# Help me get rid of Lycos Sidesearch

**URL:** <https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897>\
**Category:** Factual Questions\
**Created:** [September 10, 2004, 9:48am UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897 "2004-09-10T09:48:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Grasshopper](https://avatars.discourse-cdn.com/v4/letter/g/f19dbf/32.png) [@Grasshopper](https://boards.straightdope.com/u/Grasshopper)\
**Post date:** [September 10, 2004, 9:48am UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/1 "2004-09-10T09:48:26Z")

</div>

For the record, I did read the sticky on asking computer questions. I have run Ad-aware, Spybot Search and Destroy, Spyware Blaster, NoAdware, and the Cleaner and probably half a dozen more that I can’t think of right now. I don’t remember which program it was, but one gives you a log of all spyware found on your computer, and the suggestion in the sticky was to post the results of the log on HijackThis’s website - my log said my computer is completely clean. It isn’t!

Lycos sidesearch keeps popping up every time I search for something, and my computer has been crashing like crazy lately. I’ve gone to the control panel to Add/Remove programs - Sidesearch isn’t listed as one of the programs. I’ve searched for it; nothing shows up. I’ve looked at the instructions for manually removing Sidesearch found on [this](http://www.spysweeper.com/lycos-sidesearch-uninstall.html) website, and the startup entry it mentions in the registry? Yup, you guessed it - it isn’t there. By all accounts, my computer _should not_ have sidesearch, but it must be hidden somewhere on my computer because it’s still popping up.

I hope it’s okay that I’m posting a computer/spyware question here. I just don’t know what else to do, so I’m turning this over to the smartest group of people I know. I’m using Windows ME and Internet Explorer 6.0. And I know there’s some consensus that ME can be junk, but this is the first real computer problem I’ve had in 4 years. And no, I definitely don’t plan to use IE ever again after this! In fact, would it fix the problem if I were to just completely delete Internet Explorer?

Thanks for any help you can give me. This is just driving me crazy.

---

<div class="post-metadata">

**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\
**Post date:** [September 10, 2004, 2:04pm UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/2 "2004-09-10T14:04:56Z")

</div>

Run [HijackThis](http://www.spychecker.com/program/hijackthis.html) and post the log here. It will show all startup items and browser add-ons.

I wouldn’t recommend removing IE; some sites require it. [Mozilla Firefox](http://www.mozilla.org/products/firefox/) is an excellent substitute for everyday use though.

---

<div class="post-metadata">

**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\
**Post date:** [September 10, 2004, 2:27pm UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/3 "2004-09-10T14:27:48Z")

</div>

Alternatively, if you’re feeling particularly confident, you can research the HijackThis log on your own using [this handy tutorial](http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htm). I used it and was able to eliminate an exasperatingly nasty spyware problem. However, I understand that you can inadvertently screw things up by deleting the wrong items, so make sure you know what you’re doing.

---

<div class="post-metadata">

**Author:** ![Grasshopper](https://avatars.discourse-cdn.com/v4/letter/g/f19dbf/32.png) [@Grasshopper](https://boards.straightdope.com/u/Grasshopper)\
**Post date:** [September 11, 2004, 4:15am UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/4 "2004-09-11T04:15:28Z")

</div>

Thanks for the replies so far. Here is my HijackThis log - I also posted it to the Spyware Info forums but haven’t gotten any replies yet. A great big thank you to anyone who is willing to look through this log to try to help me. I’ve lost count of how many times I had to restart my computer today, and it’s making me weary.

Logfile of HijackThis v1.98.2  
Scan saved at 12:17:30 PM, on 9/10/2004  
Platform: Windows ME (Win9x 4.90.3000)  
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:  
C:\WINDOWS\SYSTEM\KERNEL32.DLL  
C:\WINDOWS\SYSTEM\MSGSRV32.EXE  
C:\WINDOWS\SYSTEM\SPOOL32.EXE  
C:\WINDOWS\SYSTEM\MPREXE.EXE  
C:\WINDOWS\SYSTEM\MSTASK.EXE  
C:\WINDOWS\SYSTEM\SSDPSRV.EXE  
C:\WINDOWS\SYSTEM\STIMON.EXE  
C:\WINDOWS\SYSTEM\mmtask.tsk  
C:\WINDOWS\EXPLORER.EXE  
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE  
C:\WINDOWS\TASKMON.EXE  
C:\WINDOWS\SYSTEM\SYSTRAY.EXE  
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM\_EXEC.EXE  
C:\WINDOWS\SYSTEM\WMIEXE.EXE  
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\RXMON9X.EXE  
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\MOTIVEASSISTANT\BIN\MAD.EXE  
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE  
C:\WINDOWS\LOADQM.EXE  
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE  
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE  
C:\PROGRAM FILES\NETZIP CLASSIC\NZFPROP.EXE  
C:\PROGRAM FILES\CANON CREATIVE\TEXTBRIDGE\BIN\INSTANTACCESS.EXE  
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE\_OB\EVNTSVC.EXE  
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE  
C:\WINDOWS\TPPALDR.EXE  
C:\PROGRAM FILES\[SUPPORT.COM](http://SUPPORT.COM)\BIN\TGCMD.EXE  
C:\PROGRAM FILES\THE CLEANER\TCM.EXE  
C:\PROGRAM FILES\AIM95\AIM.EXE  
C:\PROGRAM FILES\IE NEW WINDOW MAXIMIZER\IEMAXIMIZER.EXE  
C:\PROGRAM FILES\SPYWARE DOCTOR\SPYDOCTOR.EXE  
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE  
C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\NETSCAPE.EXE  
C:\WINDOWS\SYSTEM\DDHELP.EXE  
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE  
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [http://keyword.netscape.com/keyword/%s](http://keyword.netscape.com/keyword/%25s)  
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost  
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5\_0\_2\_3.DLL  
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL  
O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL  
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5\_0\_2\_3.DLL  
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX  
O4 - HKLM…\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun  
O4 - HKLM…\Run: [TaskMonitor] C:\WINDOWS askmon.exe  
O4 - HKLM…\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s  
O4 - HKLM…\Run: [SystemTray] SysTray.Exe  
O4 - HKLM…\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme  
O4 - HKLM…\Run: [EnsoniqMixer] starter.exe  
O4 - HKLM…\Run: [EM\_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM\_EXEC.EXE  
O4 - HKLM…\Run: [TCASUTIEXE] TCAUDIAG -off  
O4 - HKLM…\Run: [RxMon] C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe  
O4 - HKLM…\Run: [madexe] C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\mad.exe  
O4 - HKLM…\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE  
O4 - HKLM…\Run: [LoadQM] loadqm.exe  
O4 - HKLM…\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe  
O4 - HKLM…\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers  
O4 - HKLM…\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe  
O4 - HKLM…\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET  
O4 - HKLM…\Run: [AttuneClientEngine] C:\PROGRA~1\AVEO\ATTUNE\bin\Attune\_ce.exe  
O4 - HKLM…\Run: [NetZIPFolders] C:\Program Files\Netzip Classic  
zfprop.exe /startup  
O4 - HKLM…\Run: [InstantAccess] C:\PROGRA~1\CANONC~1\TEXTBR~1\BIN\INSTAN~1.EXE /h  
O4 - HKLM…\Run: [RegisterDropHandler] C:\PROGRA~1\CANONC~1\TEXTBR~1\BIN\REGIST~1.EXE  
O4 - HKLM…\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update\_OB\evntsvc.exe -osboot  
O4 - HKLM…\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe  
O4 - HKLM…\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE  
O4 - HKLM…\Run: [tgcmdprovidersbc] “c:\program files\[support.com](http://support.com)\bin gcmd.exe” /server /startmonitor /deaf /nosystray  
O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\SYSTEM\QTTASK.EXE” -atboottime  
O4 - HKLM…\Run: [WildTangent CDA] RUNDLL32.exe C:\PROGRA~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain  
O4 - HKLM…\Run: [tcactive] C:\PROGRAM FILES\THE CLEANER ca.exe  
O4 - HKLM…\Run: [tcmonitor] C:\PROGRAM FILES\THE CLEANER cm.exe  
O4 - HKLM…\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme  
O4 - HKLM…\RunServices: [SchedulingAgent] mstask.exe  
O4 - HKLM…\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe  
O4 - HKLM…\RunServices: [\*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe  
O4 - HKLM…\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE  
O4 - HKLM…\RunServices: [RegisterDropHandler] C:\PROGRA~1\CANONC~1\TEXTBR~1\BIN\REGIST~1.EXE  
O4 - HKCU…\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl  
O4 - HKCU…\Run: [Yahoo! Pager] 1  
O4 - HKCU…\Run: [IE New Window Maximizer] C:\PROGRAM FILES\IE NEW WINDOW MAXIMIZER\iemaximizer.exe  
O4 - HKCU…\Run: [Spyware Doctor] “C:\PROGRAM FILES\SPYWARE DOCTOR\SPYDOCTOR.EXE” /Q  
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe  
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE  
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe  
O4 - Startup: AGSatellite.lnk = C:\Program Files\Audiogalaxy Satellite\AGSatellite.exe  
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe  
O4 - Startup: Connection Manager.lnk = C:\Program Files\SBC\Connection Manager\CManager.exe  
O4 - Startup: iMesh Auto Update.lnk = C:\Program Files\iMesh\Client\WiseUpdt.exe  
O4 - Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe  
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS\_DEF.HTM  
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS\_ENC.HTM  
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE  
O9 - Extra ‘Tools’ menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE  
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS\_ENC.HTM  
O9 - Extra ‘Tools’ menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS\_ENC.HTM  
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS\_DEF.HTM  
O9 - Extra ‘Tools’ menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS\_DEF.HTM  
O9 - Extra button: [Real.com](http://Real.com) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll  
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE  
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\COMPANION\MODULES\MESSMOD2\V4\YHEXBMES.DLL  
O9 - Extra ‘Tools’ menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\COMPANION\MODULES\MESSMOD2\V4\YHEXBMES.DLL  
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL  
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL  
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - [http://www.dellnet.com/](http://www.dellnet.com/) (file missing) (HKCU)  
O12 - Plugin for .ivy: C:\PROGRA~1\INTERN~1\PLUGINS  
plvscrn.dll  
O12 - Plugin for .wma: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS  
pdsplay.dll  
O14 - IERESET.INF: START\_PAGE\_URL=http://www.dellnet.com/  
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - [http://www.ipix.com/viewers/ipixx.cab](http://www.ipix.com/viewers/ipixx.cab)  
O16 - DPF: {2FF18E20-DE11-11D1-8161-00A0C90DD90C} (MSNBC News Menu Control 3.01) - [http://www.msnbc.com/download/nm1228.cab](http://www.msnbc.com/download/nm1228.cab)  
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - [http://207.188.7.150/0549b0501574a3099616/netzip/RdxIE2.cab](http://207.188.7.150/0549b0501574a3099616/netzip/RdxIE2.cab)  
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - [https://rr.esecurecare.net/rnt/rnl/java/RntX.cab](https://rr.esecurecare.net/rnt/rnl/java/RntX.cab)  
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - [http://photo.walmart.com/photo/upload/XUpload.ocx](http://photo.walmart.com/photo/upload/XUpload.ocx)  
O16 - DPF: Yahoo! Trivia - [http://download.games.yahoo.com/games/clients/y/tvt0\_x.cab](http://download.games.yahoo.com/games/clients/y/tvt0_x.cab)  
O16 - DPF: Yahoo! Towers 2.0 - [http://download.games.yahoo.com/games/clients/y/ywt0\_x.cab](http://download.games.yahoo.com/games/clients/y/ywt0_x.cab)  
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - [http://www.installengine.com/engine/isetup.cab](http://www.installengine.com/engine/isetup.cab)  
O16 - DPF: Yahoo! Spelldown - [http://download.games.yahoo.com/games/clients/y/sdt1\_x.cab](http://download.games.yahoo.com/games/clients/y/sdt1_x.cab)  
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - [http://medsvc.cats.ohiou.edu/AxisCamControl.ocx](http://medsvc.cats.ohiou.edu/AxisCamControl.ocx)  
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - [http://web1.shutterfly.com/downloads/Uploader.cab](http://web1.shutterfly.com/downloads/Uploader.cab)  
O16 - DPF: Yahoo! Euchre - [http://download.games.yahoo.com/games/clients/y/et1\_x.cab](http://download.games.yahoo.com/games/clients/y/et1_x.cab)  
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - [http://www.webshots.com/samplers/WSDownloader.ocx](http://www.webshots.com/samplers/WSDownloader.ocx)  
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - [http://makeover.ivillage.com/save/makeover.cab](http://makeover.ivillage.com/save/makeover.cab)  
O16 - DPF: ppctlcab - [http://www.pestscan.com/scanner/ppctlcab.cab](http://www.pestscan.com/scanner/ppctlcab.cab)  
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - [http://www.pestscan.com/scanner/axscanner.cab](http://www.pestscan.com/scanner/axscanner.cab)

---

<div class="post-metadata">

**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\
**Post date:** [September 11, 2004, 4:55pm UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/5 "2004-09-11T16:55:35Z")

</div>

This line looks the most suspicious:

> [@](#):
>
> O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL

I would try removing it. Make sure that HijackThis is in its own folder and is set to make a backup of all removed items beforehand.

It looks like you have a lot of things running at startup. I would strongly recommend running **msconfig** and unchecking any unneeded entries on the **Startup** tab. You should see a major improvement in your PC’s performance.

---

<div class="post-metadata">

**Author:** ![Grasshopper](https://avatars.discourse-cdn.com/v4/letter/g/f19dbf/32.png) [@Grasshopper](https://boards.straightdope.com/u/Grasshopper)\
**Post date:** [September 15, 2004, 4:22am UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/6 "2004-09-15T04:22:40Z")

</div>

Oh Number, Oh Number,  
May the deity of your choice bless you for all eternity.  
You have just become my \*number \* one doper (haha!)  
In fact, check your email - I just forwarded you all kinds of hugs and flowers and snowball fights to say Thank you!!!  
(just kidding on the last part, but thank you very very much :))

---

<div class="post-metadata">

**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\
**Post date:** [September 15, 2004, 2:36pm UTC](https://boards.straightdope.com/t/help-me-get-rid-of-lycos-sidesearch/263897/7 "2004-09-15T14:36:10Z")

</div>

You’re welcome. I’m glad it worked. I don’t know if your ISP would approve of such a large email attachment though, and inserting a snowball into your PC is never a good idea.