DESPERATELY need HELP with Home Search Problems! PLEASE!

Unknown

Hello everyone: :bawling:

As many of you have experienced, I am also struggling to remove Home Search Assistant, Search Extender, and Shopping Wizard from my computer. It has changed my homepage and has disabled me to communicate via my AIM since I believe it blocked it and this has been a HUGE inconvenience for me. I am not computer-savvy and I would REALLY appreciate any HELP you guys could provide me.

I have SpyBot, AdAware, AVG, and HJT. I've ran all of those programs but they are all still on my computer. I have looked at certain guidelines on how to remove them but once again, unfortunately, I am not a computer wizard, thus, it has been VERY DIFFICULT for me.

Here is my logfile:


Logfile of HijackThis v1.99.0
Scan saved at 8:36:58 PM, on 1/7/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\documents and settings\chris aniciete\local settings\temp\k.exe
C:\documents and settings\chris aniciete\local settings\temp\EJWPEoj.exe
C:\documents and settings\chris aniciete\local settings\temp\isC.exe
C:\documents and settings\chris aniciete\local settings\temp\k.exe
C:\documents and settings\chris aniciete\local settings\temp\EJWPEoj.exe
C:\documents and settings\chris aniciete\local settings\temp\isC.exe
C:\Documents and Settings\Chris Aniciete\Application Data\ooch.exe
C:\WINNT\System32\??rss.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\Office10\WINWORD.EXE
C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\vvmpo.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\vvmpo.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {9278B02A-F75B-0FE9-0320-B1955F169D90} - C:\WINNT\netau32.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {B4066A3E-A9B8-CEC2-C984-8EE8D538C341} - C:\WINNT\netau32.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Chris Aniciete\Local Settings\Temp\KlD.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PdKRA9] C:\documents and settings\chris aniciete\local settings\temp\PdKRA9.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [wR] C:\documents and settings\chris aniciete\local settings\temp\wR.exe
O4 - HKLM\..\Run: [6] C:\documents and settings\chris aniciete\local settings\temp\6.exe
O4 - HKLM\..\Run: [rWjbgs] C:\documents and settings\chris aniciete\local settings\temp\rWjbgs.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RJ] C:\documents and settings\chris aniciete\local settings\temp\RJ.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [y0tefEys] C:\windows\y0tefEys.exe
O4 - HKLM\..\Run: [uGi] C:\documents and settings\chris aniciete\local settings\temp\uGi.exe
O4 - HKLM\..\Run: [k] C:\documents and settings\chris aniciete\local settings\temp\k.exe
O4 - HKLM\..\Run: [bE] C:\documents and settings\chris aniciete\local settings\temp\bE.exe
O4 - HKLM\..\Run: [EJWPEoj] C:\documents and settings\chris aniciete\local settings\temp\EJWPEoj.exe
O4 - HKLM\..\Run: [isC] C:\documents and settings\chris aniciete\local settings\temp\isC.exe
O4 - HKLM\..\Run: [k.exe] C:\documents and settings\chris aniciete\local settings\temp\k.exe
O4 - HKLM\..\Run: [EJWPEoj.exe] C:\documents and settings\chris aniciete\local settings\temp\EJWPEoj.exe
O4 - HKLM\..\Run: [isC.exe] C:\documents and settings\chris aniciete\local settings\temp\isC.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Sbae] C:\Documents and Settings\Chris Aniciete\Application Data\ooch.exe
O4 - HKCU\..\Run: [Qytbap] C:\WINNT\System32\??rss.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://64.55.105.206/Java/cfs31229.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://instantgreetings.aol.com/prod/install.html
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {72C9EA8F-8965-40C2-ABAD-D460A5815F86} (hostCntrlIE Class) - http://vhost.oddcast.com/admin/hostClientIE.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab28578.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_4us.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://fredmeyer.digitalcameradeveloping.com/upload/XUpload.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe


PLEASE, PLEASE, PLEASE help me with this! I would really appreciate any immediate guidance that you can give me.

Thank you very much for your time.

charlienovember6

Anybody, please? :bawling:

Dexter

Please refer to the items in big red letters at the top of this page, specifically:

SVT Forum Etiquette

be patient!!. Sometimes people will get replies in minutes. Other times it may take a day or two to get a response. This is entirely dependent on the schedules of the people who volunteer their time here. Most of us have jobs, spouses, kids, etc, in our real lives, and those things take priority. If you don't see a response immediately, please do not post "bumps" to move your thread up, unless it has been several days since you have had a reply. When the SVT SWAT Team members come into this forum, we scan the "replies" column, and identify the threads that have 0 replies. Often, we will try to work on those older ones first before moving to the newer ones. Being at the top of the threads does not work in your favour. If you "bump" your thread 3 or 4 times, what we may end up seeing is a thread with 3 or 4 replies, at the top of the list, and another post at the bottom of the page with ZERO replies. Guess who is going to get help first??

If your post has gone unanswered for more than 3 days, then it may have slipped past us. Please feel free to send a Private Message to myself (Dexter) or Primesuspect to let us know that you have gone a couple of days without an answer, and we will make sure someone follows up. You may also send a Private Message to our Site Manager, General Keebler, if you do not hear back from one of us.

To Send PM To Dexter, Click Here

To Send PM to Primesuspect, Click Here

To Send PM to General Keebler, Click Here

Dexter

Did you try our online Home Search Assistant Removal Guide?

If you have not tried that yet, please go through the guide first, and then let us know if you need further help or if you get it solved on your own by following the guide. Post back in this thread to let us know.

Dexter...

charlienovember6

I am not familiar with many of the instructions stated in the guide so indeed, I attempted to solve the problems myself using that guide, but I haven't had any success.

I'd greatly appreciate if you could please go over my log and let me know which ones I need to fix using HJT. Other easy-to-follow instructions are welcome!

Thank you very much for everything that you guys do!

Dexter

charlienovember6 wrote:

Set your system to Show Hidden Files and folders.

Pull the plug on your computer. Plug it back in and boot into Safe Mode.

Make sure that all Internet Explorer or any other browser windows or internet applications are closed. Do not have any other unnecessary programs running.


Run Hijack This. FIX THE FOLLOWING (place a checkmark beside the entries, and then press the Fix Checked button) :

**************

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\vvmpo.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\vvmpo.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\vvmpo.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing


O2 - BHO: (no name) - {9278B02A-F75B-0FE9-0320-B1955F169D90} - C:\WINNT\netau32.dll

O2 - BHO: (no name) - {B4066A3E-A9B8-CEC2-C984-8EE8D538C341} - C:\WINNT\netau32.dll

O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Chris Aniciete\Local Settings\Temp\KlD.dll



O4 - HKLM\..\Run: [PdKRA9] C:\documents and settings\chris aniciete\local settings\temp\PdKRA9.exe

O4 - HKLM\..\Run: [wR] C:\documents and settings\chris aniciete\local settings\temp\wR.exe
O4 - HKLM\..\Run: [6] C:\documents and settings\chris aniciete\local settings\temp\6.exe
O4 - HKLM\..\Run: [rWjbgs] C:\documents and settings\chris aniciete\local settings\temp\rWjbgs.exe
O4 - HKLM\..\Run: [RJ] C:\documents and settings\chris aniciete\local settings\temp\RJ.exe
O4 - HKLM\..\Run: [y0tefEys] C:\windows\y0tefEys.exe
O4 - HKLM\..\Run: [uGi] C:\documents and settings\chris aniciete\local settings\temp\uGi.exe
O4 - HKLM\..\Run: [k] C:\documents and settings\chris aniciete\local settings\temp\k.exe
O4 - HKLM\..\Run: [bE] C:\documents and settings\chris aniciete\local settings\temp\bE.exe
O4 - HKLM\..\Run: [EJWPEoj] C:\documents and settings\chris aniciete\local settings\temp\EJWPEoj.exe
O4 - HKLM\..\Run: [isC] C:\documents and settings\chris aniciete\local settings\temp\isC.exe
O4 - HKLM\..\Run: [k.exe] C:\documents and settings\chris aniciete\local settings\temp\k.exe
O4 - HKLM\..\Run: [EJWPEoj.exe] C:\documents and settings\chris aniciete\local settings\temp\EJWPEoj.exe
O4 - HKLM\..\Run: [isC.exe] C:\documents and settings\chris aniciete\local settings\temp\isC.exe

O4 - HKCU\..\Run: [Sbae] C:\Documents and Settings\Chris Aniciete\Application Data\ooch.exe
O4 - HKCU\..\Run: [Qytbap] C:\WINNT\System32\??rss.exe

O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)


**************

Stay in Safe mode, manually locate:

C:\WINNT\vvmpo.dll
C:\WINNT\netau32.dll
C:\windows\y0tefEys.exe
C:\Documents and Settings\Chris Aniciete\Application Data\ooch.exe
C:\WINNT\System32\??rss.exe


and quarantine them.

Then, go into C: -> Windows -> Downloaded Program Files, and delete everything in there. Anything you really need will be re-downloaded on demand when you visit the website that needs them.

Then open your My Computer icon, right click on your C drive, and click the Properties button. Choose Disk Cleanup. It will take a few moments for the cleanup manager to load up. When it does, set it to clean Temporary Files, Temporary Internet Files, and Recycle Bin. Click OK to begin.

When it is done, pull the plug on the computer again. Plug it back in, boot up normally, check things out, and come back to let us know how it turned out. Post a fresh HJT log for review.

charlienovember6

Hello Dexter. Thanks for the response. I followed the directions you had given me but it only led me to a bigger problem. I am using a computer in my school rather than my own because my computer is now not working at all. After following everything you had asked me to do and finally pulled the plug of the computer and rebooted it, my computer just kept rebooting and rebooting and couldn't get to the desktop. I talked to a friend who is good with computers about it and after hours of attempts, I got an error page, telling me that the ntoskrnl.exe is corrupt or missing.

I am very disappointed and frustrated at how this led me to a much bigger problem.

charlienovember6

To be more specific, now, I am getting a blue error page telling me that my image version.dll is corrupt.

:shakehead