win2k & ie 5.5 search bar (W2K)

[dmpp]

ok...

I have IE 5.5 on the machine....and whenever I restart the server.... when I open up IE it shows the link toolbar and the search panel (on the left side - know what I'm talking about?)... so I close them up.....and next time I restart the computer they show up again....

I'm logging in as the administrator account...and nothing I do fixes this problem....

I've uninstalled the browser to 5.01 and reinstalled 5.5 sp2..... still I got the same problem in 5.01 and 5.5 sp2.. it made no difference...

Please help! :-)

[dmpp]

I've also re-installed win2k over the existing win2k installation.... but to no avail!

[Paul S]

Have you tried going to View>Explorer Bar> and see if any of the option are checked. If they are checked here then they will always open the browser with this set of options.

<font color=green>Paul</font color=green>

[dmpp]

they are checked..... but even if I uncheck them and restart they still show up

[Mosaic1]

A quick question. When you use Search, which search engine appears? Is it one you have chosen? Can you change the search engine, reboot and not have it changed back to something else against your will?
Also, is there a Link in the toolbar which is not one you have put there?
In other words has your Search been hijacked?

[reghakr]

dmpp,

Do a search in the registry for this term:

NoBandCustomize

If you find it, right-click on it and choose delete.

reghakr

[dmpp]

ok....... it's searching....

no matching keys..

[reghakr]

Post back if you have any entries under these keys:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Restrictions

HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Toolbars\Restrictions

HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Control Panel

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer

Also check HKEY_LOCAL_MACHINE

reghakr

[dmpp]

I don't have a:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer (or any sub directories)

Under HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer
I have these:
(Default) REG_SZ (value not set)
CDRAutoRun REG_DWORD 0x00000000 (0)
NoDriveTypeAutoRun REG_DWORD 0x00000095(149)


I don't have:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Int ernet Explorer
or any subfolders

Under
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Policies\Explorer

I have these:
(Default) REG_SZ (value not set)
ShowSuperHidden REG_DWORD 0x00000001(1)

[reghakr]

Sorry, but I don't see any problems with what you've posted.

Are you using any 3-rd party utility that "integrates" into IE?

reghakr

[dmpp]

just norton av 2001

[dmpp]

it's a TinyBar.com one... I never set it up to use that one.... in fact.....I never set up any search engine to show up.... it just did... I didn't install any software on the machine for a few months now.. I only use that machine as a print/web server...

[Mosaic1]

http://groups.google.com/groups?q=TinyBar&hl=en&lr=&ie=UTF-8&oe=UTF8&selm=e4Fy8sr1BHA.2716%40tkmsftngp04&rnum=3 (http://groups.google.com/groups?q=TinyBar&hl=en&lr=&ie=UTF-8&oe=UTF8&selm=2336f09c.0202200744.5cdb4724%40posting.google .com&rnum=2>http://groups.google.com/groups?q=TinyBar&hl=en&lr=&ie=UTF-8&oe=UTF8&selm=2336f09c.0202200744.5cdb4724%40posting.google .com&rnum=2</a>

<a)

There is good information at both of these links regarding this one including the registry keys and where it is being loaded from at boot. There may be a "DLL" which is really a registry file loading at start to change the settings back if you change them. sp.dll
Also, they suggest downloading and installing Ad-Aware. that may find and remove it if you have no luck. Here's the latest address for Ad-Aware:
<a target="_blank" href=http://www.lavasoft.nu/>http://www.lavasoft.nu/</a>

[Mosaic1]

In fact, you might just try Ad-aware first to see if it will take care of it for you. Be sure to make a backup so you can restore if there is a problem.

[dmpp]

ok... the only 2 from the first link that I found on the system were:

Key 4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{69550BE2-9A78-11d2-BA91-00600827878D}"=hex:00,00,00,00
"{8E718888-423F-11D2-876E-00A0C9082467}"=hex:00

I just deleted them, and I'm restarting that machine. We'll see if that fixes it. I have Ad-aware already (the latest version as of 3 days ago) and have run it several times... the last 2 times I ran it, it didn't find anything....

I'll let you know how this goes once the reboot has finished.

[dmpp]

stupid POS...

it's still there... damn... I didn't find the dll anywhere on my system.. there must be something that's being run at boot to re-enable it..

In win98 there's a tool called msconfig... is there a similar tool for win2k?

[Mosaic1]

Try this free utility. It is called Startup Cop.
<a target="_blank" href=http://downloads-zdnet.com.com/3000-2344-5943130.html?tag=pop>http://downloads-zdnet.com.com/3000-2344-5943130.html?tag=pop</a>

[dmpp]

Hey hey!

I used start cop.... I saw an entry called "sp".... having no idea what it was, I took a look at the details and saw that it ran a reg file in my winnt folder called sp.reg. I renamed that to sp.reg.old and disabled that item from the startup. Problem fixed!!!!

FYI... below is a copy|paste of the reg file...





REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.tinybar.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.tinybar.com/ie/"
"Search Page"="http://www.tinybar.com/ie/"
"Search Bar"="http://www.tinybar.com/ie/"
"SearchURL"="http://www.tinybar.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.tinybar.com/ie/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.tinybar.com/ie/"
"Window_Placement"=hex:2c,00,00,00,02,00,00,00,03,00,00,00,b8,0b,00, 00,b8,0b,00,00,fc,ff,ff,ff,fc,ff,ff,ff,51,00,00,00 ,51,00,00,00,a9,02,00,00,e5,01,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout"=hex:11,00,00,00,4c,00,00,00,00,00,00,00,30,00,00, 00,1f,00,00,00, 7e,00,00,00,01,00,00,00,a0,06,00,00,e9,02,00,00,05 ,00,00,00,62,04,00,00,26, 00,00,00,02,00,00,00,a1,06,00,00,f7,02,00,00,04,00 ,00,00,a1,00,00,00,11,03, 00,00,03,00,00,00,a1,02,00,00,0b,03,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,01,24,d0,30,81 ,6a,d0,11,82,74,00,c0,4f, d5,ae,38,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00

[reghakr]

Excellent call MO!

Keep this for future reference:

To restore the "default" search settings:
Open Notepad and copy and paste the following between the lines and save the file as searchfix.reg. Double-click on the file to merge the contents into the registry.
=============BEGINCUT=============

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Provider"="yaho"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
=============ENDCUT=============

If you see a SearchBar entry under [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main], delete it.

reghakr

[Mosaic1]

Reghakr,
Thanks. I do have to admit we have been seeing a lot of these Search and Home Page hijackings at other Forums. I will copy that registry file. It's a good one to have.


dmpp,
Glad you got it resolved. Good work. You know your stuff.

Mo

[dmpp]

I e-mailed lavasoft about this.... they said... that tinybar and several other hijackings are being planned on inclusion in the next update of ad-aware....

:-)

I really appreciate all your help....

[Mosaic1]

You're. welcome. Great that LS is going to include these too. Thanks for the information. It will be very useful.

If you want the broadest possible protection, there is a new free utility which is excellent. Using it and Ad-Aware will give you a wider range of protection. It is called Spybot-Search & Destroy


Here is a link:
<a target="_blank" href=http://patrick.kolla.de/software/spybotsd/>http://patrick.kolla.de/software/spybotsd/</a>