I have a problem that started happening a couple of days ago.
Whenever I do a search with G00gle the search response is much slower
than I'm used to. There is a pause before the results are displayed
and when the results finally come up a new window also pops up on the
left of the screen. This window has a Lycos search box and a list of
suggested Sponsored Links.
This is extremely annoying and I want to remove whatever software got
installed by something that hijacked my system.
I did some experimenting to see if this is happening with any other
search engines and discovered that I get the Lycos hijack when
searching with Yahoo!, Alta Vista, Ask Jeeves and LookSmart. I don’t
get hijacked with AllTheWeb, HotBot or Teoma. That’s as far as I got
with my troubleshooting. It may impact other search engines as well.
Please help me get rid of whatever has grabbed my search capabilities.
I’m a GA researcher and it’s driving me nuts. Thanks.
czh |
Request for Question Clarification by
pinkfreud-ga
on
25 Apr 2003 13:14 PDT
I hate these #%@! hijackers! This sort of thing has happened to me
twice in the last six months, and the cause can be very difficult to
pinpoint.
Does the phrase "Enhanced Results" appear in the new window? If so,
this newsgroup post may have useful info for you:
http://groups.google.co.jp/groups?selm=207767a4.0302042341.7178d37e%40posting.google.com&oe=UTF-8&output=gplain
|
Clarification of Question by
czh-ga
on
25 Apr 2003 13:30 PDT
Thanks Pink. No. I don't get anything about "Enhanced Results." The
window has Sponsored Links at the top followed by Popular Keyword
Searches and the list of keywords changes in relation to my real
search. I'll go through the suggestions from the link you provided. I
hope you can figure out what I need to do to clean this out. Thanks.
czh
|
Clarification of Question by
czh-ga
on
25 Apr 2003 14:14 PDT
I don’t know if this is simply a coincidence, but the last two days
I’ve gotten an error message on rebooting my machine.
---------------------------
WJView Error
Error: Could not execute Main. The system cannot find the file
specified.
---------------------------
I haven’t changed anything for weeks. I haven’t installed or deleted
anything. I haven’t changed my work habits. No one else uses this
machine.
Thanks for your help.
czh
|
Request for Question Clarification by
aceresearcher-ga
on
25 Apr 2003 21:21 PDT
czh,
Have you run both Spybot Search & Destroy and AdAware to see if either
of them picks up any scumware?
Spybot Search & Destroy 1.2
(donorware - free, but you can donate if you wish)
http://security.kolla.de/index.php?lang=en&page=download
AdAware Standard 6.0
(freeware)
http://www.lavasoft.de/support/download
Let me know!
ace
|
Request for Question Clarification by
aceresearcher-ga
on
25 Apr 2003 21:37 PDT
czh, what version of Internet Explorer are you using?
|
Clarification of Question by
czh-ga
on
25 Apr 2003 22:00 PDT
Hi ace,
Thanks for taking a stab at this. I’m on IE 6.0. I’ve run AdAware and
cleaned up a bunch of garbage. I also found BHODemon from Definitive
Solutions.
http://www.definitivesolutions.com/bhodemon.htm based on the link Pink
found.
I was excited that this would fix it. I downloaded it and got the
diagnosis:
The following Browser Helper Objects (BHOs) have been found on your
machine:
googletoolbar_en_1.1.70 deleon.dll and a CLSID code
{AA58ED58-01DD-4D91-8333-CF10577473F7}
When you click on Details, you get a radio button to disable it. I did
that. It also gave the location of the file as
c:\winnt\downloaded program
files\googletoolbar_en_1.1.70-deleon.dll__BHODemonDisabled.
I checked to see if it worked. Nope. I still have the Lycos toolbar
pop up on the left of my screen. I went to check for the file and
c:\winnt\downloaded program
files\googletoolbar_en_1.1.70-deleon.dll__BHODemonDisabled isn’t
there.
I’m truly confused. Any ideas on what to do next? I sure appreciate
your help.
czh
|
Clarification of Question by
czh-ga
on
25 Apr 2003 23:48 PDT
After running AdAware, Spybot, BHODemon, HijackThis and a couple of
other clean-up programs I was still getting the Lycos toolbar window.
I finally uninstalled the Google Toolbar and rebooted my machine. The
problem is solved. Knock on wood!!!
I spent about four hours on this today. I appreciate the help,
especially from Pinkfreud, Aceresearcher and Sublime. All of you
helped get me on the right track. Thanks.
czh
|
Request for Question Clarification by
aceresearcher-ga
on
25 Apr 2003 23:54 PDT
Aha!
http://www.webmasterworld.com/forum80/204.htm
|
Request for Question Clarification by
sublime1-ga
on
25 Apr 2003 23:56 PDT
czh...
Your most recent clarification seems to refer to a legitimate
entry for the Google Tool Bar. I suspect that what you have is
at least one version of spyware proliferated by 'Gator', such
as 'Xupiter' or their latest annoyance, 'Search Scout'. While
these can be tenacious, the patient application of Spybot,
Ad-Aware, and BHODemon should prove effective, especially
in conjunction with some seasoned advice. The following page
offers a considerable amount of information about the nature
and removal of Xupiter and Gator programs in general. It also
talks about a program I haven't yet tried, which sounds promising,
called SpywareBlaster:
http://home1.gte.net/johnfull/n230.htm
Take note of ActiveX settings, hidden .ini and .inf files,
using msconfig, setting Windows Explorer to 'show all files',
deleting ActiveX plugins and so on. If you have questions
about any of this, stop back here and leave a RFC.
MSconfig does not come with Windows 2000, but you can use the
version for Windows XP, and it works perfectly. You can download
it from The Tech Guide website:
http://www.thetechguide.com/downloads.html
http://www.thetechguide.com/downloads/msconfig.zip
MSconfig lets you view, in the 'Startup' tab, all the software
that loads when Windows starts, which can sometimes load the
bases of spyware programs.
Let me know if this helps and what progress you make, as well
as any questions you have.
sublime1-ga
|
Request for Question Clarification by
aceresearcher-ga
on
26 Apr 2003 00:01 PDT
czh,
I believe the culprit is a nasty Internet Explorer BHO (Browser
"Helper" Object) from www.hightrafficads.com called "SubSearch/High
Traffic" or "Qual Net".
It has several variants and no uninstall feature, but DoxDeskCom has
determined the appropriate Registry edits for a fix, detailed here:
http://www.doxdesk.com/parasite/SubSearch.html
Ya learn something new every day at Google Answers! ;-)
ace
|
Request for Question Clarification by
sublime1-ga
on
26 Apr 2003 00:10 PDT
Oops! Bad timing. Seems you were writing your clarification that
all was well at about the same time I was writing my RFC. Glad
it all worked out.
|
Clarification of Question by
czh-ga
on
26 Apr 2003 11:35 PDT
Thanks for all your help. See my new question.
czh
|
