Add/Remove Software (Search Extender & Home Search Assistent)

hey guys,

well ive ran spybot s&d, ad-aware, cwshredder, hijack this & spyware blaster and removed every single thing it detected and my home page & google are still screwed along with pop ups.

(below i will attach an image as to what my homepage always refers back too even though i change it under the "tools" option

also, my google is acting funny. everytime i do a search i get a new window that opens up (here is the url of the new window that opened up after searching "the simpsons") http://search-to-find.com/sec.php?qq...sons&pin=37049

when i go to start, settings, control panel, add remove programs i see two things in there called:

search extender (which has the image of the msn buddy icon) & home search assistent (which has the image of the monitor, & a disc. when i try to remove "search extender" is says unable to open "http://looking-for.cc/uninstall/SearchExtender.html & when i try to remove "home search assistent" is says unable to open "http://looking-for.cc/uninstall/HomeSearchAssistant.html".

does anyone know what this means? i dont know what it is but at this point im trying eeeeeeeeverthing to get this crap resolved!!!

problems im facing:
pop-ups
home page changes
google, alta-vista (additional windows opening up)

Post your HijackThis log here.

the first log that appeared i deleted everything....

after doing another scan this is what came up

C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ieoq32.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\WINDOWS\system32\ntsb.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Rich & Karyn\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
O2 - BHO: (no name) - {3F508203-C722-9913-5AE6-D4D6D529B196} - C:\WINDOWS\system32\ieoq32.dll
O4 - HKLM\..\Run: [ieoq32.exe] C:\WINDOWS\system32\ieoq32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\RunOnce: [ntsb.exe] C:\WINDOWS\system32\ntsb.exe
O4 - HKLM\..\RunOnce: [ipuj32.exe] C:\WINDOWS\system32\ipuj32.exe

Is that the whole log?

ya.....

like i said, i did a scan before this one and deleted/fixed everything!

is it bad for the log to this short?

Quote:

---

like i said, i did a scan before this one and deleted/fixed everything!

---

That was not a good idea.
HJT does not know what is bad or good. It is a tool. Removal of everything is not always a good thing, you could cripple windows severely with it.

C:\Documents and Settings\Rich & Karyn\Desktop\HijackThis.exe

You should use HJT again and restore everything that was removed. Hmm, you didn't delete anything that suddenly appeared on the desktop, did you? If you did, and since HJT is on your desktop, that was your backups.
You need to have HJT in it's own folder, so the backups it creates when it removes stuff can be in a safe place.

Do another scan, and then post the log on here.
I see some bad things that are in the log that is currently on here, but cannot advise as the rest of the log is missing.

Quote:

---

Originally posted by markp62
That was not a good idea.
HJT does not know what is bad or good. It is a tool. Removal of everything is not always a good thing, you could cripple windows severely with it.

C:\Documents and Settings\Rich & Karyn\Desktop\HijackThis.exe

You should use HJT again and restore everything that was removed. Hmm, you didn't delete anything that suddenly appeared on the desktop, did you? If you did, and since HJT is on your desktop, that was your backups.
You need to have HJT in it's own folder, so the backups it creates when it removes stuff can be in a safe place.

Do another scan, and then post the log on here.
I see some bad things that are in the log that is currently on here, but cannot advise as the rest of the log is missing.

---

well when i did the scan and fixed it there was all this ***** on my desktop. i got so frustrated that i deleted all of it :(

i did the scan again and this is what appeared

Logfile of HijackThis v1.97.7
Scan saved at 4:36:37 PM, on 6/23/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ieoq32.exe
C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\WINDOWS\system32\ntsb.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Rich & Karyn\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
O2 - BHO: (no name) - {3F508203-C722-9913-5AE6-D4D6D529B196} - C:\WINDOWS\system32\ieoq32.dll
O4 - HKLM\..\Run: [ieoq32.exe] C:\WINDOWS\system32\ieoq32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\RunOnce: [ntsb.exe] C:\WINDOWS\system32\ntsb.exe
O4 - HKLM\..\RunOnce: [ipuj32.exe] C:\WINDOWS\system32\ipuj32.exe

:( :( :(

when do i start noticing that my pc is screwed?

I couldn't tell you when, but here are some things you will find missing.
When you go back to Windows Update, you will need to reload the ActiveX control, as no doubt that was one of the things you deleted.
If you had Macromedia Shockwave and Flash installed, you will need to install again.
If you had Adobe Reader installed, you will need to reinstall to get the IE function back for it again.
If you had any download managers, they will need to be reinstalled.
There are more you will find out about, only you know what was installed.

In any case, based on the current log, this is what I suggest to be removed. This is one of the easiest logs to fix, basically pick everything but one.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
O2 - BHO: (no name) - {3F508203-C722-9913-5AE6-D4D6D529B196} - C:\WINDOWS\system32\ieoq32.dll
O4 - HKLM\..\Run: [ieoq32.exe] C:\WINDOWS\system32\ieoq32.exe
O4 - HKLM\..\RunOnce: [ntsb.exe] C:\WINDOWS\system32\ntsb.exe
O4 - HKLM\..\RunOnce: [ipuj32.exe] C:\WINDOWS\system32\ipuj32.exe

Reboot, and delete these files.
C:\WINDOWS\system32\udmdp.dll
C:\WINDOWS\system32\ieoq32.dll
C:\WINDOWS\system32\ieoq32.exe
C:\WINDOWS\system32\ntsb.exe
C:\WINDOWS\system32\ipuj32.exe

Quote:

---

Originally posted by markp62
I couldn't tell you when, but here are some things you will find missing.
When you go back to Windows Update, you will need to reload the ActiveX control, as no doubt that was one of the things you deleted.
If you had Macromedia Shockwave and Flash installed, you will need to install again.
If you had Adobe Reader installed, you will need to reinstall to get the IE function back for it again.
If you had any download managers, they will need to be reinstalled.
There are more you will find out about, only you know what was installed.

In any case, based on the current log, this is what I suggest to be removed. This is one of the easiest logs to fix, basically pick everything but one.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://udmdp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\udmdp.dll/sp.html#37049
O2 - BHO: (no name) - {3F508203-C722-9913-5AE6-D4D6D529B196} - C:\WINDOWS\system32\ieoq32.dll
O4 - HKLM\..\Run: [ieoq32.exe] C:\WINDOWS\system32\ieoq32.exe
O4 - HKLM\..\RunOnce: [ntsb.exe] C:\WINDOWS\system32\ntsb.exe
O4 - HKLM\..\RunOnce: [ipuj32.exe] C:\WINDOWS\system32\ipuj32.exe

Reboot, and delete these files.
C:\WINDOWS\system32\udmdp.dll
C:\WINDOWS\system32\ieoq32.dll
C:\WINDOWS\system32\ieoq32.exe
C:\WINDOWS\system32\ntsb.exe
C:\WINDOWS\system32\ipuj32.exe

---

i noticed some of the things you said would be missing like flash......but thats about it so far.....

i fixed the problems you suggested then rebooted & tried deleting the files you suggested but i wasnt able to delete

C:\WINDOWS\system32\ieoq32.dll (couldnt find this)
C:\WINDOWS\system32\ieoq32.exe (when i tried deletign it said cannot delete ieoq32: access denied
make sure the disk is not fully or write-protected and that the file is not currently in use

the same msg appeared when i tried removing C:\WINDOWS\system32\ntsb.exe

what now? :(

Get MoveOnBoot, free, and use it to target this file. It adds a new item to your right click Context Menu. Just select to Move on Boot, then reboot, and they will be gone.
Please post a new HJT after you do this.