Announcement Banner
UNSOLVED

grebob

updated

23 years ago

G

grebob

10 Posts

0

4230

February 25th, 2004 01:00

Flashlight Search Takeover

I'm new to the Forum, so the answer to my problem may already be available - please let me know if this is the case.

I used to be able to type in a couple of words like "fishing boat" into the address bar of the IE browser and get a response from MSN in the form of a list of useful sites.  If I was more specific, like "Bass Pro Shop", it would take me directly to the www.basspro.com site.  Doesn't work any more.

Now if I enter the same info, I get redirected to "flashlightsearch,com with info that's less than useful and a pop-up as well.  I have checked all my Internet Options and set MSN as the default search engine - still I get this idiot flashlightsearch garbage.  I've run Spybot, searched the Registry,searched for the word "flashlight" in file names, and even for the text in files.  Nothing.

Can somebody tell me how to get rid of these jerks?

  • grebob

    10 Posts

    672

    0

    Posted February 25th, 2004 01:00

    Here is the log from Hijackthis:

    Logfile of HijackThis v1.97.7
    Scan saved at 8:49:52 PM, on 2/24/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
    C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\default\Local Settings\Temp\Temporary Directory 1 for hijackthis1977.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wayneswords.com/wayne/wayne.pl
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.xpressweb.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=cache.xpressweb.com:3128;https=:0;ftp=:0;gopher=:0;socks=:0
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
    R3 - URLSearchHook: TvmBho Class - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\1.0.1322.0\en-us\msntb.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
    O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
    O9 - Extra button: Encarta Encyclopedia (HKLM)
    O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
    O9 - Extra button: Define (HKLM)
    O9 - Extra 'Tools' menuitem: Define (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O9 - Extra button: Dell Home (HKCU)
    O9 - Extra button: WeatherBug (HKCU)
    O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
    O12 - Plugin for .bpt: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37595.309224537
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

     

  • Yellowhammer

    725 Posts

    673

    0

    Posted February 25th, 2004 01:00

    Try ad-aware which I have a link to below my signature.  If that fails, post a hijackthis log per step 6 below my signature.
  • grebob

    10 Posts

    672

    0

    Posted February 25th, 2004 01:00

    When I type in "fishing boat" into the address bar it goes to http://www.flashlightsearch.com/search.aspx?q=http://fishing%20boat/
  • Yellowhammer

    725 Posts

    672

    0

    Posted February 25th, 2004 02:00

    First you need to move hijackthis.exe to another folder.  It does not need to be run from a temporary folder as we will lose the ability to restore anything we make a mistake on.

    Then close all windows and have hijackthis fix the following:

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
    R3 - URLSearchHook: TvmBho Class - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll

    O2 - BHO: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll

    O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    Reboot to safe mode and delete the following folder:

    C:\Program Files\TV Media\

    Post another log when through.

  • grebob

    10 Posts

    672

    0

    Posted February 25th, 2004 04:00

    Another update - changed the tvm.exe-07304AA4.pf name to xTVM.EXE-07304AA4.xpf

    Now Safe Mode works.  Coincidence?  Now what?

    By the way - Hijackthis doesn't seem to Scan anymore - just pops up instantly with the old log minus the "fixed" items.

  • grebob

    10 Posts

    672

    0

    Posted February 25th, 2004 04:00

    Just did a search for tvm.exe.  Found it in the c:\WINDOWS\Prefetch folder.  Should I delete it?
  • YoKenny

    363 Posts

    672

    0

    Posted February 25th, 2004 04:00

    Delete Tvm.exe from the Prefetch folder.

    In Internet Explorer go to Search (the magnify icon) then Customize then click on Reset.   Go through the Settings to adjust for your preferences.

  • grebob

    10 Posts

    672

    0

    Posted February 25th, 2004 04:00

    Had Hijackthis fix what you said.  Rebooted - wouldn't go into Safe Mode.  Hung up.  Rebooted normally & deleted the TVMedia folder & contents.  Rebooted again.  Looks like Flashlightsearch is mostly gone, but can't get browser to search on "fishing boats.  Address bar switches to http:///?%20fishing%20boat and says "Cannot find Server".  Suspect this is a leftover from Flashlight.  Tried twice more to reboot in Safe Mode - still hangs.

    Suggestions?  I have WindowsXP & haven't used Safe Mode before on it.  Needed it frequently with ME.

  • grebob

    10 Posts

    672

    0

    Posted February 25th, 2004 05:00

    I reset the options in the Advanced section where they were - Display results, and go to the most likely site no help.  Also tried Just go to the most likely site.  Ditto.

    Acts like the Do not search from the address bar is selected - but it isn't

  • YoKenny

    363 Posts

    73

    0

    Posted February 25th, 2004 10:00

    Go to http://www.kellys-korner-xp.com/xp_tweaks.htm then download item "229. Set IE Search to Default" then right click on it and merge it into the registry.