[Fixed] Quick Browser Search

JConway · 01-09-2006

All day I've been having problems with my browser being redirected to Quick Browser Search. My computer's been acting weird for around a week now. I've tried to use the trendmicro free virus scan, but some reason, my computer is not allowing it to run. For the past hour, I'm not getting redirected to a quick browser search page, I'm just getting a strange "Firefox: the page you are looking for is not available" screen. I just downloaded the new version of Firefox, so maybe that's why? When I google something, it usually takes 2-3 times before I'm able to see the website I want without being redirected or seeing the Firefox message. I attached the hijackthis log. Please help!!!

joe5 · 01-09-2006

Hya J Conway , welcome to PCHF.

You have a bunch of those nasty buggers on there im afraid , can you first follow the "Prework" instructions (see link below) and attach the two resulting log files to a post? Then we'll see what still needs to be done.

JConway · 01-10-2006

The file from ewido was too big to attach. What should I do?

joe5 · 01-10-2006

You can remove all/some lines with the word "cookies" in them. Then it should be small enough to attach.
I'll have a look at youre hjt log.

JConway · 01-10-2006

Ok. That worked!!! I left several of the cookies there. The rest were just like them.

joe5 · 01-10-2006

Make sure you still have hidden files set to show , system restore disabled , and that you still have Ccleaner.

First uninstall "Kontiki" in add/remove programs if present.

Then download and run "rapidblaster killer" from here and run it:
http://www.snapfiles.com/get/rapidblasterkiller.html

Then boot in safemode (hit f8 when booting up) and fix these with hjt:

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.scourweb.net/nph-searc...look=stmpl1&kw=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.scourweb.net/nph-searc...look=stmpl1&kw=
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
O2 - BHO: ZIBho Class - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh304181.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - Home Prefix: c:\searchpage.html?page=
O13 - Mosaic Prefix: c:\searchpage.html?page=
O20 - Winlogon Notify: iexplorer - iexplorer.dll (file missing)

Delete the files in bold , and run Ccleaner.

Do you know if this is indeed from youre audio card? the "MPTask.exe" is beying flagged as an trojan , but i doubt it , looking at the location.

O4 - Global Startup: M-Audio MobilePre Control Panel Launcher.lnk = C:\Program Files\M-Audio MobilePre\MPTask.exe

Then post a new hjt log please.

JConway · 01-10-2006

Ok. I hope that worked. When I just tried to go to yahoo, I got a "Firefox cannot find this page" on the first attempt.

Also, that sounds like my soundcard, which is an m-audio.

01-09-2006	#2
joe5 Elite Member Join Date: Jun 2005 Location: Netherlands Posts: 9,025	Hya J Conway , welcome to PCHF. You have a bunch of those nasty buggers on there im afraid , can you first follow the "Prework" instructions (see link below) and attach the two resulting log files to a post? Then we'll see what still needs to be done. __________________ - PCHF Team. - (NL) - Mal-ware Eradicator! - - Online AV Scans - HijackThis! - Bootdisk.com - ATF-Cleaner - Stinger - 'Prework' - 'Afterwork' - PCHF Rules - Donate to PCHF. And get>

01-10-2006	#4
joe5 Elite Member Join Date: Jun 2005 Location: Netherlands Posts: 9,025	You can remove all/some lines with the word "cookies" in them. Then it should be small enough to attach. I'll have a look at youre hjt log. __________________ - PCHF Team. - (NL) - Mal-ware Eradicator! - - Online AV Scans - HijackThis! - Bootdisk.com - ATF-Cleaner - Stinger - 'Prework' - 'Afterwork' - PCHF Rules - Donate to PCHF. And get>

01-10-2006	#6
joe5 Elite Member Join Date: Jun 2005 Location: Netherlands Posts: 9,025	Make sure you still have hidden files set to show , system restore disabled , and that you still have Ccleaner. First uninstall "Kontiki" in add/remove programs if present. Then download and run "rapidblaster killer" from here and run it: http://www.snapfiles.com/get/rapidblasterkiller.html Then boot in safemode (hit f8 when booting up) and fix these with hjt: R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.scourweb.net/nph-searc...look=stmpl1&kw= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.scourweb.net/nph-searc...look=stmpl1&kw= R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file) O2 - BHO: ZIBho Class - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh304181.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201 O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O13 - Home Prefix: c:\searchpage.html?page= O13 - Mosaic Prefix: c:\searchpage.html?page= O20 - Winlogon Notify: iexplorer - iexplorer.dll (file missing) Delete the files in bold , and run Ccleaner. Do you know if this is indeed from youre audio card? the "MPTask.exe" is beying flagged as an trojan , but i doubt it , looking at the location. O4 - Global Startup: M-Audio MobilePre Control Panel Launcher.lnk = C:\Program Files\M-Audio MobilePre\MPTask.exe Then post a new hjt log please. __________________ - PCHF Team. - (NL) - Mal-ware Eradicator! - - Online AV Scans - HijackThis! - Bootdisk.com - ATF-Cleaner - Stinger - 'Prework' - 'Afterwork' - PCHF Rules - Donate to PCHF. And get>

Similar discussions...
Thread	Thread Starter	Forum	Replies	Last Post
[Resolved] Mcafee component missing	bob4bob	[Fixed] Hijackthis! Logs	5	11-25-2005 09:03 AM
Information: Thinking about switching web browser?	merlin	Web, Internet and Network Tutorials	0	08-01-2005 06:11 AM
[FIXED] - Browser and installer problems!!!	IHATEMYCOMPUTER	Internet Help	16	07-10-2005 09:35 PM
[Information] Home Search Assistant removal	sniddsta	Security Watch	1	11-26-2004 09:02 AM

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode