How can I remove this Searchmeup/Search-findall problem.

Forums: Computers
Email this Topic • Print this Page

Hello
Yesterday when I was bombarded by pop ups I clicked on a site by accident and since then whenever I load up IE search-findall.com sets itself as the homepage. When I change it it always reverts back. I then investigated and found it linked to searchmeup.com.

I installed ad-ware6, pest control, CWShredder and Hijackthis and nothing has helped. My Hijackthis log identified a lot of search-findall/searchmeup stuff but when I fix it they come back.

I dont have much knowledge when it comes to editing my registry so would apprieciate your help.

Also I have looked at lots of forums topics on its removal but all the advice I read doesnt help in my case so I thought I would submit my own log for review.

Here is the Hijackthis log.

Logfile of HijackThis v1.97.7
Scan saved at 10:20:12, on 18/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\CMEII\CMESys.exe
C:\Program Files\Common files\updmgr\updmgr.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\ktybhvovh.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\windows\temp\adware\fsg_4104.exe
C:\WINDOWS\Downloaded Program Files\2.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Common Files\GMT\GMT.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\User\My Documents\Programs\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-findall.com/findall.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-findall.com/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-findall.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.commonname.com/english/toolbar/sidebar.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-findall.com/findall.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search-findall.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search-findall.com/findall.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search-findall.com/findall.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search-findall.com/findall.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://bestsearch.cc/5595/search.php?qq=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12B7F1A5-D3EB-9A2E-D2E2-F79DE784B0D9} - (no file)
O2 - BHO: BabeIE - {A6475E6B-3C2E-4B1F-82FD-8F1C0B1D8AD0} - C:\Program Files\CommonName\Toolbar\BabeIE.dll
O2 - BHO: (no name) - {BB1E7FCE-48AE-427F-83A9-AED76F1FD300} - C:\WINDOWS\ogwvpplir.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem216.dll (file missing)
O3 - Toolbar: CommonName - {A3E3F04C-F98C-4295-95EF-41C57425B077} - C:\Program Files\CommonName\Toolbar\CNBarIE.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVCOMS] C:\WINDOWS\System32\LVCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup
O4 - HKLM\..\Run: [wiwitp] C:\WINDOWS\ktybhvovh.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [Trickler] "c:\windows\temp\adware\fsg_4104.exe"
O4 - HKLM\..\Run: [applc] C:\WINDOWS\Downloaded Program Files\2.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add A Page Note - C:\Program Files\CommonName\Toolbar\createnote.htm
O8 - Extra context menu item: Bookmark This Page - C:\Program Files\CommonName\Toolbar\createbookmark.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Email This Link - C:\Program Files\CommonName\Toolbar\emaillink.htm
O8 - Extra context menu item: Search using CommonName - C:\Program Files\CommonName\Toolbar\navigate.htm
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O11 - Options group: [CommonName] CommonName
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct0_x.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38000.1222453704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/roing.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA927AB4-C522-4FCA-8D05-AB758672EFF6}: NameServer = 195.92.195.94 195.92.195.95

It is just a jumble to me but I did identify some search-findall lines which wont stay deleted.

Id be very grateful if you could shine a light on this for me.

Topic Stats
Top Replies
Link to this Topic

Type: Discussion • Score: 1 • Views: 1,325 • Replies: 2

No top replies

This is definitely CoolWebSearch, make sure CWShredder is updated then run it again making sure you click on 'fix', not 'scan'.

Restart HijackThis and put checks next to the following, close all browser windows (including this one) then click on 'Fix Checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-findall.com/findall.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-findall.com/index.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-findall.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.commonname.com/english/toolbar/sidebar.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search-findall.com/findall.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search-findall.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search-findall.com/findall.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search-findall.com/findall.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search-findall.com/findall.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://bestsearch.cc/5595/search.php?qq=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: (no name) - {12B7F1A5-D3EB-9A2E-D2E2-F79DE784B0D9} - (no file)
O2 - BHO: BabeIE - {A6475E6B-3C2E-4B1F-82FD-8F1C0B1D8AD0} - C:\Program Files\CommonName\Toolbar\BabeIE.dll
O2 - BHO: (no name) - {BB1E7FCE-48AE-427F-83A9-AED76F1FD300} - C:\WINDOWS\ogwvpplir.dll
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem216.dll (file missing)
O3 - Toolbar: CommonName - {A3E3F04C-F98C-4295-95EF-41C57425B077} - C:\Program Files\CommonName\Toolbar\CNBarIE.dll (file missing)
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)

O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup
O4 - HKLM\..\Run: [wiwitp] C:\WINDOWS\ktybhvovh.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [Trickler] "c:\windows\temp\adware\fsg_4104.exe"
O4 - HKLM\..\Run: [applc] C:\WINDOWS\Downloaded Program Files\2.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart

O8 - Extra context menu item: Add A Page Note - C:\Program Files\CommonName\Toolbar\createnote.htm
O8 - Extra context menu item: Bookmark This Page - C:\Program Files\CommonName\Toolbar\createbookmark.htm
O8 - Extra context menu item: Email This Link - C:\Program Files\CommonName\Toolbar\emaillink.htm
O8 - Extra context menu item: Search using CommonName - C:\Program Files\CommonName\Toolbar\navigate.htm

O11 - Options group: [CommonName] CommonName

O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/roing.cab

Make sure you have Set Windows to show Hidden Files & Folders, then reboot into safe mode then find and delete the following in bold:

C:\Program Files\Common files\updmgr
C:\WINDOWS\ktybhvovh.exe
C:\WINDOWS\Downloaded Program Files\2.exe
C:\WINDOWS\twaintec.dll
C:\Program Files\CommonName
C:\WINDOWS\ogwvpplir.dll

Then uninstall MessengerPlus2 as it comes bundled with malware.
Then uninstall New.net-

1) From the Windows Start button select Settings and then Control Panel.

2) When the Control Panel window opens, double-click on the Add/Remove Programs icon.

3) When the Add/Remove Programs Properties window opens, locate New.Net in the list of installed programs. Select it and then click on the Add/Remove button.

4) Follow the on screen instructions. Do not have HijackThis fix New.Net

Next uninstall Gator

Reboot then post a fresh log after scanning with Adaware once more.

0 Replies

Searchmeup/Search-findall problem.
I have had similar problems, and if you are not confident with the following, you are probably stuck with it or will have to get somebody to remove it for you. (You didn't mention it, but have you tried Spy-bot Search and Destroy? It's free and often finds stuff others don't Just type Spy-bot Search and Destroy into Google or similar. Don't be fooled by imitations!) I also find sureclean professional very good for removing files that cannot normally be accessed. You may need it to remove the files I am going to try to identify for you. Or you may need to follow the rather technical removal method below. These programs often store a file or executable, disguised as a system folder so they are difficult to find or remove. These then replace the deleted files, which is why they keep coming back. A lot of this is a judgement and intuition which comes with experience, so it is at your own risk if you choose to follow this advice. However, I have used these techniques on my own and other people's computers with a 100% success rate. First, you need to be able to see system folders and files. Open windows explorer, click tools and options. Click the view tab. Search down for 'hidden files and folders.' Change from 'do not show hidden files and folders' to 'show hidden files and folders'. Then, a little lower down you will see ?'hide protected operating system files (recommended)'. Check this box, and click ?'yes' on the warning that is displayed. Then click apply, ok and close the folder. Now you need to search for the file. I have done this with windows own search engine and third party software, but there doesn't seem to be much in it, except the speed. Search for Searchmeup, Search-findall, meup, findall or something similar until you find the file (don't forget to search the contents as well as file name), probably in a system folder, that hasn't been recognised by your anti-spyware. You may have to search for ?'search' or manually search system and other files to identify stuff you don't think should be there. ( I had an executable called ?'trickler' in a folder called iGator which was sending me to a Claria search page. Search Google for unknown or unexpected folder or file names and see if you can link to the site you are having trouble with. This is a good indication you have found the problem. I only found out by going to the Claria website and identifying that they were the connected. Searching for Claria found nothing. It's part of the deception.) You will then have to plough through the results, but nobody said this was going to be easy! In fact, I recently spent a whole weekend doing just this to clean a friend's computer of junk. When identified, you may be lucky and be able to delete it. If not try ?'sureclean' if that fails (here comes the technical stuff) make a note of the full file path. Restart the computer in dos (win 98 and earlier) or open the command prompt for later versions.

For Dos (win 98 and earlier)

Type dir fullfilepath to the containing folder.(eg dir c:\windows\system\iGator). I chose iGator because it is one of the nasties I had trouble with. Press enter which will list the files in the folder. Then, at the command prompt type del full file path\filename. Do this for every file in the folder. Press enter, and hopefully all will be well. If not, read on.

For NT Systems

Make a note of the full file path.
Open the command prompt (start run type cmd.exe and open.) Open windows task manager. (ctrl, alt, del). Click processes and find explorer. Click end task and yes. (This hopefully will stop windows identifying the file and stopping you deleting it.) Then, at the command prompt type cd fullfilepath and press enter. Type dir/x and the files should be shown. Then, at the command prompt type del full file path\filename. Do this for every file in the folder. Press enter, and hopefully all will be well. If not, read on. If not, read on. To restore explorer, click 'new task' in the task manager and type 'explorer.exe' in the box and click 'ok'.

Please note that ?'fullfilepath' is not what you type. Type the actual path that leads to the file/directory.

Shut down and re-start the machine. Check the folder, and make sure the files are gone, and then use your anti spyware to remove the files they were creating. If the files or anything else reappears in the supposedly empty folder, look for a file called desktop in the folders containing the files. Open it and delete everything except the top line. Open it and delete everything except the top line [.ShellClassInfo]. This little file has nothing to do with the desktop, but contains enough info for files etc to reinstall. Leaving the top line there fools windows and other applications into believing it is still doing its job, but you have removed the information it needs! You then need to remove all the files again by whatever method works. Oh, don't forget. If all else is well with your machine and you are using system restore, you may want to consider disabling it or the files will be back if you need to restore to an earlier time. Before you do, consider your confidence in following this advice. If you make a mistake, removing a needed file, system restore will not be there for you!

There are more drastic alternatives, such as saving all important files, formatting the drive and reinstalling your o/s. It just depends on how badly you want rid of these invaders, since that is what they are. If you need any more help, I would be happy to let you have my email address to try to help further. Drunk

0 Replies

How can I remove this Searchmeup/Search-findall problem.

Related Topics

Quick Links

My Account

able2know