Can anyone please help me in getting rid of find4u on my machine. Hijackthis! log available on request. any help would be greatly appreciated, thanks.

Sykes, have you used Spybot and Adware yet? If they did not work, just use hijackthis to solve your problem. You should see the "find4u" entries that are listed and just place a check next to them and run the program. This should solve your problem

I've used all three of those programs, and search4u is still hijacking my machine everytime you start Explorer. Hijackthis shows 5 obvious registry changes attributable to search4u, but when I remove them, it still hijacks my machine whenever you open Explorer, so there is obviously something I'm missing. Here is the Hijackthis! log.... Logfile of HijackThis v1.97.7 Scan saved at 9:03:54 AM, on 5/20/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\NavNT\rtvscan.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\AutoUpdate\AutoUpdate.exe C:\Program Files\NavNT\vptray.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogin.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe E:\Spybot\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://find4u.net/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find4u.net/index.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.106rocks.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://find4u.net/index.htm O2 - BHO: (no name) - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - E:\Spybot\PopThis.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0F82A7B5-BA79-2C6B-DCA5-AF963FD45446} - C:\PROGRA~1\INFOSE~1\Mapi Eq.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [DKRYI] C:\WINDOWS\DKRYI.exe O4 - HKLM\..\Run: [BIPWD] C:\WINDOWS\BIPWD.exe O4 - HKLM\..\Run: [OJQXFM] C:\WINDOWS\OJQXFM.exe O4 - HKLM\..\Run: [QTDGAD] C:\WINDOWS\QTDGAD.exe O4 - HKLM\..\Run: [krqxwzib] C:\WINDOWS\krqxwzib.exe O4 - HKLM\..\Run: [jopqxsf] C:\WINDOWS\jopqxsf.exe O4 - HKLM\..\Run: [qtodqf] C:\WINDOWS\qtodqf.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - Global Startup: winlogin.exe O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab O16 - DPF: {00000000-CDDC-0704-0B53-2C8830E9FAEC} - http://install.global-netcom.de/ieloader.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/29739b2fced008134206/netzip/RdxIE601.cab O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37908.6258680556 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_12_0.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{763D5914-97C5-476F-BC21-8C10F95B530C}: NameServer = 207.230.75.34,207.230.75.50 O17 - HKLM\System\CS1\Services\Tcpip\..\{763D5914-97C5-476F-BC21-8C10F95B530C}: NameServer = 207.230.75.34,207.230.75.50 I can see and remove the obvious 5 with "search4u" in them, but are there other entries in there I need to be removing? Thanks for your help.

In the previous post, when I mention "search4u" I actually mean "find4u"

Have HJT fix these: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://find4u.net/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find4u.net/index.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://find4u.net/index.htm O2 - BHO: (no name) - {0F82A7B5-BA79-2C6B-DCA5-AF963FD45446} - C:\PROGRA~1\INFOSE~1\Mapi Eq.dll (file missing) O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [DKRYI] C:\WINDOWS\DKRYI.exe O4 - HKLM\..\Run: [BIPWD] C:\WINDOWS\BIPWD.exe O4 - HKLM\..\Run: [OJQXFM] C:\WINDOWS\OJQXFM.exe O4 - HKLM\..\Run: [QTDGAD] C:\WINDOWS\QTDGAD.exe O4 - HKLM\..\Run: [krqxwzib] C:\WINDOWS\krqxwzib.exe O4 - HKLM\..\Run: [jopqxsf] C:\WINDOWS\jopqxsf.exe O4 - HKLM\..\Run: [qtodqf] C:\WINDOWS\qtodqf.exe O16 - DPF: {00000000-CDDC-0704-0B53-2C8830E9FAEC} - http://install.global-netcom.de/ieloader.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/29739b2fced008134206/netzip/RdxIE601.cab Reboot into safe mode and delete these files: C:\Program Files\Window Active\winactive.exe C:\Program Files\Window Active <---Folder Too C:\Program Files\AutoUpdate\AutoUpdate.exe C:\Program Files\AutoUpdate <---Folder Too C:\WINDOWS\DKRYI.exe <---all these files C:\WINDOWS\BIPWD.exe C:\WINDOWS\OJQXFM.exe C:\WINDOWS\QTDGAD.exe C:\WINDOWS\krqxwzib.exe C:\WINDOWS\jopqxsf.exe C:\WINDOWS\qtodqf.exe

I have the same find4u issues. Have tried to remove using programs including hijackthis (see log attached). I know to obviously remove the find4u files, but the program keep coming back. What other files should I remove? I don't want to remove any files which I need, but want to remove all files which I don't. This also attaches stuff like free cam sex on to my favorites list, which I obviously don't want up there. Logfile of HijackThis v1.97.7 Scan saved at 9:31:22 AM, on 5/23/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe C:\WINDOWS\System32\mshta.exe C:\PROGRA~1\COMPAQ\EASYAC~1\BTTNSERV.exe C:\PROGRA~1\COMPAQ\EASYAC~1\EAUSBKBD.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\PROGRA~1\MESSEN~1\msmsgs.exe C:\WINDOWS\System32\ctfmon.exe C:\windows\dllhelp.exe C:\Program Files\Internet Explorer\IEengine.exe C:\Program Files\Microsoft Office\Office10\msoffice.exe C:\Documents and Settings\default\Local Settings\Temp\Temporary Directory 3 for hijackthis1977.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://find4u.net/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find4u.net/index.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=3c00&s=searchbar&LC=0409 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://find4u.net/index.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe O4 - HKLM\..\Run: [MSKernel32] C:\WINDOWS\SYSTEM32\Win32.hta O4 - HKLM\..\Run: [Desksite CMA] c:\program files\desksite\bin\cma.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [dllhelp] c:\windows\dllhelp.exe O4 - HKCU\..\Run: [IEengine] C:\Program Files\Internet Explorer\IEengine.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM) O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM) O9 - Extra 'Tools' menuitem: AV Live (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: AV &Translate (HKLM) O9 - Extra button: Create Mobile Favorite (HKLM) O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll O12 - Plugin for .mid: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38129.589849537 Please help...thanks in advance. Jb

If your still there, have HJT fix these: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://find4u.net/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find4u.net/index.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://find4u.net/index.htm O4 - HKCU\..\Run: [dllhelp] c:\windows\dllhelp.exe O4 - HKCU\..\Run: [IEengine] C:\Program Files\Internet Explorer\IEengine.exe O4 - HKLM\..\Run: [MSKernel32] C:\WINDOWS\SYSTEM32\Win32.hta Reboot into safe mode and delete these files: c:\windows\dllhelp.exe C:\Program Files\Internet Explorer\IEengine.exe C:\WINDOWS\SYSTEM32\Win32.hta Let me know MrC