Having trouble getting rid of searchx.cc hijack on our son's computer. I have tried virtually every spyware remover I can find, but just can't get IE browser back. I have HiJack This, but cannot tell on many of the entries what to do. Is there someone who would be kind enough to look at the output log and give me some advice? I would sure appreciate it.

Art Pierce If you tried Ad-aware, Spybot S&D, and CWShredder without success...go ahead and post your log. I will help you with it. ________________________________________ I never give up! Windows Update

Thanks very much... Logfile of HijackThis v1.97.7 Scan saved at 9:16:47 AM, on 4/9/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\cisvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINNT\Explorer.exe C:\WINNT\System32\wfxsnt40.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe C:\WINNT\System32\ctfmon.exe C:\Program Files\Messenger\MSMSGS.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Common Files\efax\HotTray.exe C:\Palm\HOTSYNC.exe C:\Program Files\Common Files\efax\Dllcmd32.exe C:\Program Files\SpamPal\spampal.exe C:\WINNT\system32\cidaemon.exe C:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe C:\Program Files\Microsoft Office\Office10\EXCEL.exe C:\Program Files\FileZilla\filezilla.exe C:\WINNT\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Microsoft Office\Office10\OUTLOOK.exe C:\Program Files\Internet Explorer\IEXPLORE.exe \Diamond\Installers\SpyWare Removers\HijackThis.exe C:\WINNT\system32\NOTEPAD.exe C:\WINNT\system32\rundll32.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\NoteTab Light\NoteTab.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {11359F4A-B191-42d7-905A-594F8CF0387B} - C:\WINNT\Downloaded Program Files\CONFLICT.1\lexbar.dll O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) O2 - BHO: (no name) - {8978448D-DF0D-4D7B-A046-E03E5EBAF600} - C:\WINNT\System32\dfd.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [Internet Explorer Updater] C:\WINNT\system32\lexbac.exe O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.exe" /background O4 - HKCU\..\Run: [SiteMonitor] "C:\Program Files\Izlenim\Site Monitor\httpstats.exe" O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exe O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.exe O4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: SymmTime.lnk = C:\Program Files\Symmetricom\SymmTime\SymmTime.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Search &Dictionary - C:\Program files\Lexico\Toolbar\dictionary.htm O8 - Extra context menu item: Search &Thesaurus - C:\Program files\Lexico\Toolbar\thesaurus.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Translate Page - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://*.xoops.org O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F0E2D69A-DC2F-4E9B-A993-684FB1C21DBC} - http://dictionary.reference.com/tools/toolbar/lexico.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = the-solara-group.net O17 - HKLM\Software\..\Telephony: DomainName = the-solara-group.net O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = the-solara-group.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = the-solara-group.net

Art Pierce Please start hijackthis again and check the following: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\System32\dfd.dll/sp.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) O2 - BHO: (no name) - {8978448D-DF0D-4D7B-A046-E03E5EBAF600} - C:\WINNT\System32\dfd.dll O4 - HKLM\..\Run: [Internet Explorer Updater] C:\WINNT\system32\lexbac.exe Once all are checked; close all open windows except hijack and click fix checked Reboot the computer and delete the following: c:\winnt\system32\lexbac.exe <-file (this is a trojan that downloads malware on your computer) Next clear out temporary internet files including offline content and history. Clear out c:\winnt\temp <...yes all can go Have you placed http://*xoops.org in your trusted zone?...I don't think it's a problem...just making sure you put that there and not something else... I also recommend updating windows with all listed critical updates including sp1. It will take several visits to get them all. If you have a slow connection that presents a problem...some of the updates are quite large...M$ has offered a free update cd you can order. Details here: http://www.microsoft.com/security/protect/cd/order.asp I also notice the computer has no antivirus. Just to rule out that possiblity run a scan here: http://www.ravantivirus.com/scan/ If it reports any findings...paste results here along with new hijack log. There are a few good free antivirus programs available... AVG free: http://www.grisoft.com/us/us_dwnl_free.php Avast4 personal: http://www.avast.com/i_kat_207.php?lang=ENG AntiVir personal: http://www.free-av.com/ With AVG or Avast you will need to enter a proper email address so they can mail you the install key. I will check back in a bit... _______________________________________ I never give up! Windows Update

Thanks very much for the information. Removed what was requested, and checked for viruses. Nothing reported. We have a small network, and the virus stoppers are quite good. However, IE is still loading with searchx.cc screen. As requested, here is a current Hijackthis.log after doing the steps you suggested: Logfile of HijackThis v1.97.7 Scan saved at 7:16:25 PM, on 4/9/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\cisvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINNT\Explorer.exe C:\WINNT\System32\wfxsnt40.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe C:\WINNT\System32\ctfmon.exe C:\Program Files\Messenger\MSMSGS.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Common Files\efax\HotTray.exe C:\Palm\HOTSYNC.exe C:\Program Files\Common Files\efax\Dllcmd32.exe C:\Program Files\SpamPal\spampal.exe C:\WINNT\system32\cidaemon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft Office\Office10\OUTLOOK.exe C:\WINNT\System32\msiexec.exe C:\WINNT\System32\msiexec.exe C:\WINNT\System32\MsiExec.exe \Diamond\Installers\SpyWare Removers\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\System32\mcca.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\System32\mcca.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\System32\mcca.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\System32\mcca.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\System32\mcca.dll/sp.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\System32\mcca.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: (no name) - {D5FF13F6-9350-48AE-8397-1CD16002FFE5} - C:\WINNT\System32\mcca.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.exe" /background O4 - HKCU\..\Run: [SiteMonitor] "C:\Program Files\Izlenim\Site Monitor\httpstats.exe" O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exe O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.exe O4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: SymmTime.lnk = C:\Program Files\Symmetricom\SymmTime\SymmTime.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Search &Dictionary - C:\Program files\Lexico\Toolbar\dictionary.htm O8 - Extra context menu item: Search &Thesaurus - C:\Program files\Lexico\Toolbar\thesaurus.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Translate Page - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://*.xoops.org O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O16 - DPF: {F0E2D69A-DC2F-4E9B-A993-684FB1C21DBC} - http://dictionary.reference.com/tools/toolbar/lexico.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = the-solara-group.net O17 - HKLM\Software\..\Telephony: DomainName = the-solara-group.net O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = the-solara-group.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = the-solara-group.net

Hi, I have had the same problem on my pc. The obfuscated dll's are the initial problem. Even if you change the start page through IE or the registry, the dll seems to reload the registry & therefore also IE. However, when you delete the dll, either in safe mode or command prompt, the problem seems to go away.....and then return 'some time' later. If you ran Hijack This again (as you have done) you will see the registry entries for IE pointing to a differently named dll - therefore, some other program is re-creating the dll with a random name. I have two suspect programs which I have now deleted. One was picked up by McAfee with the latest DAT files - c:\winnt\system32\sys.exe - couldn't clean it so I just deleted it. The other - c:\winnt\system32\fiks.exe - I initially spotted when doing a search for the latest .exe files on my system. The only info I could shed on this last one came from Trend Micro via a Google search - which suggested that this was one of the files included in the 'Trojan Bancos-L' - a password logging trojan mainly aimed at Spanish banking websites. I have not figured out how or exactly when the program is reloading the random-named dll - there is nothing suspicious in any of the startup folders or RUN keys in the registry, unless it has attached itself to a genuine file. It may be pure coincidence, but it seems that after removing the dll & sorting out IE, the problem returns after starting Outlook Express. I have yet to see if this has fully resolved the problem, but some of this information may be useful to you/anyone else, in finding an answer. Good luck.

Hello, Is this searchx.cc problem virtually impossible to remove? I've tried every suggestion I've came across: - running hijackthis to delete the .dlls and stuff. - running ad-aware 6 - running spybot s&d - installing norton anti-virus - running cws 1.56.1 - and even manual removal Nothing seems to work. It just keeps coming back. I'm on the verge of doing a full system reboot because I'm running out of options here!