180 search assistant

During this past week a window keeps popping up with the
following message:
'180 Search Assistant Alert - Warning
The system has detected that a 3rd party applicaiton has
removed 180 search assistant without your consent. This
may cause some programs not to run as expected.'

It then offers the option to reinstall, tidy up or remind
me later.

If, as I suspect, this is not part of Windows XP can
anyone tell me what it is & how I remove it please?

Hi Dee - First, follow the manual (only) removal directions here as they
apply to your system:
http://www.sawtoothdistortion.com/Ar...180Search.html


Some additional info is available he

http://www.kephyr.com/spywarescanner...se/index.phtml
http://sarc.com/avcenter/venc/data/adware.ncase.html
http://www.safer-networking.org/inde...ail=2003-06-24



Then, run AdAware and SpyBot S&D to help clean up the residual stuff:

#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
when possible. Reboot and test if the malware is fixed after using each
tool. HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT...02092715262339
#########IMPORTANT#########

Sometimes the tools below will find files which they are unable to delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
"replacing, moving, renaming or deleting one or many files which are
currently in use (e.g. system files like comctl32.dll, or virus/trojan
files.)" Another is Killbox, he
http://download.broadbandmedic.com/Killbox.exe


Download and run Stinger.exe, he
http://download.nai.com/products/mca...rt/stinger.exe or from the link
on this page: http://vil.nai.com/vil/stinger/

Download sysclean.com , from Trend Micro, he
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, he http://www.trendmicro.com/download/pattern.asp Be sure to read
the "How-to" info he
http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might also want
to get Art's updater, SYS-UP.Zip, here for future updating of these:
http://home.epix.net/~artnpeg/). (If you download and use the updater from
the beginning, it will automatically handle downloading the other files.)
Place them in a dedicated folder after appropriate unzipping. Disable
Restore if your on XP or ME (directions he
http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm), then boot to
Safe mode (HowTo he
http://service1.symantec.com/SUPPORT...01052409420406)
Do a complete scan of your system in Safe mode and clean or delete anything
it finds. Reboot to normal mode and re-run the scan again.

This scan may take a long time, as Sysclean is VERY extensive and thorough.


For the general hijack case, the best way to start is to get Ad-Aware SE
Personal Edition, he http://www.lavasoftusa.com/support/download/.
UPDATE, set it up in accordance with this:
http://forum.aumha.org/viewtopic.php?t=5877 or the directions immediately
below and run this regularly to get rid of most "spyware/hijackware" on your
machine. If it has to fix things, be sure to re-boot and rerun AdAware
again and repeat this cycle until you get a clean scan. The reason is that
it may have to remove things which are currently "in use" before it can then
clean up others. Configure Ad-aware for a customized scan, and let it
remove any bad files found.....

Begin Setup Directions
Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click the gear
wheel at the top and check these options to configure Ad-aware for a
customized scan:

General activate these: "Automatically save log-file" and "Automatically
quarantine objects prior to removal"

Scanning activate these: "Scan within archives", "Scan active processes",
"Scan registry", "Deep scan registry," "Scan my IE Favorites for banned
sites," and "Scan my Hosts file"

Tweaks Scanning Engine activate this: "Unload recognized processes during
scanning."

Tweaks Cleaning Engine: activate these: "Automatically try to unregister
objects prior to deletion" and "Let Windows remove files in use after
reboot."

Click "Proceed" to save your settings, then click "Start." Make sure
"Activate in-depth scan" is ticked green, then scan your system. When the
scan is finished, the screen will tell you if anything has been found, click
"Next." The bad files will be listed. Right click the pane and click "Select
all objects" - This will put a check mark in the box at the side, click
"Next" again and click "OK" at the prompt "# objects will be removed.
Continue?"
End Setup Directions

Courtesy of http://www.nondisputandum.com/html/anti_spyware.html: HINT: If
Ad Aware is automatically shut-down by a malicious software, first run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe, before
opening Ad Aware. When AAWCloak is open, click "Activate Cloak". Than open
Ad Aware and scan your system.



Another excellent program for this purpose is SpyBot Search and Destroy
available he http://security.kolla.de/ SpyBot Support Forum he
http://www.net-integration.net/cgi-b.../ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing ONLY RED things with SpyBot
S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle until
you get a clean "no red" scan. The reason is that SpyBot sometimes has to
remove things which are currently "in use" before it can then clean up
others.

Note that sometimes you need to make a judgment call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm


Once you get this cleaned up, you might want to consider installing Eric
Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help prevent this
kind of thing from happening in the futu

IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm "IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of Internet
Explorer. Once you merge this list of sites and domains into the Registry,
the web sites for these companies will not be able to use cookies, ActiveX
controls, Java applets, or scripting to compromise your privacy or your PC
while you surf the Net. Nor will they be able to use your browser to push
unwanted pop-ups, cookies, or auto-installing programs on your PC." Read
carefully.

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
load - but keep it UPDATED) The latest version as of this writing will
prevent installation or prevent the malware from running if it is already
installed, and it provides information and fixit-links for a variety of
parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. All three Very Highly Recommended

Next, install and keep updated a good HOSTS file. It can help you avoid
most adware/malware. See he http://www.mvps.org/winhelp2002/hosts.htm
(Be sure it's named/renamed HOSTS - all caps, no extension) Additional
tutorials he
http://www.bleepingcomputer.com/foru...wt utorial=51
(detailed) and he http://www.spywarewarrior.com/viewtopic.php?t=410
(overview)


Finally, be sure that you have a good hardware or software firewall and an
AntiVirus installed, and bring your OS up-to-date with ALL Critical updates
from Windows Update.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In ,
dee typed:
During this past week a window keeps popping up with the
following message:
'180 Search Assistant Alert - Warning
The system has detected that a 3rd party applicaiton has
removed 180 search assistant without your consent. This
may cause some programs not to run as expected.'

It then offers the option to reinstall, tidy up or remind
me later.

If, as I suspect, this is not part of Windows XP can
anyone tell me what it is & how I remove it please?

dee wrote:
During this past week a window keeps popping up with the
following message:
'180 Search Assistant Alert - Warning
The system has detected that a 3rd party applicaiton has
removed 180 search assistant without your consent. This
may cause some programs not to run as expected.'

It then offers the option to reinstall, tidy up or remind
me later.

If, as I suspect, this is not part of Windows XP can
anyone tell me what it is & how I remove it please?


The "180 Search Assistant" is a component of n-Case.

n-Case is a form of spyware. Two products that are normally
quite effective at finding and removing such scumware are Ad-Aware
from www.lavasoft.de and SpyBot Search and Destroy from
www.safer-networking.org/. Both have free versions.

Symantec provides removal instructions:
http://securityresponse.symantec.com...are.ncase.html

Additional manual removal instructions for the most common
varieties of scumware are available he

PC Hell Spyware and Adware Removal Help
http://www.pchell.com/support/spyware.shtml

--

Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having
both at once. - RAH