Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
My browser homepage gets reset to this: "res://ipysh.dll/index.html#27063". Pop-up windows (some of which are related to anti-spyware sites) show up every time I start up IE. The homepage that shows up is related to the search-all-fast.com, or search-to-find.com sites. Anybody know what can I do other than just formatting my HD?
download spybot s&d and adaware6 and cwshredder from www.spywareinfo.com and run them all and see what you get that should help
cheers ianmc
0 
well said ianmc, the first thing I do is search for spy and adware before monkeying with the internal set-up. saves alot of grief.
Another good free utility is stinger.exe. Run that one too as it finds alot of trojans and stuff.
Also Crusard, make sure your AV is up-to-date and do a thorough virus scan.
0
I had ran Spybot S&D, but it diodnt find much. I just ran Norton Antivirus and found A LOT of adware files in my Windows and \system32 folders. What's curious about this is that they all weight 89kb. So, I deleted them all, restarting machine now...
0
All files detected by Norton and S&D have been erased, but three of them reappear as soon as I remove them. I've made a copy of a null file and renamed it to replace these three, in attempt to fool the adware, but the hijacks and popups keep showing up...
0
I have the same problem. I have ran Spybot, Adware, CWS shredder, Registry Prot, and Norton Anti Virus - I cannot clean this from my machine. Everytime I change the default page to blank it goes to: res://qaaue.dll/index.html#12802 and then lauches the other window for all the spyware software (kind of insidious and smart). Good marketing tool!
0
I have the same problem. Pop ups are 99% anti-spyware/anti-pop-up software. Ironic, huh? I run Adaware, Spybot, CWShredder, HijackThis, clean them all out, and they just come back. Can't find the root. Hope someone does and posts it here.
0
I have the same problem. I have run Ad-aware, SpyBot, Adwarespy, Spyware doctor, Highjack This, and NAV - up to date.. It all points to the same destination in the IE address bar; res://omiuc.dll/index.html#96676, or a variant. Always ending in index.html#96676. It always comes back after regedit and spyware/adware removal. The main site is http://www.search-all-fast.com. This appears to be a new kind of spyware. This is the only place I have found so far on the internet talking about it.
0
no-one said anything about firewalls....are you guys using them? Sygate personal is free. And what about good up-to-date AV's? Nothing was said on checking for viruses using the latest up-dates.
An on-line scan might help you too. Did you guys use the latest stinger.exe?
0
Sorry, I overlooked, it was said that Norton was used to scan for viruses...my apologies.
Another thing I forgot is, most firewalls are more efficient than the built in winXp firewall.
0
I ran AV (Norton), Adaware, Spybot, AOL Spyware detection, CWS shredder and none of them detected this. I ran HijackThis and it found something, but gets reinstalled after you reset the page (see below).
Note: I fixed the problem, but by brute force - I did a system restore back to a date prior to having the problem.
0
we all have the same issue, mine is : res://jjqjo.dll/index.html#22776 with the same anti-spyware messages associated with launching IE. Even if you reset the homepage it overrides it next time you log in and none of these spyware tools fix the problem. If anyone knows anything, keep me in the loop this frustrates me to no end!
0
Hi, I encountered the same.
The various AV and spyprograms failed to find this pest.
So I had to find out myself
What it does is the following:
- the xxxxx.dll is saved as System|Hidden in either ..\windows or ..\windows\system32
- it generates an executable and installs it in the registry under local machine\software\microsoft\windows\current version\run (so it will be started) This executable (either ????.exe or ?????32.exe) is 9216 bytes long and also System|Hidden.
- the trick however is that it also installs an entry in CLSID.COuntermeasures I have found to work are:
- unHide|System the ?????.dll
- look for the exact name in the Run section, also unHide|System this file (should be 9216 bytes)
- open the ?????.dll using a hexeditor and look voor a typical GUID string {.....-....}
- find this string in the registry
- now you will find this GUID string inside an entry named CoSearchAssistant (may be something else, should be a Search Assistant)- Delete the whole entry
- Delete the entry in the Run section
- delete the ?????.dll
- delete the ????(?32).exe
try againNote: deleting only the dll and/or exe won't help because on start-up it will spawn a new exe. The solution appears to be in the xxSearchAssistant.
Since I did this IE is running clear again.
0
Hady,
How do you find the GUID string? I looked through the file in hex editor, and I could find nothing. Can you please explain whether to look in the hex code or regular code, and what exactly I am looking for.
Thanks in advance,
Narayana
0  |
 email server
|
re-installing XP on half ...
|
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
