OKIE slow and easy..

Internet Explorer (IE6) for win XP
has two search functions
1) Press f3 and a menu appears on the left side with a search box
2) alt+D to get to the address bar , the one on top where one would normally enter a URL address

the latter works by typing in the keywords like so.
" Address: " is not included .. just to show its the address bar...

1)Address: babyoxide
2)Address: search babyoxide
3)Address: find babyoxide
4)Address: ?babyoxide

And would produce results using msn search engine
NOW however, i get this instead
http:///?%20babyoxide

Address: babyoxide food money ghost
http:///?%20babyoxide%20food%20money%20ghost

(NOTE the forward SLASH, 3 of them not 2)

see i was running through some sites and accidentally click YES to accept some certificates requesting permission to install some malwares onto my system

after a long "FIGHT" i manage to clear those certificates (all of it, everything from the certificate section under internet options ) i re-installed ie6 ver 2600 to version 2800, i did some registry edit on the KEYS
HKLUser and HKLM > software > microsoft > internet explorer > main AND searchurls AND search
virus scans turns up multiple throjans, ad-aware turns up multiple malwares..


i found these helps from some other helps pages i been through along the way..
registry entries edited accordingly (for the address bar auto search)
however, NONE of it works to restore the ADDRESS BAR SEARCH FUNCTION..

the final site i visited showed of changing/restoring the search options under a customize menu on the top right corner of the search box on the left. i forget where that is or how to get there.. .. anyway it doesn't help and the use of that caused even more problems suchs as, i get the entire result screen from msn ending up on the left menu when trying to search using the LEFT menu..

until now .. the address bar search function still wouldn't work.. PLEASE advice...

i know how to restore it and that is resintalling the entire winxp , along with a fresh copy of ie6 BUT then THAT IS too fuking tedious.. and i dun wish to resort to THAT method unless i really am having crappy issues with my system.. its been working great no crashes no hiccups , cepts maybe the darn ISPs (cable) keeps having these maintenance thing and i ended up frustrated without internet access. but since i last installed this winxp a yr ago.. nothing major i couldn't fix except this bloody irrtating search bar not working now ..


NOTES: the malware did not come with an un-installer for 3 out of 8 programs (its quite very common already, the worse i've seen is they dun even appear in the add/remove section), and those that i could uninstall from the remove/add. program section, leaves traces of junks in my windows directory here and there.. which i manage to scaned and delete..

2 of them requires a download of thier stupid UNINSTALLER from thier webpage when trying to remove from the add/remove section.. STUPID, becos i doubt they put any effort in it .. it doesn't even clear the damn registrys . or atleast prevent from future RE-INFECTIONS, when i revisited the site, all the darn programs come rolling IN again without my permission,, seem like somewhere in the registry or somewhere in the system contains a string or file that compromisses the security on the IE6...

some of the program are,
match?? (dialer)
lstbars
xxxtoolbar
*numbers*.exe as in random.. eg. 45642184.exe 454684634.exe
located somehwree in the windows or windows/system32 or windows/system
ddm_d.exe in c:\ (dynamic media something)
can't remeber the rest..
i mange to block out a couple of them now when i revisted but the majority still comes in wihout permission

all internet security settings has been set to high and "prompt" for some instead of disable...

BOTTOM line , it STILL doesn't work to prevent auto downloading
my guess is some files or registry entires are still hidden..

****************
BabyOxide
***************
Person who invented the /%systempath%/ is a great big idiot !!
it allows any and every one to know where to put malicious files..
therefore installing windows in different folder names other then win98, windows,. winxp, winnt, DOESN"T work in prevention cept maybe some really old files that specified windows instead of /%path%/

ISTbar.Quidon is a hijacker that can be removed by Spybot Search and Destroy or Pest patrol
ISTbar.Slotch also known as XxXToolbar is also a hijacker that can be removed by Spybot Search and Destroy and Pest Patrol. I don't use Pest Patrol so I can't help with specifics, but I know Spybot removes the bars and the registry entries. This is the easiest way to correct the problem. And it's free. After they are removed your IE should work OK unless you messed up the registry. If you still would rather do it the hard way here you go. Make a restore point in case you screw up.Remember a DLL file will keep reinstalling itself if it is deleted unless you unregister it.

qi32.dll Unregister this DLL with Regsvr32 then reboot.

HOW TO USE Regsvr32

You can use the Regsvr32 tool (Regsvr32.exe) to register and unregister object linking and embedding (OLE) controls such as dynamic-link library (DLL) or ActiveX Controls (OCX) files that are self-registerable.
RegSvr32.exe has the following command-line options:
Regsvr32 [/u] [/n] [/i[:cmdline]] dllname
/u - Unregister server<BR/>
/i - Call DllInstall passing it an optional [cmdline]; when used with /u calls dll uninstall
/n - do not call DllRegisterServer; this option must be used with /i

When you use Regsvr32.exe, it attempts to load the component and call its DLLSelfRegister function. If this attempt is successful, Regsvr32.exe displays a dialog indicating success. If the attempt is unsuccessful, Regsvr32.exe returns an error message, which may include a Win32 error code.
Example: To unregister Winshow's winshow.dll:
Click the Start button, and select Run
Enter this command line:
regsvr32 /u [systemroot]\winshow.dll
For example, in a Windows XP machine in which your systemroot was at c:\winnt, you would enter:
regsvr32 /u c:\winnt\winshow.dll

HOW TO DELETE IT
Find the DLL file right click and delete. You will probably find this one in Windows / system 32

Hnry I found this on the first search I did for Qidion with google. It took less than 1 minute to find the info on the hijacker and removal instructions. I'll let you find the info for Slotch. Forget that MSN search engine and install the google tool bar. Also you really should install Spyware Guard. It immediately stops any program from changing the home page or browser, then opens a window to tell you exactly what program is trying to install and asks you if you want to proceed or stop. You said in your post that you have no problem preventing it. Well obviously you do. Whatever security protocols are in place on your computer are not preventing it. I'm not getting down on you Bro I'm just trying to help you. I am disabled and all I do is sit here in front of my computer and play on the net 10 to 12 hours per day.I never get viruses although I do a lot of downloading on KaZaA (ssshhh! Don't tell RIAA<g>). I do a lot of web site browsing and I never, let me repeat that I NEVER see a pop up. Even on stupid sites like angelfire hosted sites where the pop ups come so fast and heavy you can't stop them (like the one that got you into this problem) I NEVER see any. I am only using 4 free programs to maintain that level of browsing quality. Spyware Blaster. Spyware Guard.
AVG anti-virus. And Freesurfer MK II. I check for updates daily, and even if there are no new updates I run Spybot and AVG everynight before I go to bed. I have a file called DOWNLOAD that I use for downloading files. When asked I always save the files to the download file before opening them so they can first be scanned with the AVG, done with a right click. Even large files like game demos take less than 1 minute to be scanned. All these mother f***ers out there that put this crap like hijackers and s**t out there spoil the enjoyment. I can tell from your tone in the posts that you are p**sed and frustrated. We've all been there and learned our lessons. I had to lose 6000 music files before I decided I better learn about partitions and back up hard drives. Now I am running 2 120 GB Maxtors with the OS on a 23GB partition. Surfing is fun again. Hope you can get there too. Good luck. I need to shut up now I'm ranting. SEE YA................!

Hey thanks for those helps. i learn something new, heh the regsvr32 thing.. but hey i dun think i need to use that, anyway i have tried using various spybots and stuff like it i feel its a little memory draining. besides i dun really mind pop ups i just hate those that force you to click and auto download stuff. i do surfing alot even for one without handicap (which probably mean i just have no life lol), sorry to hear about your handicap.. plus maybe you might not notice but if i depended heavily on those antiviryus shileds and stuff like that yes i make my surfing enjoyable a tit bit but i learn less things in the long run so if one day somehting hit me i won't know what it is and would probably start to blame those programs for not working.. i fix pcs and i nvr took a single course on how to do it make be just read up .. i do alittle javascript programming and i nvr take a single lessonn cept from my own research on the internet.. bottom line is i try to learn these things on my own its sort of trigger a heavier interest then when being taught..like any other i have been using this msn search thingy and some how got used to it, lol. so i feel a little uneasy when it doesn't work.. i keep my explorer neat and clean so i do not have like couple of bars here and there.. (maybe i'm just trying to make life more difficult for myself) hehehehe

any way .. regarding this search thing I FINALLY MANAGE TO FIXED it, without the reinstall part

JUST incase for those of you who may want to try ..

what i did,

i am running winxp , so by all mean i have a default adminstrator acct which i use(no log on required)
the worse part i can be in, is this acct gets c**k up lol

I switch on the guest acct, if i make a new acct i would have a hard time killing that acct as the min acct must be 2, admin and a main acct, the guest acct alone is enough to create havoc on all those installed programs.. i dun need more to do that..

ON the guest acct the explorer works fine(it just pop into my mind to try that this evening.)
so i tot maybe its something to do with the darn registry.. so i went about to compare.. but after awhile.. I GAVE up its defintiely not inside the

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

cos when i replace that entire key (deleted and replaced) with the one in the geust acct the browser doesn't work, and since i have deleted the entire registry key for the explorer before...and nothing happens my second try was to delete the entire one and replace it with the entire guest accts ' [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]

to my surprise.. it actually works .. so now my explorer has been restored..

as for those files that i mentions i deleted them using housecall + ad aware

however, under no protection program i am not sure if it will ever auto download again without my permission.. since until now i have no need to return to that webby..

i have a good no popup free ware .. seem to work great its a beta version but i only use it when doing some seriosuly surfing..

due to my nature of surfing (open new pages) and mostly on editing my own webapges it always opens a new page (under certain conditions it also considered a popup) so this no popup program doesn't work well for me..

Well those two bars are pretty new and have already hit the No. Hemisphere. The security sites say they have a handle on them here, but they are probably hitting the Singapore market a bit later. There seems to always be a lag between the continents either way of about a few days or a week. I'm glad you got it fixed.

Check your registry with regedit and see if this key has beeen changed or missing

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

if it has start a new txt document in notepad, copy and paste the key then rename the .txt to .reg.

right click on the file and click merge.

I don't know about the rest of you, but the following worked for me to remove Almighty Search. Go to the home page of IGetNet at http://www.igetnet.com/. At the very bottom left of the home page there is a link to uninstall the upgrade. I clicked on that, followed the directions and MSN was restored as my search page. Hopefully this might help some of you.

THALIE IS RIGHT YOU GUYS!

HAHAHAHA... oh my gosh! I love you Thalie Borrill. I've been trying for weeks to get rid of that Almighty Search thing. I've tried adware removal programs, repairing windows and everything. I never once thought to go to iGetNet.com. It's SO OBVIOUS! Your method worked like a CHARM!

oh, by the way. Did you all know you cannot uninstall IE from windows XP? You can only upgrade it if it needs upgrading. But by unchecking the little box in the windows programs things all you are doing is disableing it. It's supposed to help system admins if they need to disable it or something. Pretty lame design on Microsofts part I think, especially when things like almighty search by iGetNet attack it. N E Ways. Thalie your the best!

Doh! I had this same problem with IE's autosearch. I had merged the below .reg data into my registry, but there was additional junk in this key which was messing up autosearch. A modified reg file is below. Paste into notepad and rename with .reg file to execute.

REGEDIT4

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

I have a free popup blocker through Google. I'm up to 865 popups blocked. Go to Google and click options. Autofill is also there. Free and it works!