Hi Kevin, I have downloaded and run these three programs: Norton Antivirus (updated), Adaware (newest version), and Spybot, as you suggested. It didn't fix my browser problem: I still can't search with www.yahoo.com or www.google.com. I ran the HijackThis program and this message popped up: "You have a particularly large number of Hijacked domains. It's better for you to delete each file itself than to fix the item and create a backup" etc. I'd follow what the popup says, except that there was another popup saying that I shouldn't casually delete files. Sorry, I'm a very very newbie to this stuff, I apologize if I've made any mistakes. Please help; I've been unable to search on tne net for weeks. Thanks, Katie PS: here is the Logfile Logfile of HijackThis v1.97.7 Scan saved at 12:38:54 AM, on 1/21/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\SPOOL32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\SYSTEM\SSDPSRV.exe C:\WINDOWS\SYSTEM\MDM.exe C:\WINDOWS\SYSTEM\STIMON.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.exe C:\PROGRAM FILES\NORTON INTERNET SECURITY PROFESSIONAL\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.exe C:\WINDOWS\SYSTEM\RESTORE\STMGR.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\SYSTEM\WBEM\WINMGMT.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\WINDOWS\SYSTEM\PRPCUI.exe C:\PROGRAM FILES\PHOENIX TECHNOLOGIES\BAYSWAP\BAYSWAP.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\RUNDLL32.exe C:\WINDOWS\SYSTEM\TOSMEM.exe C:\WINDOWS\SYSTEM\IRMON.exe C:\WINDOWS\SYSTEM\HPZTSB07.exe C:\WINDOWS\SYSTEM\LVCOMS.exe C:\WINDOWS\LOADQM.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.exe C:\WINDOWS\RunDLL.exe C:\WINDOWS\WUAUCLT.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe C:\MY DOCUMENTS\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=ftp.starhub.net.sg:21;gopher=proxy.starhub.net.sg:8080;http=proxy.starhub.net.sg:8080;https=proxy.starhub.net.sg:8080 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank O1 - Hosts: 88.88.88.88 elite O1 - Hosts: 207.44.220.30 www.google.akadns.net O1 - Hosts: 207.44.220.30 www.google.com O1 - Hosts: 207.44.220.30 google.com O1 - Hosts: 207.44.220.30 www.altavista.com O1 - Hosts: 207.44.220.30 altavista.com O1 - Hosts: 207.44.220.30 search.yahoo.com O1 - Hosts: 207.44.220.30 uk.search.yahoo.com O1 - Hosts: 207.44.220.30 ca.search.yahoo.com O1 - Hosts: 207.44.220.30 jp.search.yahoo.com O1 - Hosts: 207.44.220.30 au.search.yahoo.com O1 - Hosts: 207.44.220.30 de.search.yahoo.com O1 - Hosts: 207.44.220.30 search.yahoo.co.jp O1 - Hosts: 207.44.220.30 www.lycos.de O1 - Hosts: 207.44.220.30 www.lycos.ca O1 - Hosts: 207.44.220.30 www.lycos.jp O1 - Hosts: 207.44.220.30 www.lycos.co.jp O1 - Hosts: 207.44.220.30 alltheweb.com O1 - Hosts: 207.44.220.30 web.ask.com O1 - Hosts: 207.44.220.30 ask.com O1 - Hosts: 207.44.220.30 www.ask.com O1 - Hosts: 207.44.220.30 www.teoma.com O1 - Hosts: 207.44.220.30 search.aol.com O1 - Hosts: 207.44.220.30 www.looksmart.com O1 - Hosts: 207.44.220.30 ca.search.msn.com O1 - Hosts: 207.44.220.30 fr.ca.search.msn.com O1 - Hosts: 207.44.220.30 search.fr.msn.be O1 - Hosts: 207.44.220.30 search.fr.msn.ch O1 - Hosts: 207.44.220.30 search.latam.yupimsn.com O1 - Hosts: 207.44.220.30 search.msn.at O1 - Hosts: 207.44.220.30 search.msn.be O1 - Hosts: 207.44.220.30 search.msn.ch O1 - Hosts: 207.44.220.30 search.msn.co.in O1 - Hosts: 207.44.220.30 search.msn.co.jp O1 - Hosts: 207.44.220.30 search.msn.co.kr O1 - Hosts: 207.44.220.30 search.msn.com.br O1 - Hosts: 207.44.220.30 search.msn.com.hk O1 - Hosts: 207.44.220.30 search.msn.com.my O1 - Hosts: 207.44.220.30 search.msn.com.sg O1 - Hosts: 207.44.220.30 search.msn.com.tw O1 - Hosts: 207.44.220.30 search.msn.co.za O1 - Hosts: 207.44.220.30 search.msn.de O1 - Hosts: 207.44.220.30 search.msn.dk O1 - Hosts: 207.44.220.30 search.msn.es O1 - Hosts: 207.44.220.30 search.msn.fi O1 - Hosts: 207.44.220.30 search.msn.fr O1 - Hosts: 207.44.220.30 search.msn.it O1 - Hosts: 207.44.220.30 search.msn.nl O1 - Hosts: 207.44.220.30 search.msn.no O1 - Hosts: 207.44.220.30 search.msn.se O1 - Hosts: 207.44.220.30 search.ninemsn.com.au O1 - Hosts: 207.44.220.30 search.t1msn.com.mx O1 - Hosts: 207.44.220.30 search.xtramsn.co.nz O1 - Hosts: 207.44.220.30 search.yupimsn.com O1 - Hosts: 207.44.220.30 uk.search.msn.com O1 - Hosts: 207.44.220.30 search.lycos.com O1 - Hosts: 207.44.220.30 www.lycos.com O1 - Hosts: 207.44.220.30 www.google.ca O1 - Hosts: 207.44.220.30 google.ca O1 - Hosts: 207.44.220.30 www.google.uk O1 - Hosts: 207.44.220.30 www.google.co.uk O1 - Hosts: 207.44.220.30 www.google.com.au O1 - Hosts: 207.44.220.30 www.google.co.jp O1 - Hosts: 207.44.220.30 www.google.jp O1 - Hosts: 207.44.220.30 www.google.at O1 - Hosts: 207.44.220.30 www.google.be O1 - Hosts: 207.44.220.30 www.google.ch O1 - Hosts: 207.44.220.30 www.google.de O1 - Hosts: 207.44.220.30 www.google.se O1 - Hosts: 207.44.220.30 www.google.dk O1 - Hosts: 207.44.220.30 www.google.fi O1 - Hosts: 207.44.220.30 www.google.fr O1 - Hosts: 207.44.220.30 www.google.com.gr O1 - Hosts: 207.44.220.30 www.google.com.hk O1 - Hosts: 207.44.220.30 www.google.ie O1 - Hosts: 207.44.220.30 www.google.co.il O1 - Hosts: 207.44.220.30 www.google.it O1 - Hosts: 207.44.220.30 www.google.co.kr O1 - Hosts: 207.44.220.30 www.google.com.mx O1 - Hosts: 207.44.220.30 www.google.nl O1 - Hosts: 207.44.220.30 www.google.co.nz O1 - Hosts: 207.44.220.30 www.google.pl O1 - Hosts: 207.44.220.30 www.google.pt O1 - Hosts: 207.44.220.30 www.google.com.ru O1 - Hosts: 207.44.220.30 www.google.com.sg O1 - Hosts: 207.44.220.30 www.google.co.th O1 - Hosts: 207.44.220.30 www.google.com.tr O1 - Hosts: 207.44.220.30 www.google.com.tw O1 - Hosts: 207.44.220.30 go.google.com O1 - Hosts: 207.44.220.30 google.at O1 - Hosts: 207.44.220.30 google.be O1 - Hosts: 207.44.220.30 google.de O1 - Hosts: 207.44.220.30 google.dk O1 - Hosts: 207.44.220.30 google.fi O1 - Hosts: 207.44.220.30 google.fr O1 - Hosts: 207.44.220.30 google.com.hk O1 - Hosts: 207.44.220.30 google.ie O1 - Hosts: 207.44.220.30 google.co.il O1 - Hosts: 207.44.220.30 google.it O1 - Hosts: 207.44.220.30 google.co.kr O1 - Hosts: 207.44.220.30 google.com.mx O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe O4 - HKLM\..\Run: [BaySwap] C:\Program Files\Phoenix Technologies\BaySwap\BaySwap.exe O4 - HKLM\..\Run: [BaySwap2] C:\Program Files\Phoenix Technologies\BaySwap\TbUpdate.exe O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [NVQuickTweak] RUNDLL32.exe NVQTWK.DLL,NvTaskbarInit O4 - HKLM\..\Run: [TosMem] tosmem.exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [ConMgr.exe] "C:\PROGRAM FILES\EARTHLINK 5.0\CONMGR.exe" O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\PROGRAM FILES\EARTHLINK 5.0\UPDATEMGR.exe" /NOCM O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb07.exe O4 - HKLM\..\Run: [iwxqvvd] "C:\WINDOWS\SYSTEM\IWXQVVD.exe" O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security Professional\UrlLstCk.exe O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\NORTON~1\ADVTOOLS\ADVCHK.exe O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\NORTON~1\ADVTOOLS\NPROTECT.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.exe O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\NORTON~1\ADVTOOLS\NPROTECT.exe O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.exe O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.exe O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - Startup: Microsoft Office.lnk = C:\Program Files\office2k\Office\OSA9.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.starhub.net.sg O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37762.6267592593 O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll

Hi Katie, Run HijackThis again and place a check in the box next to the following item. Next, close all browser Windows, and have HT 'fix checked'. You Must restart your computer when you're done. O4 - HKLM\..\Run: [iwxqvvd] "C:\WINDOWS\SYSTEM\IWXQVVD.exe" After restarting delete the following file: C:\WINDOWS\SYSTEM\IWXQVVD.exe Then do a search for Hosts. (no file extension) Open each file that is found and delete the one that contains all the 01-Hosts entries listed in the hijack log.