Home Search Fix Problems

Unknown

Hello, i've never really posted on here before but through googling I found the Home Search Assistant Removal Guide to help me remove it from my parents computer. I followed it exactly step by step and wound up in worse shape. I got to the very end where it told me to reboot the computer back up in normal mode(step 12 or so in the guide). When I rebooted, the computer starts up in a low color and low resolution(like old school windows) and there is no mouse pointer. I have no clue as to what made it do this. No matter what I do it keeps loading that way. I even tried system restore and that didn't work. Has anyone ever had this happen? and do you know how to fix it? Any suggestions will help.

Dexter

You may have inadvertently removed some needed entries in HJT, and/or quarantined some needed items by mistake.

Please boot back up in Safe Mode, and get me a list of all items you put into quarantine manually. If you saved your HJT log as a text file, refer to that to figure out where quarantined files need to go back to, and put them back. Then, go back into HJT, click on Config -> Backups, and restore all backed up entries.

Let me know if that helps.

Dexter...

cakanode

I had already went back in and restored all deleted registry entries from HJT. I even restored the spybot and ad-aware values that I had deleted. Still messed up. It is my parents computer and they had never really kept it clean of spyware or anything. When I ran the first spyboy check a few days ago, it came up with 150 problems so I know it was riddled with problems. They may just take it to a computer shop to have it completely revamped. However, if you have any other ideas please let me know so that I may save them some money. I can post the HJT log if you'd like. Just let me know. Thanks so much for your help already.

Dexter

Yep, post the log.

Dexter...

cakanode

Here is the original log before everything went haywire. I could also post a log from running it now if you would like. Let me know. Thanks again.

Logfile of HijackThis v1.97.7
Scan saved at 9:39:42 PM, on 08/21/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\ADDWF32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BC0E155E-1A45-33EA-5DBD-50DE1453AE61} - C:\WINDOWS\MFCSK.DLL (file missing)
O2 - BHO: (no name) - {B81CB9C1-88EE-BD54-B5A0-0D6FA7436CEA} - C:\WINDOWS\SYSJA.DLL (file missing)
O2 - BHO: (no name) - {A23A37B0-4D47-787A-2542-90BAA46F7745} - C:\WINDOWS\APPIQ32.DLL (file missing)
O2 - BHO: (no name) - {5DEC3A0E-57E4-A9B8-C208-3EBC0CE872B6} - C:\WINDOWS\SYSTEM\WINBT.DLL (file missing)
O2 - BHO: (no name) - {2B1D1A46-456B-4569-5408-A18F2290B4AA} - C:\WINDOWS\SYSTEM\JAVAAI32.DLL (file missing)
O2 - BHO: (no name) - {741A224A-0928-455C-96D0-0B9E0AF542C3} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {A423E337-BECF-0E13-7DFB-41C986ABFC8C} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {4D565991-F4A5-E649-13DD-44B32F002B6F} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {4D5623E7-B3C0-0B90-EE70-5C3A183235E3} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {D4FCEB84-5BA7-C5EA-761D-5987372B1BBF} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {C2F72E71-977D-D1EB-871F-633DBD3EC20B} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {A24F3A0C-E1E9-32E3-6392-D1D2BAEDD0FB} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {A91D02AD-F61E-3DD9-D845-9599586A7152} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {D481982F-2688-2ABA-7088-01E8750E411A} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {DE519AEC-4A99-3592-2D98-ECF62944F706} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {0410DCC7-5514-CF79-B52D-9FE906230878} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {0B4D5FD1-2341-16FC-2CAC-DC7E12039904} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {DD9CC47F-93DA-C176-8EAB-0F01B7631141} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {4F8DD61A-1AF0-F963-9FD5-2817649B2879} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {B40A0D79-75C8-D24C-5B56-52FBFBE11B04} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {5C1855D0-FD0F-35AD-13F1-3A545A0CAE86} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {F3184CE8-C588-D4D5-9FD4-74BF95712624} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {647B7C3A-BE72-E122-772D-4D78A24E913E} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {56D6D3D0-5FDD-BC98-9286-35CFF81729D6} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {46FCADB0-6F6F-CA6F-C435-0CF56B375F59} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {B3E631BF-741C-9280-6A30-43DCB84A68BB} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {7BB33AF2-BA79-7C08-1005-AC35D095970C} - C:\WINDOWS\NETYY32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NEWGAME] C:\Program Files\NEWgame Vmag\1754850\Program\backWeb-1754850.exe -startup
O4 - HKLM\..\Run: [Upromise0] "C:\PROGRAM FILES\UPROMISE_REMINDU\Upromise0.exe"
O4 - HKLM\..\Run: [APPJP32.EXE] C:\WINDOWS\SYSTEM\APPJP32.EXE
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ADDWF32.EXE] C:\WINDOWS\ADDWF32.EXE
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - Startup: Event Planner Reminders Tray Icon.lnk = C:\Sierra\Planner\PLNRnote.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: RemindU - file://C:\PROGRAM FILES\UPROMISE_REMINDU\Sy1050\Tp1050\scri1050a.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: RemindU (HKCU)
O9 - Extra button: RemindU (HKCU)
O12 - Plugin for .hiv: C:\WINDOWS\DOWNLOADED PROGRAM FILES\nphijkjv.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin4.dll
O16 - DPF: {BC26D98E-4F8E-11D4-B523-94ED45C04971} (PrintQuickActiveXSetup Class) - http://www.ibmezprint.com/plugin/win/ie/printQuick.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {36C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDKey Class) - http://www.cdkeybonus.com/cdkey/ITCDKey.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/4003/ftp.coupons.com/r3120/cpbrxpie.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37935.7184953704
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {FC89F9FA-0FEF-43DA-AE71-5C7897DC000D} (XLiteInstall Class) - http://www.cabcconnection.com/CABCXInstall_Full.cab
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.crackerbarrel.com/CFIDE/classes/CFJava.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/137df61e0b256c129415/netzip/RdxIE601.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\ca.exe

Dexter

Sorry to take a while to reply here, been a busy few days. Yes, yu still have problem entries. Did you locate and stop a bogus service as per Step 4 of the guide?

These are your current problem entries from this log:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xzjtq.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O2 - BHO: (no name) - {BC0E155E-1A45-33EA-5DBD-50DE1453AE61} - C:\WINDOWS\MFCSK.DLL (file missing)
O2 - BHO: (no name) - {B81CB9C1-88EE-BD54-B5A0-0D6FA7436CEA} - C:\WINDOWS\SYSJA.DLL (file missing)
O2 - BHO: (no name) - {A23A37B0-4D47-787A-2542-90BAA46F7745} - C:\WINDOWS\APPIQ32.DLL (file missing)
O2 - BHO: (no name) - {5DEC3A0E-57E4-A9B8-C208-3EBC0CE872B6} - C:\WINDOWS\SYSTEM\WINBT.DLL (file missing)
O2 - BHO: (no name) - {2B1D1A46-456B-4569-5408-A18F2290B4AA} - C:\WINDOWS\SYSTEM\JAVAAI32.DLL (file missing)
O2 - BHO: (no name) - {741A224A-0928-455C-96D0-0B9E0AF542C3} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {A423E337-BECF-0E13-7DFB-41C986ABFC8C} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {4D565991-F4A5-E649-13DD-44B32F002B6F} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {4D5623E7-B3C0-0B90-EE70-5C3A183235E3} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {D4FCEB84-5BA7-C5EA-761D-5987372B1BBF} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {C2F72E71-977D-D1EB-871F-633DBD3EC20B} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {A24F3A0C-E1E9-32E3-6392-D1D2BAEDD0FB} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {A91D02AD-F61E-3DD9-D845-9599586A7152} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {D481982F-2688-2ABA-7088-01E8750E411A} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {DE519AEC-4A99-3592-2D98-ECF62944F706} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {0410DCC7-5514-CF79-B52D-9FE906230878} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {0B4D5FD1-2341-16FC-2CAC-DC7E12039904} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {DD9CC47F-93DA-C176-8EAB-0F01B7631141} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {4F8DD61A-1AF0-F963-9FD5-2817649B2879} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {B40A0D79-75C8-D24C-5B56-52FBFBE11B04} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {5C1855D0-FD0F-35AD-13F1-3A545A0CAE86} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {F3184CE8-C588-D4D5-9FD4-74BF95712624} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {647B7C3A-BE72-E122-772D-4D78A24E913E} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {56D6D3D0-5FDD-BC98-9286-35CFF81729D6} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {46FCADB0-6F6F-CA6F-C435-0CF56B375F59} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {B3E631BF-741C-9280-6A30-43DCB84A68BB} - C:\WINDOWS\NETYY32.DLL
O2 - BHO: (no name) - {7BB33AF2-BA79-7C08-1005-AC35D095970C} - C:\WINDOWS\NETYY32.DLL

O4 - HKLM\..\Run: [APPJP32.EXE] C:\WINDOWS\SYSTEM\APPJP32.EXE

O4 - HKLM\..\RunServices: [ADDWF32.EXE] C:\WINDOWS\ADDWF32.EXE

O12 - Plugin for .hiv: C:\WINDOWS\DOWNLOADED PROGRAM FILES\nphijkjv.dll


Dexter...