Isearch Removal
Results 1 to 10 of 10

Thread: Isearch Removal

  1. #1
    Join Date
    Apr 2004
    Location
    Montreal
    Posts
    3

    Isearch Removal

    Hello
    I am another Isearch victim.

    I tried to uninstall using their website, did not work.

    I also ran spybot and hijackThis. I attached the output file.
    What should I erase to get rid of Isearch. If there are other useless things I should get rid of, please let me know.

    Thank you
    Attached Files Attached Files

  2. #2
    Join Date
    Aug 2003
    Location
    The GREAT STATE of PENNSYLVANIA
    Posts
    849
    yogi, look in Start>Search; files or folders and type in Isearch and everything there Delete, if you know your way around the registry go in there too.
    I hope this may help?
    Take Care

  3. #3
    Join Date
    May 2001
    Location
    USA
    Posts
    757
    download Ad-Aware at http://www.lavasoftusa.com/software/adaware
    After installing AAW, and before running the program, update by using the Globe icon.
    Shut down and restart Ad-Aware.
    Now press "Scan Now", "Select drives\folders to scan" and select the active partition (usually C: ), then 'next', and let Ad-Aware scan your drives.
    It will find a number of "bad" files and registry keys. Click 'Next' again.
    Rightclick in that pane and choose "select all" and click 'next'.
    It will ask you whether you'd like to remove all checked items. Click OK.
    Finally, close Ad-Aware, and reboot.........

    Then..rescan with HijackThis..
    Rather than attaching the log.."Scan"...then "Save Log"...when it opens in notepad.......copy (edit..select all..copy) & paste (CTRL-V) the log into your next reply.......

  4. #4
    Join Date
    Apr 2004
    Posts
    683
    discogail to the rescue again, hehe . Yea do just that, the advice discogail gave me worked perfectly and isearch has gone bye bye from my system. Btw, isearch doesnt show up in normal file searches on your comp or add/remove hardware. Isearch really, really pissed me off. Good luck getting rid of it.

  5. #5
    Join Date
    Apr 2004
    Location
    Montreal
    Posts
    3

    Stupid Isearch

    Thank you for all your help and quick replies. I had ad aware before isearch showed up and adaware did not find it. A friend came in and deleted toolbar.dll and all the isearch files we can find on the registry, I think it's out. Just in case, I've pasted the Hijack log file underneath here.
    Thank you all very much.

    Logfile of HijackThis v1.97.7
    Scan saved at 8:59:37 AM, on 08/04/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MDM.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\INTERNAT.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
    C:\WINDOWS\RunDLL.exe
    C:\PROGRAM FILES\KAZAA LITE\KAZAA.KPP
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\SYSTEM\TOOLBAR.DLL (file missing)
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.nytimes.com/"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\7l2owelo.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\7l2owelo.slt\prefs.js)
    O1 - Hosts: 216.177.73.139 auto.search.msn.com
    O1 - Hosts: 216.177.73.139 search.netscape.com
    O1 - Hosts: 216.177.73.139 ieautosearch
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\SYSTEM\TOOLBAR.DLL (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL (file missing)
    O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\SYSTEM\TOOLBAR.DLL (file missing)
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [OmgStartup] C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [internat.exe] internat.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Explore] C:\WINDOWS\SYSTEM\EXPLORE.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash Hunter\save.htm
    O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\SYSTEM\TOOLBAR.DLL/SEARCH.HTML
    O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Flash2X Flash Hunter (HKCU)
    O9 - Extra 'Tools' menuitem: &Launch Flash Hunter (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
    O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx
    O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...882.7840509259

  6. #6
    Join Date
    May 2001
    Location
    USA
    Posts
    757
    Create a new folder..place HijackThis off the desktop, and into it..then..with all other browser windows closed, and only HijackThis running...check off:

    R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\SYSTEM\TOOLBAR.DLL (file missing)
    O1 - Hosts: 216.177.73.139 auto.search.msn.com
    O1 - Hosts: 216.177.73.139 search.netscape.com
    O1 - Hosts: 216.177.73.139 ieautosearch
    O2 - BHO: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\SYSTEM\TOOLBAR.DLL (file missing)
    O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\SYSTEM\TOOLBAR.DLL (file missing)
    O4 - HKLM\..\Run: [Explore] C:\WINDOWS\SYSTEM\EXPLORE.exe
    O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\SYSTEM\TOOLBAR.DLL/SEARCH.HTML


    "Fix Checked"..reboot

    Then-->Download & run McAfee's free stand-alone ExploreZip cleaner.

  7. #7
    Join Date
    Apr 2004
    Location
    Montreal
    Posts
    3
    Thank you,

    It worked,
    yogi

  8. #8
    Join Date
    Jul 2006
    Location
    Seattle
    Posts
    34
    I am in a quandry. I cannot install Norton Antivirus2006 or perform their online scan beacause there seems to be a virus on my computer that Norton Antivus 2004 didn't find.

    I just used the free online scan at Earthlink.net; and it said that I have the following on my system:


    CoolWebSearch
    ISearch
    PSGuard
    SearchSquire
    Transponder


    Afterlooking for the information in the above posts
    I went to Symantec.com, and searched for ISearch. According to their removal directions, I found that I have the following item for
    ISearch



    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C78AB3F-A857-482e-80C0-3A1E5238A565}

    1C78AB3F-A857-482E-80C0-3A1E5238A565 is used by ISearch but not in the above location.



    in the registry subkey:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
    value: "NoDriveTypeAutoRun" = "91"

    Where ISearch changes it.

    I currently have these removal tools installed:
    HighJackThis, KillBox [newest], bholist, and startuplist.
    I also have SPyBot Search and Destroy.

    I might still have remnants of CoolWebSearch on my computer.
    I have ran cwshredder.exe before.

    If anyone can help, please do.

  9. #9
    Join Date
    Apr 2005
    Location
    Maryland, USA
    Posts
    17,806
    Welcome to VirtualDr

    Please follow the instructions on the following VirtualDr page first:

    http://discussions.virtualdr.com/sho...d.php?t=167915

    Then post your HijackThis Log and (hopefully) an expert will soon drop in and give you a hand.

  10. #10
    Join Date
    Feb 2004
    Location
    Mandurah, Western Australia
    Posts
    10,157
    Please start your own thread though as this one is almost 2 years old .

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •