Message causing some concern.

richprice · 10 Jul 2011

Just recently, I was installing a few new apps. One of them seems to have snuck something in without me catching it. I don't know which app it could have been, and I usually block this sort of thing before it has a chance to do any harm or damage. Now I keep getting a message (screenshot included here) that a program is being blocked from changing my Search Settings.

Message causing some concern.-snap_message_1.png

I have gone through HiJackThis and killed off anything that I didn't want (a few older apps I didn't need starting) and a couple of things I didn't recognize. MalwareBytes Pro (paid version) doesn't raise any alarms after a full scan. Nor does AdAware Pro. None of the protection and removal apps don't seem to think whatever it is, is malware. Still, I have missed whatever it is that is trying to change my settings and I keep getting the same message a few times every hour. Whatever it is seems to make 3 attempts at changing my search settings and then gives up for a while.

Does anybody here have any experience with something like this? I could sure use the help. Normally, I'm the one giving help, but today just isn't my day. I need to get rid of this bug, but I can't find it. Any help conquering this thing will be deeply appreciated.

richc46 · 10 Jul 2011

Welcome

In the future download WinPatrol, it will tell you when a change is being made to your system and give you time to make the corrction.
Make a clean boot to find out what is causing this problem.
http://support.microsoft.com/kb/929135

The Howling Wolves · 10 Jul 2011

Have you tried one of Brinks Tutorials...
1. User Account Control - UAC - Change Notification Settings

2. "Notification Area Icons" Settings - Enable or Disable

richprice · 10 Jul 2011

richc46 said:

Welcome

In the future download WinPatrol, it will tell you when a change is being made to your system and give you time to make the corrction.
Make a clean boot to find out what is causing this problem.
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

Between UAC, Returnil System Suite, Comodo Internet Security Suite 2011, AdAware and a couple others, I always get a notification when something changes. I'm just not able to find out WHICH program it is that's trying to make the change. I will try the WinPatrol, and maybe it will tell me which program is trying to make the change. Whatever it is (even if it is part of an app or utility that I'm using) I'll remove it when I find out what it is.

I'm using Win 7 Pro x64 SP1, just in case you need to know.

Corrine · 10 Jul 2011

richprice said:

Just recently, I was installing a few new apps. One of them seems to have snuck something in without me catching it. I don't know which app it could have been, and I usually block this sort of thing before it has a chance to do any harm or damage. Now I keep getting a message (screenshot included here) that a program is being blocked from changing my Search Settings.

It might help to know what new apps you installed. It sounds as though one included a toolbar that is actually run by IAC/Ask. For example, Avira's AntiVir WebGuard is actually part of Ask, which will persistently try to change your search settings.

These are the security products that include the Ask Toolbar: Products with Ask Toolbar - Calendar Of Updates

Here's a long list of products with unwanted add-ons, many including the Ask Toolbar: Installers Hall of Shame (Unwanted add-on) - Calendar Of Updates

Borg 386 · 11 Jul 2011

If you want to take an in depth look at what's starting & running, there are some free tools available here:

Autoruns for Windows

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.
Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.
You'll probably be surprised at how many executables are launched automatically!

Process Explorer

Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.
The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.

Also, to see what's connecting to the web:

http://technet.microsoft.com/en-us/s...rnals/bb897437

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.