mysearchnow

Greetings, shawn_mck!

Check for virus and adware

Housecall Online Scan
http://housecall.antivirus.com

SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/
or
CW Shredder
http://www.spychecker.com/program/cwshredder.html 

Best wishes, war1

you can go to control panel --> add/remove programs and remove "mysearchnow" there

Sunray

hey guys..  pretty slow on EE tonight, eh?  Looks like this one is under control.  Think I will head off to bed.  

FE

when i go to my internet explorer and click view > toolbars... it has the standard list of toolbars and one which is titled "rfglglqucho".

I uninstalled msg plus and i ran spybot but the bar is still there.

Fatal_Exception,

Hey I was just playing ping-pong for an hr and just coming now. Yeah everything is damn slow today . I believe questioners and experts have gone out of town on vacation. But I wont be .. LOL!!!

Thanks,
Sunray

Hey I have got this error once. Go to start --> run --> type "regedit"
registry will open
press ctrl + F ( search window will open)
give the term "rfglglqucho" and search for it. If you find , delete that key.
Once you do one search , delete it and then press F3 and it will look for the same word in another location

Surnay

shawn_mck,

Also download and run this tool

HijackThis : http://www.webattack.com/download/dlhijackthis.shtml 

and post us the log file it creates

Thanks,
Sunray

You are a diehard Sunray....  Going to leave it with you.  

Think I will pick up my MCSE books and let them put me to sleep.

G'nite all.

FE

>> You are a diehard Sunray

Excellant comment that I have got in a while.. Thanks ..

I will be going to bed with " Your memory - How it works and how to improve it ".. Looks pretty good ..

Sunray

shawn_mck,

Hey did you check Hijackthis..

or go to registry and look for mysearch at this location

"R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html "


Thanks,
Sunray

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\program files\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\nvsvc32.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\FaT-TaY SCRiPT\FaT-TaY SCRiPT.exe
C:\Program Files\Kazaa Lite K++\KazaaLite.kpp
C:\WINDOWS\regedit.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\FaT\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell.com/
O2 - BHO: (no name) - {11ce0f27-85b9-45ed-b9c9-8e081b637600} - C:\DOCUME~1\FaT\APPLIC~1\stiblshsttou.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2ab7a4d0-f738-4d80-b049-b56ec3a9ca6b} - C:\DOCUME~1\FaT\APPLIC~1\stiblshsttou.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37977.4044212963
O16 - DPF: {E4961D20-6367-4C75-BCF3-5213C29A827B} (llamapro) - https://www.pimpwar.com/crew/llamapro/llamapro.cab

remove these

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://mysearchnow.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mysearchnow.com/searchbar.html

Sunray

Get Kazaa off there and you will be in better shape...  :)

Now I am going to bed!

FE

refresh the registry after you delete the entries.

Now open IE and check if it is still there.

If it is not , restart your machine and again open IE and check if it is still there

Sunray

Ok I restarted my computer and i opened my IE and clicked view > toolbars and now there is a blank space under "Links" and when i click on it the bar appears again

Hope you deleted all the keys as I had said ..

OK did you download and installed Spybot as War1 suggested.

Sunray

Ok i checked over the keys that you had told me to delete and they are gone and i installed the spybot software and ran it. I had used spybot a few hours ago and fixed all the problems it found.

I seen this key under the hijackthis log and i was wondering if maybe this could be the problem?

O3 - Toolbar: (no name) - {2ab7a4d0-f738-4d80-b049-b56ec3a9ca6b} - C:\DOCUME~1\FaT\APPLIC~1\stiblshsttou.dll

Next, reset the Search Engine. Click the Search button in the toolbar > Customize > AutoSearch Settings > Select a provider from the list.
Open Internet Explorer > Tools > Options > Programs > "Reset Web Settings"

Ok the toolbar is gone totally now... Thanks to everyone that helped me :)

-Shawn

Shawn, Which procedure helped you. Also, please close this Q if your problem is solved.

I myself also had this problem, and from this thread i got rid of the toolbar (thanks guys). But i have another problem now. I use google toolbar, and when i used to have mysearchnow, it would turn google off and turn itsself on. Now there's no mysearchnow, but google still automatically turns off every time i refresh the page. How can i fix this?

Becky..  probably best to open a new thread for your question..  That way you are sure to get a response...

FE

If anyone encounteer this problem... (as I did)... run this out...
http://lop.com/toolbar_uninstall.exe

RyD

avast immediately blocked this download, this is a trojan...

yeah.. might be now... but wasn't almost a year ago! I might still have the exe hidden deep down in some back up..

Cheers!

or maybe avast just is configured too sverely over here, wouldn't be surprised :P

On topic: the browser extension of mysearchnow is caused by installation of MSN Messenger Plus (3)

Control Panel -> add/remove software/remove messenger. You get the option to keep messenger plus extension, but it removes the adware.

Cheers