IExplorer "Cannot Find Webpage" Changed

[karl.pestell]

Hi All

This seems like a small thing to sort out, but I cant find out whats up so I thought I would ask on here.

My internet explorer search feature was changed to something called "Search Results". I found a registry entry that changed it back and that seemed fine.

Now, when I put in a website into the address bar which does not work, this "search Results" page appears instead of the previous default page which I used to have.

I am running XP Pro with IE V6. I have run Housecall and Panda virus scans. I have also run A squared (A2) and Ad-Aware which some stuff was detected, but after removing some ads etc, this still didnt fix the problem.

I have added an attachment which shows myself entering a website that doesnt exist to show you what is happening...

Any help or pointers would be good.

Thanks

Karl

[jeffr]

Is this search bar an add-on? Is it seperate from the browser? I'd go into your add/remove programs and see if you have an installation for some type of search bar. This sounds to me more like spyware. Are you using the latest Ad-Aware? Try it again.

[karl.pestell]

There is nothing in the add/remove programs that shouldnt be there.

This isnt as such a search bar. When I enter an incorrect webpage name, that webpage comes up. The blue bit at the top is part of the webpage and no addon to the IE window.

I am using the latest Ad-Aware and I have updated it etc and it is not picking up on anything.

[karl.pestell]

Right, I have now tried using Ad-Aware and Spybot and neither of which have been able to remove this problem.

I assume this is the same problem as what the CWShredder corrects, but not being the same title etc, it wont fix it.

Any further help is appreciated.

Thanks. Karl

[Mesaeus]

I think it's time you post a HijackThis log here, and I'll see if I can find a reference to it.

[karl.pestell]

Right, here is my log.... I hope I did it right as Ive not used it before.
------------------------------------------------------------------

Logfile of HijackThis v1.97.7
Scan saved at 15:39:48, on 03/09/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Karl David Pestell\Desktop\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blueyonder.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: URLSearch Class - {043B5D00-92A9-4cae-A3D8-A4B4B8D52BB1} - C:\WINDOWS\System32\winspoe.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-12.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094060084296
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

-------------------------------------------------------------------

Thanks. Karl

[karl.pestell]

Right I have managed to sort it all out...

I went to http://mvps.org/winhelp2002/unwanted.htm and in there is a number of registry fixes which reset the explorer things back to the default values.

Thanks for all of your time and help and it has been very much appreciated.

Thanks again, Karl

[Mesaeus]

Good to know you solved it yourself, but if you didn't, this was probably the naughty bit that was causing you grief :

R3 - URLSearchHook: URLSearch Class - {043B5D00-92A9-4cae-A3D8-A4B4B8D52BB1} - C:\WINDOWS\System32\winspoe.dll

Anyways, I recommend SpywareBlaster if you want preventive protection against search bars hijacking your pc.