Explorer and IE Hijacked

[ste_w]

The Problem is wats in the picture, ive just copied the link from above

http://forum.osnn.net/attachment.php?attachmentid=3826

Where by my normal Search isnt available to me in my account but is in other accounts on the system, i just dont want it to be some spyware or monitoring thing

 

[yoyo]

That is the classic Windows search. You may have applied it using a tweak program.

Check this registry key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState

if there is an entry

Use Search Asst

delete the entry or change the value to yes

 

[ste_w]

How do i check the Registry and look for this?

 

[yoyo]

Click Start - click Run - type: regedit

In the window that opens in the "folder tree" in the left pane navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState

click on "CabinetState"

Now look in the right window if there is an entry named Use Search Asst which has the value no assigned to it.

Doubleclick on Use Search Asst and in the input window that comes up replace no by yes.

Click OK and close regedit.

 

[ste_w]

The only thing i have in the Right Window is...

 

[Dublex]

I would try using Adaware SE to see if it finds something as well... I will look at your hijack this log and see if there is anything else you are missing.

 

[ste_w]

Im using Adaware Pro 6 181 n thanx

 

[Dublex]

Hmm, nothing I recognise as spyware in the log file, not even coolweb like dodge files.

Does your search window still come up with that alternate search site?

Or does Adaware Pro SE or Pro tell you of any strange registry keys at the end of a scan?

 

[yoyo]

When you looked in the registry for that value were you logged in to the account with the problem?

 

[ste_w]

To Dublex the problem i have now is just the default search, For files on my computer has changed from the Default Xp Look, To Yoyo yes i am logged into the account with the problem

 

[Dublex]

Well the direct registry key that controls the search page is under HKEY_CURRENT_USER and the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main directory.

If you goto that area in regedit you should be heading on the right pane called Search Page. The default is http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch but you can change it to what you want.

edit: hmm, need to work out exactly how that key works, as I tried it and it didn't change straight away

 

[ste_w]

Dublex i think we may have Missunderstood each other here, ill take a screenshot so u can clearly see the problem...

If u look at the pic, wats in the red box is the problem, instead of having the XP Search With the Dog at the bottom i have this...

 

[Kush]

just a lil advice, the only spyware removal programs that actually work right, are adaware, and spybot, some that claim to clean actually put spyware, so always watch out, it seams that u have installed msn plus recently, and u clicked on yes i agree, thiking u agreed to the lisence when u actually agreed to install a sponsor program, uninstall msn plus, run adaware se w/ updates, and spybot, then reinstall msn plus and make sure u say NO, I REFUSE

 

[ste_w]

i said no last time but still installed that stupid MySearchBar Thing

 

[j79zlr]

Dublex i think we may have Missunderstood each other here, ill take a screenshot so u can clearly see the problem...

If u look at the pic, wats in the red box is the problem, instead of having the XP Search With the Dog at the bottom i have this...

So you want the dog back? Use my UNDO reg file, http://www.j79zlr.com/reg/UNDO_RemoveSearchAssistant.reg

 

[ste_w]

ok i have applied that Reg Entry and the value is set to yes but it hasnt changed anyting

 

[American Zombie]

Go to your inf folder (normally C:\windows\inf and may be hidden) and find the file srchasst.inf then right-click on it. Choose install and then reboot.

 

[ste_w]

ok i tired that and rebooted but still same problem, it asked me for some files off the XP Home SP2 Cd, i onyl have an XP Oem Cd so i put that in n let it get the files from there, rebooted and it was still the same, so i did the same but this time got it to install the files from the XP SP2 Folder in the windows Directory, rebooted, Same problem?

I opened the srchasst.inf with notpad and spotted this:

Files to be copied to the users machine
[SearchAssistantClient]
msgr3en.dll,,,32
nls302en.lex,,,32
srchctls.dll,,,32
srchui.dll,,,32

Is the msgr3en.dll,,,32 a DLL From MSN Messenger Plus 3?

 

[American Zombie]

Is the msgr3en.dll,,,32 a DLL From MSN Messenger Plus 3?

I don't think so as description of it says "Microsoft English Natural Language Server".

Since you have the XP CD....Why not just do a repair with it?
You will have to reinstall some drivers and SP2 but all your applications will be intact. It will be like doing a clean install of Windows without losing your programs.

 

[ste_w]

Doing A Repair is too Drastic really