monazbest
join:2004-07-20
42100
| 180 search assistant
while i was troubleshooting a computer for hijack, i detected not more than one entrie in ADD/REMOVE programs which was 180 search assistant.the home page was hijacked and could not browse any web page.i successfully uninstalled 180 search assistant by connecting to internet.but that still din allow me access any other web page than the one which said "eazy-net search". i then deleted hosts file.and temporary files and cookies.i could get to google and other web sites.the page is still hijacked.but when click a specific link on google said "google error cannot open the page".tried other web site could browse it partially...donno how to proceed further.any suggestion would be of gr8 help. |
|
Zupe
Premium,MVM
join:2001-11-29
New York, NY
clubs:
| Please follow all of the steps in this FAQ and then post a Hijack This log, as well as the other information requested there, when you're done: »Security »I think my computer is infected or hijacked. What should I do?
--
Brain: Pinky, are you pondering what I'm pondering?
Pinky: I think so, Brain, but "Snowball for Windows"? |
|
sybille
Not only "just visiting"
Premium
join:2004-04-06
France
1 edit | reply to monazbest
If there's something in the FAQ that isn't clear, let us know! People will be happy to help you.
Good luck!
pollux44 |
|
monazbest
join:2004-07-20
42100 | i do keep n try troubleshooting various spyware issues..well in most of the cases we are not even given access to browse web..such instances we cant even access websites to download online tools.is there anyway we could do it manually?? |
|
sybille
Not only "just visiting"
Premium
join:2004-04-06
France
| reply to monazbest
monazbest,
I didn't understand what you meant. Are you not able to connect to the web to download the software described in the FAQ?
How are you connecting to the internet to post? Are you using another computer? If you are, maybe you can download files with that computer and burn them to a CD to run on the computer that is having problems. I don't know if that will be possible for you.
Unfortunately, 180 search assistant is really difficult to remove manually. Here are some instructions from someone who has tried to do so (I don't know if they will work for you, I haven't tried them):
»www.sawtoothdistortion.com/Artic···rch.html
First there is a discussion about using the program's uninstaller in add/remove programs (as you said you tried to do), then there are manual instructions. The author of this article himself is not sure it's a 100% fix - at the end, he asks people to tell him if they know of other registry entries that need to be deleted. This is one reason it would be much better for you to use the tools in the FAQ if there is any way for you to download them.
Maybe someone else here will have some other ideas?
pollux44 |
|
Zupe
Premium,MVM
join:2001-11-29
New York, NY
clubs:
| reply to monazbest
At a minimum it would really help to see a Hijack This log to do much of anything without trying to guess at things, can you download it on another computer and then transfer it on disk/CD to the problem system?
--
Brain: Pinky, are you pondering what I'm pondering?
Pinky: I think so, Brain, but "Snowball for Windows"? |
|
monazbest
join:2004-07-20
42100
| well i have joined this forum today and i am finding it quite helpful.OK let me explain this.I am DELL technician offering service for anti-virus and spyware.we do troubleshoot over phone and its my customer's issue i try to resolve and learn more.well my customers could not go online with the page hijacked and i deal with more than 5 customers a day with the same hijack issue.we ultimately end up doing Format Install which is more annoying to me than it could be for them...i feel bad when i cant help them with their issues. there has to be some solution for home page hijack!!! 
i dont wanna do format for every hijack call.
well i did talk to a cust right now.his page was hijacked but could browse.cust had MCcaffe installed and MCcaffe spyware protection too..he also had Purchased a full version of Pest Patrol.he still had his page hijacked.i edited start up.deleted hosts file also uninstalled unwanted junk from ADD/remove programs..removed the software traces from registry.follwed the following link to from microsoft and deleted all the traces of the hijacked site.still no go.
»support.microsoft.com/default.as···s;320159
down loaded hijack this.ran FIX.
downloaded spybot.ran fix.they say they fix it but the issue still remains...  .i had to suggest him an FR.i spent more than 2'1/2 hours on this call. wht do i do?? |
|
sybille
Not only "just visiting"
Premium
join:2004-04-06
France
| Doesn't Dell have a policy for tech support that includes training for these problems?
I don't know how this would fit in with your job, but you could maybe refer your clients to the FAQ. It's really a good procedure for dealing with hijacked computers. Otherwise, I don't know how you're going to be able go beyond the format/reinstall approach.
I'm not one of the expert volunteers here. I can sometimes see problems in a HijackThis log (especially if it's the one from my computer, because I know what's supposed to be there), but I am not qualified to help with the real work of cleaning infections. To do so requires specialized skills. Also, the policy of this forum is that the steps in the FAQ need to be followed before HijackThis logs are examined in detail.
I'm sure it's distressing to be confronted with these problems and not to have the resources to respond more helpfully. I think this is something to take up with your manager at work, since I'm sure your colleagues must have similar difficulties.
Hope that isn't too harsh - I'm just astonished that Dell isn't doing more to equip its technicians.
pollux44 |
|
monazbest
join:2004-07-20
42100
| well...DEll has never had a team before to deal with the virus and spyware..it was not a DELL policy to deal with spyware and virus....but since most of our customers had these issues, DELL has recently set up this team to assist these customers. This team has started on the 15th of july and we are doing as much of Research as we could do and assist our customers better.well i find ur responses really good.and i dont think it was harsh at all...
i really appreciate the cooperation i am getting here. I am sure this forum will be very helpful for my R&D.
thankz a lot,
monica. |
|
John2g
Qui Tacet Consentit
Premium
join:2001-08-10
England
| reply to monazbest
You might find this helpful, although it does show some fps.
»Automated online HJT log analyser
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. |
|
sybille
Not only "just visiting"
Premium
join:2004-04-06
France
| reply to monazbest
Without meaning to slight the dedicated experts of this forum, here are some other places where you can watch HijackThis logs being analyzed (if you don't already know about them, and in no particular order):
»forums.spywareinfo.com
»forums.net-integration.net
»www.wilderssecurity.com
»www.tomcoyote.org
»www.computercops.biz/forums.html
There are others....
Also, if you haven't run into this yet, there's a HijackThis tutorial written by Merijn, the program's author (2 mirrors, there are others):
»www.spywareinfo.com/~merijn/htlo···ial.html
»www.computercops.biz/HijackThis.html
Hope this helps your research, and welcome to the forum.
pollux44 |
|
John2g
Qui Tacet Consentit
Premium
join:2001-08-10
England
| Wilders to not analyse HJT logs any more.
»www.wilderssecurity.com/showthre···st222776
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. |
|
sybille
Not only "just visiting"
Premium
join:2004-04-06
France | Oops. I didn't know that. I tend to spend my time over there in several forums in particular and I guess I missed that bit of news.
pollux44 |
|
Doucette4
join:2004-07-21
| reply to sybille
Hello,
I am the author of this article posted by pollux44:
»www.sawtoothdistortion.com/Artic···rch.html
It was written as I was documenting what I did to remove 180 Search Assistant from my computer. (I installed it unknowingly. I pay very close attention to the software I install, and I just made a bad mistake.)
Anyway, I would love to hear from any of you who my instructions do *not* work for, so that I may update them accordingly to help everyone else who needs help.
As for the registy entries, I *think* I found them all, but you never know. I found the two most important ones (the one that puts it in the "add or remove programs" list and the one that puts it in the "msconfig" startup list.
Thanks! |
|
