(re-)setting Google as the default search engine

[khaley]

I have searched through and read several sites in vain while trying to correct a recent problem: I downloaded AIM for chats and despite the fact that I unchecked the "Make AIM my default search engine" in the installation, AIM still went ahead and took over my searches. Even after uninstalling (as I thought) all AIM programs from my computer I still can't get rid of the search engine in the main navigation window of Firefox. I was wondering if you can help me re-set Google as my default search engine. I'm using WinXP and Mozilla Firefox.

[compdoc]

click on the AIM icon a list of search providers should show click on google and thats it

[khaley]

Unfortunately I have no AIM icon anymore to click on. The one in the navigation bar won't let me click on it.

[compdoc]

ok open firefox and in the address bar type this

about:config

and then hit enter

then scroll down to

browser.search.selectedEngine

then right click on it and then click reset

close firefox and the open firefox google should be back

let me know if this worked

if it does not I'll find another solution

[compdoc]

one more thing you should check is

browser.search.searchEnginesURL

the value should be

https://%LOCALE%.add-ons.mozilla.com/%LOCALE%/firefox/%VERSION%/search-engines/

[khaley]

I can't tell you how grateful I am for this help.
I wasn't able to locate either browser.search.selectedEngine or browser.search.searchEnginesURL in the list of configurations. I tried tweaking two things that looked similar enough and resetting the value to the stream you suggested. But still when I open Firefox the default is AIM.

[khaley]

I found out if I scroll down to keywordURL and click Reset it resets back to google. It works now. Thank you so much again for all your help!!

[compdoc]

great glad you got it working

[khaley]

I'm having the same problem I had a year ago, only this time around the solutions we tried (successfully) last year aren't working anymore: I've somehow lost the ability to have Google as my default search engine in Mozilla. I've tried typing about: config in the address bar and then scrolling down to keywordURL, but when I right click on this there's no option of doing "reset"--only "modify" or "copy" (this worked last year). I don't suppose you have any further suggestions? Thanks so much....

[kaninelupus]

OK - sounds like it might simply be time to create a new FF profile, as it sounds like has become completely corrupted if it won't allow any resets.

BTW - I'm assuming have again gotten rid of AIM, with no more desire to tempt fate ??

Now before guiding you through setting up a new profile in Firefox, do you have any saved passwords? Just asking, as this will require an extra add-in. Let us know and can go from there.

NB: Would also recommend downloading CCleaner and running the Registry cleaner to remove any lingering entries AIM left behind, just to make sure it doesn't continue to interfere

[khaley]

Thanks so much for your quick and helpful reply! I'd love to set up a new FF profile, if you can guide me through it. IN the meantime, I did succeed in getting Google back to being my default--I went into Programs and Removed two programs I'd added yesterday, then restarted my computer--miraculously, whatever annoying search engine had taken over had disappeared. However, I'd like to have a clean list under the about:config, as you say, so let's proceed....

I do have a ton of saved passwords in FF, actually.
B.t.w, if the problem isn't caused (this year, this time around) by my having installed AIM and its horrid entries, do you still recommend my running CCleaner?

OK - sounds like it might simply be time to create a new FF profile, as it sounds like has become completely corrupted if it won't allow any resets.

BTW - I'm assuming have again gotten rid of AIM, with no more desire to tempt fate ??

Now before guiding you through setting up a new profile in Firefox, do you have any saved passwords? Just asking, as this will require an extra add-in. Let us know and can go from there.

NB: Would also recommend downloading CCleaner and running the Registry cleaner to remove any lingering entries AIM left behind, just to make sure it doesn't continue to interfere

[kaninelupus]

I do have a ton of saved passwords in FF, actually.
B.t.w, if the problem isn't caused (this year, this time around) by my having installed AIM and its horrid entries, do you still recommend my running CCleaner?

OK - glad to hear things are at least usable, but yes would still recommend using CCleaner. Use to both clear out a little of the rubbish (ie, temp files etc) and still run the Reg cleaner, as uninstalling apps can still leave a lot of crap behind.

Now bear in mind (and this is for others reading afterwards) that none of this is essential for creating a clean profile - some may even prefer to not bring anything over, especially those using multiple profiles for different purposes, such as on a shared computer. The following is for the OP and those needing to create a new profile but still wanting to retain the basics from the old.

Now before getting started, you'll need to make the Profiles folder (or more specifically, the Documents and Settings folder where your profile folder is located) visible. From the Control Panel, open up Folder
Options and ensure both Hidden Files/Folders & System Protected Files/Folders are set as visible (you'll get a prompt on the latter, but fine to OK it).

Now you'll need the password export add-on for FF - have attached to this post for you. Right-click and save to your Desktop to save DL'ing twice (ALL FF add-ins can be installed from local location, simply by drag-and-dropping into FF's main window). Once DL'ed, drag-drop into FF and install.... restart FF.

Now you can option FF Options. n the Security tab, you'll see a new button "Import/Export Passwords" - click and follow the prompts.

Next is time to export your Bookmarks. In the Bookmarks menu, select Organise Bookmarks. Use the Import & Backup tool to export your bookmarks in HTML format to same location exported passwords to (makes sense to keep all these together to make life easier).

Final step is optional, but will allow you to preserve all your browsing history as well. This is where you need to access the actual Profiles folder. Now to make life easier, we'll jump there using the Run console, but the full location on XP is:
C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles
But to make life easier, hit WinKey+R, and paste the following into the text box:
%APPDATA%\Mozilla\Firefox\Profiles\
As you've never set up a custom profile, should only be the one, which will end with ".default", so Open up and locate "places.sqlite" -> copy and paste to same location as other files (will likely have to close FF before it will let you do this).

Now we have your key files, we are ready to set up a new profile. With Firefox closed, again open the Run console and enter firefox.exe -p to open the profile manager. Create a new Profile and start FF using new profile... this is essential to create all the new files/folders in the actual Profiles folder.

Now, firstly again drag-drop Password Exporter into FF -> install and restart FF. This time, use the tool to import all your passwords.

Use the Organise Bookmarks option to import all your bookmarks. Will need to take a couple of minutes afterward to tidy your bookmarks up and delete duplicate core FF folders, but no matter.

Lastly, if you wanted your history, close FF and open the new profile folder and copy-paste the "places.splite" file over the top of the default version.

And there you have it - new profile with all the bits you need retained :)

[khaley]

Hello again,

Did you say you had a password export add-on for FF? I didn't get the attachment if you did attach it to the last post--but I'm ready and rarin' to go with every procedure you outlined!

thanks so much again,
Kathleen

[khaley]

Dear Kaninelupus,

I was only waiting to get the password export add-on for FF (you said you'd attached it to the previous post, but I couldn't find it) to get started working on this problem. The problem (even after running CCleaner) is that IExplorer keeps on popping up with strange pop-ups while I'm working within various sites on FF. I have a feeling it's related to the activities of a few nights ago that generated the whole search-engine switchover.

thanks so much for helping with this!
Kathleen

OK - glad to hear things are at least usable, but yes would still recommend using CCleaner. Use to both clear out a little of the rubbish (ie, temp files etc) and still run the Reg cleaner, as uninstalling apps can still leave a lot of crap behind.

Now bear in mind (and this is for others reading afterwards) that none of this is essential for creating a clean profile - some may even prefer to not bring anything over, especially those using multiple profiles for different purposes, such as on a shared computer. The following is for the OP and those needing to create a new profile but still wanting to retain the basics from the old.

Now before getting started, you'll need to make the Profiles folder (or more specifically, the Documents and Settings folder where your profile folder is located) visible. From the Control Panel, open up Folder
Options and ensure both Hidden Files/Folders & System Protected Files/Folders are set as visible (you'll get a prompt on the latter, but fine to OK it).

Now you'll need the password export add-on for FF - have attached to this post for you. Right-click and save to your Desktop to save DL'ing twice (ALL FF add-ins can be installed from local location, simply by drag-and-dropping into FF's main window). Once DL'ed, drag-drop into FF and install.... restart FF.

Now you can option FF Options. n the Security tab, you'll see a new button "Import/Export Passwords" - click and follow the prompts.

Next is time to export your Bookmarks. In the Bookmarks menu, select Organise Bookmarks. Use the Import & Backup tool to export your bookmarks in HTML format to same location exported passwords to (makes sense to keep all these together to make life easier).

Final step is optional, but will allow you to preserve all your browsing history as well. This is where you need to access the actual Profiles folder. Now to make life easier, we'll jump there using the Run console, but the full location on XP is:
C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles
But to make life easier, hit WinKey+R, and paste the following into the text box:
%APPDATA%\Mozilla\Firefox\Profiles\
As you've never set up a custom profile, should only be the one, which will end with ".default", so Open up and locate "places.sqlite" -> copy and paste to same location as other files (will likely have to close FF before it will let you do this).

Now we have your key files, we are ready to set up a new profile. With Firefox closed, again open the Run console and enter firefox.exe -p to open the profile manager. Create a new Profile and start FF using new profile... this is essential to create all the new files/folders in the actual Profiles folder.

Now, firstly again drag-drop Password Exporter into FF -> install and restart FF. This time, use the tool to import all your passwords.

Use the Organise Bookmarks option to import all your bookmarks. Will need to take a couple of minutes afterward to tidy your bookmarks up and delete duplicate core FF folders, but no matter.

Lastly, if you wanted your history, close FF and open the new profile folder and copy-paste the "places.splite" file over the top of the default version.

And there you have it - new profile with all the bits you need retained :)

[Bob_180_Bob]

Hi,
Try this site

http://www.void.gr/kargig/blog/2009/07/02/using-firefox-password-exporter/

[kaninelupus]

Ah crap... I did forget to attach the file (blonde moment). Here 'tis :)

EDIT: classed as invalid file-type on DaniWeb - here's the direct link to the file. Should be able to right-click and "save as".

[kaninelupus]

Just looked over second post. Could be one of two things:

One is malware; the other is that what ever you installed buggered around with your default browser settings, so that when new-pages (or pop-ups) are generated via Firefox, your system is using what it thinks is the default browser (at least for that task).

Simplest way to find out if it is a default browser will actually occur in setting up new profile. First time you load new profile, it will ask if you want Firefox as default browser. If after selecting Yes and running for a while, and you still cop this issue, then we know is a malware issue and can guide you from there.

As an extra tip, after you have your new profile all set-up and running (ie, everything you need copied across), hard delete the original profile, as it sounds like it has become a little funky. To do this, first open FF's Profile Manager (as instructed above, Firefox needs to be completely closed to run) and delete original profile. Now chances are, if something is funky, there'll be files that this step wont delete, which means the base profile folder will still exist. To completely remove, follow these steps:

• Completely exit FF (and FF's Profile Manager) and go to the Profiles Folder.
• Select folder (don't actually open it) and hit Shift+Delete - Windows will ask if you want to permanently delete (ie, bypass Recycle Bin) - hit Yes.

This completely deletes the folder.

Now as said, not at this point convinced you have a malware issue, but if the whole opening popups in IE thing persists afterwards, will guide you from there :) Sorry again about the missing add-on :$

[khaley]

God bless you, kaninelupus!
To quote Babu of Seinfeld, "You very good man."

So far so good, as far as the IExplore popups go (I really wish I could permanently delete IExplore from my computer--is there any reason why a user shouldn't do that?). But I never found the option to set Mozilla Firefox as my default browser. When I opened FF after going through all the steps you outlined, it never gave me the option about setting it as the default. I am naturally curious whether this is a malware issue, as that seems highly plausible given the sorts of places I was visiting that occasioned this whole mess (Limewire--ugh).

thanks so much, again-
Kathleen

Just looked over second post. Could be one of two things:

One is malware; the other is that what ever you installed buggered around with your default browser settings, so that when new-pages (or pop-ups) are generated via Firefox, your system is using what it thinks is the default browser (at least for that task).

Simplest way to find out if it is a default browser will actually occur in setting up new profile. First time you load new profile, it will ask if you want Firefox as default browser. If after selecting Yes and running for a while, and you still cop this issue, then we know is a malware issue and can guide you from there.

As an extra tip, after you have your new profile all set-up and running (ie, everything you need copied across), hard delete the original profile, as it sounds like it has become a little funky. To do this, first open FF's Profile Manager (as instructed above, Firefox needs to be completely closed to run) and delete original profile. Now chances are, if something is funky, there'll be files that this step wont delete, which means the base profile folder will still exist. To completely remove, follow these steps:

• Completely exit FF (and FF's Profile Manager) and go to the Profiles Folder.
• Select folder (don't actually open it) and hit Shift+Delete - Windows will ask if you want to permanently delete (ie, bypass Recycle Bin) - hit Yes.

This completely deletes the folder.

Now as said, not at this point convinced you have a malware issue, but if the whole opening popups in IE thing persists afterwards, will guide you from there :) Sorry again about the missing add-on :$

[khaley]

p.s. Under the Advanced tab of Options in FF I just did a check to see if FF was my default browser and it says it is. I hope that clinches it.

[khaley]

I just had another IExplore popup when I entered Amazon.com, so I guess you must be right--it must be Malware. Any suggestions?

thanks!
Kathleen

[kaninelupus]

One final thing to try before turning to the malware scanners.

Close FF and open IE - set as default browser. Close IE
Open FF and reset as Default.

Is bit of a long shot, but sometimes when a local app has tinkered with the default browser settings for certain type of files/pages, you have hand it all over to IE before resetting the default browser.

To test, hop back over to say Amazon and see if behaviour re-occurs... if so, we'll check for malware.

BTW, what AV are you using, just so can get some idea of how likely an infection actually is?

[khaley]

Sorry to show my ignorance again, but what's AV?

[khaley]

OK, it's definitely malware, I guess, because IExplore did another popup even after I did as you suggested.... How do I get rid of Malware?

[kaninelupus]

Sorry about delayed response - DaniWeb went funny just before and lost first attempt at replying :-/

AV = AntiVirus (if is either AVG, Norton, or McAfee, we'll be looking elsewhere).

To the Malware issue first. Am going to suggest a two pronged approach; using first an old favourite, which gets under many malware's radar, then a more powerful utility to finish off. First download and install the following utilities (don't run just yet):

• Ad-Aware
• MalwareBytes
• (Free versions in both cases just fine for your needs).

Once installed, check to make sure both FULLY updated in way of malware signatures - very important. You DON'T need Ad-Aware's active protection tool, or what ever calling these days, so on install, just deselect that option.

Now, first run Ad-Aware and allow it to remove anything it finds... do not reboot when it asks... select NO/LATER.
Next, run MalwareBytes, also allowing it to fix anything it finds.
Once both have run (and MalwareBytes will likely prompt you for this), then and ONLY then is it fine to reboot your computer.

Now - just as an extra check-up - after reboot, can you pls download, install and run HijackThis for me? After the scan, DON'T go any further (ie, allow it to fix anything). Leave the utility open, and copy/paste the results here, so I can have a look over it for you. Things may well be clean after running malware cleaners, but is best to be sure to make sure no installed software tinkering with your browser settings.

NB: After all that, can then look at the AV situation :)

[kaninelupus]

NB: Is after 8PM here now and scans may take a while. If don't get a chance to look over HijackThis logs till same time tomorrow, don't stress - just means have crashed out (long week, absolutely exhausted). Is fine to leave HT open in mean time, so don't worry too much. Having said that, will keep an eye out till then for you :)

[khaley]

I have NOrton 360 Anti-virus

[kaninelupus]

I have NOrton 360 Anti-virus

Okaaaaay - am off to bed shortly, but we'll be talking about that one tomorrow.

Symantec (the company behind Norton) make absolutely fantastic enterprise/corporate antivirus/antimalware applications (I use Symantec's Endpoint Protection on my Vista partition, but was not yet fully updated for Win7 last time I checked in) but their Norton (home-user range) is not only very average, but uses so much system resources, it runs like a dog with three legs!

Anyhow, run those malware utilities, and will check-in after work tomorrow :)

[kaninelupus]

How'd you go with those scans?

[khaley]

Hi again,

So sorry to take so long to get back with the log file. I went to sleep with the computer still doing full scans via the anti-Malware and the Adaware....then was out with friends till 6 a.m. and when I got back finally got a chance to do the Hijack this! So here's the logfile (I haven't deleted anything yet--waiting for you to analyze it all!):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:02:43 AM, on 10/2/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\sttray.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8011 bytes

[kaninelupus]

remove anything to do with Mirar, and allow HijackThis to fix following lines:

• R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
• R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
• R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
• R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
• R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
• O1 - Hosts: ::1 localhost

Lastly, read herehttp://www.removevirus.org/how-to-guides/how-to-reset-hosts-file-xp-vista-windows-7/ and follow instructions on resetting Hosts file, as appears to have been hijacked

Will check back in later, as have to go out :)