKEBO~1\Atomonce.dll

It looks like an Omegasearch variant. Delete it if you find it. It will be in your Program Files folder, in a folder who's name will start with "CAKEBO" Please come back and tell me the full name of that folder if you find it.


That should clear you up. Come back and let us know.

Dexter...
weyoun21
16 Apr 2004, 12:40am
Thanks for the welcome as well as your quick reply. :)

Regarding this...

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online

T-Online is my internet provider (it's a German provider for I am in Germany). Will it have consequences if I fix it with HJT? Thanks in advance!

As for the file, I found it and was able to delete it. The folder's complete name was "Cake Bone".
Leonardo
16 Apr 2004, 01:06am
Wilkommen! Beim Short-Media, alle ist hier spitze! Unser gruppe koennen immer mit Tech fragen hilfen. (Tut mir aber sehr leid - mein Deutsch ist oft schlecht.)

Does your internet browser automatically open to T-Online when you start the browser? I believe the "~= Microsoft Internet Explorer von T-Online" simply means that is what your browser's 'home page' is set to. I'd leave it alone for now. Let someone with more security expertise than me make the decision.
Dexter
16 Apr 2004, 01:15am
Thanks for the welcome as well as your quick reply. :)

Regarding this...

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online

T-Online is my internet provider (it's a German provider for I am in Germany). Will it have consequences if I fix it with HJT? Thanks in advance!

As for the file, I found it and was able to delete it. The folder's complete name was "Cake Bone".


You are very welcome.

You can take that item out. What it does is set your Internet Explorer so that every browser window has the title read: "Microsoft Internet Explorer von T-Online" up top in the blue title area. I am betting that your Internet Service Provider gave you an "installation CD", right? That's probably where it came from. If you take that out, it will just revert to the normal setting. You can leave it in if you want to as well, it's not hurting anything. I just hate even my ISP advertising to me in my browser window, that's why I suggested you take it out :)

Glad we could help you, we hope you stick around. We have several Eurpoean users here, but I think you are the first from Germany!

We'll have to add more flags soon:

:Canflag: :ukflag: :sweflag: :usflag:

Dexter...
Leonardo
16 Apr 2004, 01:25am
Thanks, Dexter. That's what I thought; it's just with HijackThis, you need to be absolutely sure when deleting entries. (So I wanted someone else to be on the blame line if things went awry! :rolleyes: ;D )
weyoun21
16 Apr 2004, 10:22am
@Leonardo-

Thanks for the welcome! And I think your German is quite good! :)

@Dexter-


You are very welcome.

You can take that item out. What it does is set your Internet Explorer so that every browser window has the title read: "Microsoft Internet Explorer von T-Online" up top in the blue title area. I am betting that your Internet Service Provider gave you an "installation CD", right? That's probably where it came from. If you take that out, it will just revert to the normal setting. You can leave it in if you want to as well, it's not hurting anything. I just hate even my ISP advertising to me in my browser window, that's why I suggested you take it out :)

Glad we could help you, we hope you stick around. We have several Eurpoean users here, but I think you are the first from Germany!

We'll have to add more flags soon:

:Canflag: :ukflag: :sweflag: :usflag:

Dexter...

Thanks, you're completely right, that's how my provider's name popped up there. :)

I'm sure I'll stick around as this site seems to be quite wonderful and as you guys are great! :) I'd love to see a German flag around too...

However, the hotsearchbox.com problem isn't resolved yet. I ran HJT in safe mode, this is the log:

Scan saved at 10:41:22, on 16.04.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\userinit.exe
C:\WINNT\Explorer.EXE
C:\Dokumente und Einstellungen\Verena Sambale.VERENA-3ODJ4YR7\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmx.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [DeluxeCD] C:\WINNT\system32\cdplayer.exe -tray
O4 - HKLM\..\Run: [SystemSearch] C:/WINNT/REGEDIT.EXE -s C:/WINNT/system.reg
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [AIM] C:\Programme\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Semagic.lnk = C:\Programme\Semagic\LiveJournal.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {11111111-1111-1111-1111-111300000000} - mhtml:C:\\NO_SUCH_MHT.MHT!http://216.240.137.40/go.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38029.5034837963
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

I fixed all the items you pointed out in that other post but when I reboot and run HJT again, everything's there still/again.

I checked my Program files for folders like the Cake Bone one but didn't find anything else that looked like that one (or so I think).

Thanks again in advance for your help.

-Verena-
shwaip
16 Apr 2004, 10:35am
this needs to go:
O16 - DPF: {11111111-1111-1111-1111-111300000000} - mhtml:C:\\NO_SUCH_MHT.MHT!http://216.240.137.40/go.exe
Dexter
16 Apr 2004, 10:37am
Please re-run HJT in NORMAL MODE, not SAFE MODE.

On the bottom right hand side, locate the button that says CONFIG, and click it. Then click on MISC TOOLS. Then click on GENERATE STARTUP LIST LOG. Copy that startup log, and paste it here.

Dexter...
weyoun21
16 Apr 2004, 10:49am
Alright, did it, here it is...

StartupList report, 16.04.2004, 11:55:30
StartupList version: 1.52
Started from : C:\Dokumente und Einstellungen\Verena Sambale.VERENA-3ODJ4YR7\Desktop\HijackThis.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINNT\system32\cdplayer.exe
C:\WINNT\system32\internat.exe
C:\Programme\AIM95\aim.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\Semagic\LiveJournal.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINNT\System32\rsvp.exe
C:\Dokumente und Einstellungen\Verena Sambale.VERENA-3ODJ4YR7\Desktop\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Dokumente und Einstellungen\Verena Sambale.VERENA-3ODJ4YR7\Startmenü\Programme\Autostart]
Semagic.lnk = C:\Programme\Semagic\LiveJournal.exe

Shell folders Common Startup:
[C:\Dokumente und Einstellungen\All Users.WINNT\Startmenü\Programme\Autostart]
Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
LoadQM = loadqm.exe
ccApp = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
ccRegVfy = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
DeluxeCD = C:\WINNT\system32\cdplayer.exe -tray
SystemSearch = C:/WINNT/REGEDIT.EXE -s C:/WINNT/system.reg

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

internat.exe = internat.exe
AIM = C:\Programme\AIM95\aim.exe -cnetwait.odl
msnmsgr = "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINNT\system32\ssstars.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
NAV Helper - C:\Programme\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Norton AntiVirus - Meinen Computer prüfen.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{11111111-1111-1111-1111-111300000000}]
CODEBASE = mhtml:C:\\NO_SUCH_MHT.MHT!http://216.240.137.40/go.exe

[FileSharingCtrl Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\fsmsngr-en.dll
CODEBASE = http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab

[MessengerStatsClient Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab

[Update Class]
InProcServer32 = C:\WINNT\system32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38029.5034837963

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\system32\webcheck.dll
SysTray: stobject.dll

--------------------------------------------------
End of report, 5.562 bytes
Report generated in 0,250 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


-Verena-
shwaip
16 Apr 2004, 04:53pm
I think....THINK... that rsvp.exe is malware. I found a couple places on the 'net that said so, but I'm not sure.

you will need to get rid of
O16 - DPF: {11111111-1111-1111-1111-111300000000} - mhtml:C:\\NO_SUCH_MHT.MHT!http://216.240.137.40/go.exe
weyoun21
16 Apr 2004, 05:04pm
Hm. I did get rid of that file, weird that it shows up again. I'll check again.

Thanks!!

-Verena-
Shuky
16 Apr 2004, 05:44pm
Hi
I ran to this problem some weeks ago, and I did the following to get rid of it.
Hope it will help you too.
Shuky.
----------------------

hotsearchbox sets your Home Page, Search Page, Search Bar, Search Url,
Default Page Url, Search Prefix and Search Assistant and
CustomizeSearch to www.hotsearchbox.com. The hijack is reinstalled at reboot using a
.reg file

Searching for "hotsearchbox" as a text content brings me to a file
named c:\ie.reg .

Now I did the following:

Start the registry editor. This is done by clicking Start then Run.
(The Run dialog will appear.) Type regedit and click OK. (The registry
editor will open.)
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \
Run'
In the right pane, delete 'SystemSearch', if it exists. (Here I
found the ie.reg)
Exit the registry editor.
Start Windows Explorer and delete:
c:\ie.reg
Start the registry editor. This is done by clicking Start then Run.
(The Run dialog will appear.) Type regedit and click OK. (The registry
editor will open.)
Use the search function in the registry editor to find
www.hotsearchbox.com and restore all the value hotsearchbox has changed.
(hotsearchbox has changed my Home Page, Search Page, Search Bar, Search Url,
Default Page Url, Search Prefix, Search Assistant and CustomizeSearch to
www.hotsearchbox.com)
Exit the registry editor.

Shuky.
Dexter
16 Apr 2004, 11:16pm
I think....THINK... that rsvp.exe is malware. I found a couple places on the 'net that said so, but I'm not sure.


RSVP.exe is a standard file in Win 2000. It can be exploited by viruses, but this may not be the case here.

Dexter...
weyoun21
16 Apr 2004, 11:17pm
Thanks, Shuky, I did as you said and it seems to have helped! I'm not used anymore to my browser opening without the search window on the left side. o.o Thanks a lot!!! :D

-Verena-
Dexter
16 Apr 2004, 11:18pm
Good Job Shuky!

Dexter...
Strainul
24 Apr 2004, 10:23am
Hello everyone,

I ran into your discussion after searching for a solution to a similar problem:
my browser settings, speciffically the search pane, get changed after every reboot to topsearcher.com. After a short interval, a new, impossible to close window pops with that site loaded. I tried using AdAware to remove the problem, namely the registry keys, similar to the ones discussed here, but the problem reoccurs after a reboot. I discovered the culprit to be a .reg file that gets loaded at startup. Here is the line:
C:/WINNT/REGEDIT.EXE -s C:/WINNT/system.reg
When I searched for topsearcher.com within files, I found it in this system.reg file. Here is what that file looks like:

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SystemSearch"="C:/WINNT/REGEDIT.EXE -s C:/WINNT/system.reg"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.topsearcher.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.topsearcher.com/ie/"
"Search Page"="http://www.topsearcher.com/ie/"
"Search Bar"="http://www.topsearcher.com/ie/"
"SearchURL"="http://www.topsearcher.com/ie/"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.topsearcher.com/ie/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.topsearcher.com/ie/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.topsearcher.com/ie/"
"Default_Search_URL"="http://www.topsearcher.com/ie/"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout"=hex:11,00,00,00,4c,00,00,00,00,00,00,00,30,00,00,00,1b,00,00,00,\
64,00,00,00,01,00,00,00,a0,06,00,00,e9,02,00,00,05,00,00,00,62,04,00,00,26,\
00,00,00,02,00,00,00,a1,06,00,00,f7,02,00,00,04,00,00,00,a1,00,00,00,11,03,\
00,00,03,00,00,00,a9,02,00,00,0b,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,01,24,d0,30,81,6a,d0,11,82,74,00,c0,4f,\
d5,ae,38,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

I deleted the file, ran AdAware to remove the registry keys and rebooted. The problem went away. I hope this helps.
Strainul
Strainul
24 Apr 2004, 10:28am
[QUOTE=weyoun21]Alright, did it, here it is...


Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemSearch = C:/WINNT/REGEDIT.EXE -s C:/WINNT/system.reg

--------------------------------------------------

I believe here lies your problem, in this system.reg file. See my other, more detailed post for instructions.
Cheers and good luck!