Computing.Net > Forums > Security and Virus > Please help with SearchV hijack

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Please help with SearchV hijack

Reply to Message Icon

Name: Christina
Date: October 25, 2003 at 18:36:38 Pacific
OS: Win XP
CPU/Ram: P4 2.8Ghz 512 mb ram
Comment:

My system has been hijacked by searchv.com! I already tried AdAware, CWShredder and SpyBot Search & Destroy. I tried hijack this, and deleted the three entries that have to do with searchv plus the "main search page=" entry, but every time I reboot the damn thing is back as my home page! Can someone please help me, here is my Hijack log:

Logfile of HijackThis v1.97.3
Scan saved at 9:24:22 PM, on 10/25/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Dell Control Utility.lnk = C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab



Sponsored Link
Ads by Google

Response Number 1
Name: FZWG
Date: October 25, 2003 at 21:17:56 Pacific
Reply:

Run HijackThis! again, close all windows except HT, place a check in and "fix checked items" as follows:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http:/www.searchv.com/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.searchv.com/search.html

Reboot when done.

Run Spybot Search and Destroy and AdAware as well.

Also, if you like, check the feature in Spybot that locks your homepage.



0

Response Number 2
Name: FZWG
Date: October 25, 2003 at 21:35:21 Pacific
Reply:

Forgot:

Do a search for: Winshow
Delete.

Also, look at the following:
Info


0

Response Number 3
Name: Hradcany
Date: October 26, 2003 at 14:02:19 Pacific
Reply:

I found noe of the dlls, exes, or folders on my XP machine. However, in a DOS window, using EDIT, I removed from the hosts file in my System directory the line 209.66.114.130

I am a rank beginning, but I hope this helps.


0

Sponsored Link
Ads by Google
Reply to Message Icon

Related Posts

See More







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Please help with SearchV hijack

I NEED help with search hijack www.computing.net/answers/security/i-need-help-with-search-hijack/12080.html

Help with Hijack This! Log fixes www.computing.net/answers/security/help-with-hijack-this-log-fixes/8354.html

need help with searchv.com www.computing.net/answers/security/need-help-with-searchvcom/6859.html