What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

clicksearchclick.com

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I can't get ride of clicksearchclick.com there was a simliar post that I relyed to but I can't do some of the things on that post because 1. Spybot crashes and 2. clicksearchclick.com blocks me from going to certain websites (including this site - Im on a diff computer.) 3. Can't do windows update

CWShredder finds nothing
Spybot finds: SmartSecurity, CoolWWWSearch.Yexe (newest update via online)

***Here is the HJT log*******
Logfile of HijackThis v1.99.1
Scan saved at 3:45:26 PM, on 5/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\AIM95\aim.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\devldr32.exe
C:\Spybot - Search & Destroy\SpybotSD.exe
C:\HijackThis\HijackThis.exe
C:\WINDOWS\system32\Services\{79D28F9A-66BF-4A16-8484-E433C2988A2D}\SVCHOST.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\system32\Services\{79D28F9A-66BF-4A16-8484-E433C2988A2D}\SECURITY.EXE
O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\system32\Services\{79D28F9A-66BF-4A16-8484-E433C2988A2D}\SVCHOST.EXE
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [AIM] C:\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\AIM95\aim.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

I do see www.clicksearch.com in there but can't seem to have HJT remove it.. Also the C:\WINDOWS\system32\Services\{79D28F9A-66BF-4A16-8484-E433C2988A2D}\SVCHOST.EXE I believe needs to be removed too.

Can anyone help me thanks.
Post #2 last edited
<_< I think I fixed it. But I'm not sure…. If someone has a similar problem this is what I did. Boot to safe mode holding F8 goto C:\WINDOWS\system32\Services there will be a folder like {79DUGDYW&^%* something random inside it will be security.exe and SVCHost or something close to that with some .dll files. Delete them all. Next goto C:\WINDOWS\Prefetch Delete all the files in that. I noticed some come back but you should only have 5 files there. Next goto desktop, right click my computer, properties, system restore tab. Check "Turn off System Restore on all drives." (you can turn it back on after the problem is gone) Next Empty recycle bin Change your browsers Home URL to something other then clicksearchclick.com Restart into normal mode. Problem almost gone. You might have to fix your desktop once you enter. Start>Settings>Control Panel>Display>Desktop Tab>CustomizeDesktop Button>Web Tab> Uncheck Security>Delete Security Click Yes, OK, Apply Also install any missing Microsoft Security Updates. Hope this works for everyone I wish someone would sue these guys or their webhost I lost a day just trying to fix my machine or find info on how to fix it. (I also notice I still have a yellow "!" in the bottom right) Anyone know what this is its telling me I have spyware…)
Post #3
Go here and get yoursel a Free Anti-Virus program.
http://free.grisoft.com/softw/70free/setup…ree_322a531.exe

Save, Install, update and do a full scan.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #4
I don't want free antivirus software… I ran Spybot.. ( did you read my post?) Why are you giving me a noob walk though? Couldn't you tell I'm not a noob? :scratch: Anyone else know how to get rid of this thing? It's opening topantispyware.com in a small window like its trying to help me but when I did a search it seems to be a trojan or somesort. I think I might have kill part of it with the steps above. But still the little icon is anoyying…
Post #5
Sorry you got offended. After reading your post he might have thought you were a noob. For saying that

Next goto desktop, right click my computer, properties, system restore tab.
Check "Turn off System Restore on all drives." (you can turn it back on after the problem is gone)


This is never a good idea a bad restore point is better than none. Or because you said

Next goto C:\WINDOWS\Prefetch
Delete all the files in that. I noticed some come back but you should only have 5 files there.

This a tweak that is not nessary, it does nothing. But slow your system start up and slow down the programs. Me I have about 87 files in prefetch.


Now if you would like some help here Download a AV and scan with it, if you like you can pay for it. Then scan with Ad-aware.

Download the trial version of TDS-3
Install it, but do not launch it yet

Update it hereright click, select "save as"

Save it to the directory where you installed TDS-3, overwriting the previous radius.td3.

Then launch TDS-3. in the top bar of tds window click system testing> full system scan.
detections will appear in the lower pane of tds window. after the scan is finished ( it'll take a while )
right click the list> select save as txt. save it and post the contents of the scandump.txt here.

After posting the scandump go ahead and right click the list of detections again. this time select delete!
Only delete those with positive identification.

Should you wish not to follow the instructions then please post back and have this thread closed.
Post #6
First off I was trying to help people they might not know how to turn off restore and it's not a bad idea. Look at other forums it's recommends sometimes. Second C:\WINDOWS\Prefetch there was definitely bad files there. Other forums I found said almost exactly what I said to fix this problem. So you have no clue what your talking about. What are you running a 486 my computer boots fine now. Lastly why are you trying to cause problems? I was trying to help people with the same problem I was having. And why are you still suggesting things I should do? The problem is totally fix… Close the thread please… (anyone with this problem do whatever method you want I just know what I did worked.) (" Update it hereright click, select "save as" " - little eagle) <= Jerk :rofl:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI