grumble grumble yahoo grumble grumble...

[CleanChucks]

I'm running firefox 2.0.0.11, recently installed (and quickly uninstalled) megaupload's download manager, and now every time I type for example, 'pcmech' in my address bar, instead of going directly to the page, it'll show yahoo search results for it. Also, while I still had the DL manager installed, it would also show yahoo's home page or something every time I opened up a new page. It hasn't done that since I uninstalled but the other problem still lingers.

I know this is something really minor but it bugs me tbh

I'm not completely sure but I think this has to do with the megaupload thing as it happened right around the same time. Maybe it's some kind of hidden plugin or something but I can't figure it out.

Any help?

Thanks in advance!

[rjfvillarosa]

Have you checked in "Add and Remove programs" for a Yapoo search assistant?
Have you tried a system restore back to an hour or so before you installed the upload manager and Yapoo?

[CleanChucks]

1) no, but I just checked and don't see anything for yahoo there
2) no idea how to do this

[rjfvillarosa]

I assume you are using XP.
Go to Start>Programs>Accessories>System Tools>System Restore.
Click System Restore, when the restore screen opens you will be given the chance to carry out a system restoration to an earlier time/date, click Next and a calendar will appear giving you a choice of recent dates of system check points that you can select to restore your machine to. Select a time or date prior to the installation of the download manager, any installations including updates after the date/time you select will be lost, so you will need to update your antivirus software.

[CleanChucks]

I did the system restore for the day before I installed but yahoo is still doing it's thing...

[rjfvillarosa]

This works quite well on stubborn garbage like Yapoo:
http://www.nirsoft.net/utils/myuninst.html

[CleanChucks]

Still no dice...yahoo is nowhere to be seen in the programs list...

[shadowpr]

When you sy you type pcmech, do you type www.pcmech.com, or just the pcmech part and press enter. Or do you do the whole crtl and enter at the same time?

Have you looked under internet options, and search settings?

[CleanChucks]

I'm typing 'pcmech'. It used to go straight to the page, but now shows search results via yahoo.

Where are the search settings in firefox?

[rjfvillarosa]

Can you carryout the prerequisite scans in this thread:
http://forum.pcmech.com/showthread.php?t=103171 and then post a HJT log.

[shadowpr]

Sorry about that. I completely missed the firefox part. Things are blurry as I'm still doing research for my oc.

Anyway. I know with IE if I just type in pcmech, and then hit enter it will give me search results with the default search engine. I assume it might be the same with firefox.

Try typing in the whole address.

Someone that uses firefox should be able to tell you where the options are in it.

[CleanChucks]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:37:48 PM, on 12/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\PokerStars\PokerStars.exe
C:\Documents and Settings\Sign In\Desktop\HiJackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Battlefield Poker - {B736E0DC-CCE3-4e3c-B14F-403FC1569583} - C:\Microgaming\Poker\BattleFieldPokerMPP\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1181895537703
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Regi...CX/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C7AE57F-559A-4FE5-993A-34C23DDAAAFC}: NameServer = 206.248.154.22 69.28.199.126
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.2\bin\pg_ctl.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Windows Network Log (Windows Network Log Manage) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\Netlog.exe

--
End of file - 4522 bytes

[Lespaul20]

This is what I think is happening.

When you just type in PCMech it looks for an entry in DNS to match that and if it doesn't find one it searches the default search engine. If you type in the full address it should know that address next time you type in PCMech it should go directly to it. This only works with unique domain names, I think. I has nothing to do with Yahoo except that it's probably your default search engine.

[rjfvillarosa]

I don't see anything associated with Yapoo in your log so I am guessing it must be a FireFox plugin.
Have you considered uninstalling/reinstalling FireFox to see if that gets rid of it?
I don't use FireFox but I am sure I have read that there is a way to control the plugins.

[CleanChucks]

Originally Posted by Lespaul20 This is what I think is happening. When you just type in PCMech it looks for an entry in DNS to match that and if it doesn't find one it searches the default search engine. If you type in the full address it should know that address next time you type in PCMech it should go directly to it. This only works with unique domain names, I think. I has nothing to do with Yahoo except that it's probably your default search engine.

Well then why would it randomly stop working for me? ie it used to work fine (I'd type youtube, and it would go to youtube.com), but started using yahoo out of nowhere...

I tried typing the full pcmech.com then tried pcmech and it still doesn't work.

Also, I've never used yahoo - always google - and I don't know why out of nowhere firefox would assume that yahoo is my default search engine.

Originally Posted by rjfvillarosa I don't see anything associated with Yapoo in your log so I am guessing it must be a FireFox plugin. Have you considered uninstalling/reinstalling FireFox to see if that gets rid of it? I don't use FireFox but I am sure I have read that there is a way to control the plugins.

I already looked and there are no plugins for yahoo

[CleanChucks]

Well thanks for the replies, folks. I'm starting to think that maybe megaupload just changed a setting that i can't find so that yahoo (are they affiliated?) is my default search engine for the address bar, and that it's not necessarily some adware or whatever.

I still haven't found a way to fix it so if anyone who has had this problem before or knows how to fix it could please let me know that'd be great. I can deal with it otherwise, but would rather get rid of it

-ChuckTs

[Lespaul20]

If you don't have too many add-ons you could just uninstall and reinstall. Saving your favorites of course.

[CleanChucks]

Reinstalled and it still does the same thing :/

[rjfvillarosa]

Can you think of anything else you installed or updated around the time that this happened?
Does it happen when you use Internet Explorer?

[CleanChucks]

System restore says the only things I've updated around that time were an update for call of duty 4 and something called Software Distribution Service 3.0 which I assume is a windows update? I remember some recent autoupdates so that might account for that 3.0 thing.

If I try the same thing in IE it gives me msn search results.