I can not get rid of this nonsense. Every tiem I open up my browser, it is there. I have read previous replies and have tried everything. I have ad-aware, spybot, hijackthis, symantec anit-virus. Need help!!! Below is my hijackthis logfile. Thanks!! Logfile of HijackThis v1.97.7 Scan saved at 10:54:32 AM, on 12/6/2003 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\ibmpmsvc.exe C:\Program Files\STOPzilla!\szntsvc.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\Ati2evxx.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\WINNT\System32\llssrv.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\oracle\ora81\bin\vppdc.exe C:\oracle\ora81\BIN\TNSLSNR.exe c:\oracle\ora81\bin\ORACLE.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\Explorer.exe C:\WINNT\system32\PRPCUI.exe C:\WINNT\AGRSMMSG.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\WINNT\system32\dla\tfswctrl.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\Program Files\ORiNOCO\Client Manager\CMLUC.exe C:\WINNT\System32\svchost.exe C:\Documents and Settings\bweisber\My Documents\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://central.informatica.com O2 - BHO: (no name) - {00110011-4B0B-44D5-9718-90C88817369B} - C:\WINNT\NavExt.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINNT\system32\StopzillaBHO.dll O2 - BHO: (no name) - {f760cb9e-c60f-4a89-890e-fae8b849493e} - C:\WINNT\madise.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: ORiNOCO Client Manager.lnk = C:\Program Files\ORiNOCO\Client Manager\CMLUC.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37947.7730555556 O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://informatica.webex.com/client/latest/webex/ieatgpc.cab O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} (IRDIXAObj Class) - O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CCS\Services\Tcpip\..\{EDE6489E-6285-4EED-A572-A3815C7B3748}: NameServer = 10.1.32.61,10.1.32.62 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62

G'day, Please have a look at my reply to Threedoc's post, which is just a few down to yours. regards, Elric

thanks for the tips but i have tried all of this (including readin through about 30 previous tips and tricks when trying to kill start-space). i am truly baffled

Are you being hijacked by start-space, or by search-space? If you are being hijacked by search-space, try this: Find the following entry in the HijackThis! log: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/ Close all windows, and choose 'Fix checked', to let HijackThis! remove it. While offline reset IE home page in Tools>Internet Options>General tab, to your preference. Next, in the Security tab enter the search-space website into 'Restricted Sites'. Back to the General tab, clear Temporary Internet Files, Cookies, and History. Reboot. If you are being hijacked by start-space, try the same routine, except that HijackThis! does not seem to specifically identify start-space. (Might be masqueraded as something else.) On these entries: O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CCS\Services\Tcpip\..\{EDE6489E-6285-4EED-A572-A3815C7B3748}: NameServer = 10.1.32.61,10.1.32.62 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 Are these domains your ISP or company network?

These two are also candidates for fixing: O2 - BHO: (no name) - {f760cb9e-c60f-4a89-890e-fae8b849493e} - C:\WINNT\madise.dll O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} (IRDIXAObj Class) - Also download and run CWShredder from Here Post another HijackThis! log. Might be some other stuff needs to go.

well, i tried all of your ideas. i placed start-space under restricted sites and it doesnt come up. but, is that a temp fix or will that work for good? also, as to your question abotu which one it is -- it starts up with search-space but the actual website says start-space. so, i don't know how to see what the difference is. anyway, i have cleared out temp internet files, switched my domain and put search-space in restricted. then i ran hijackthis again. below is the log. by the way, informatica and the ip addresses are a part of my company work domain -- although i manually put the ip addresses. i can remove them if need be. Logfile of HijackThis v1.97.7 Scan saved at 9:17:36 AM, on 12/7/2003 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\ibmpmsvc.exe C:\Program Files\STOPzilla!\szntsvc.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\Ati2evxx.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\WINNT\System32\llssrv.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\oracle\ora81\bin\vppdc.exe C:\oracle\ora81\BIN\TNSLSNR.exe c:\oracle\ora81\bin\ORACLE.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\Explorer.exe C:\WINNT\system32\PRPCUI.exe C:\WINNT\AGRSMMSG.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\WINNT\system32\dla\tfswctrl.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\Program Files\SpyKiller\spykiller.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\ORiNOCO\Client Manager\CMLUC.exe C:\WINNT\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\bweisber\My Documents\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://central.informatica.com/ O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINNT\system32\StopzillaBHO.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.exe /autorun O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: ORiNOCO Client Manager.lnk = C:\Program Files\ORiNOCO\Client Manager\CMLUC.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37947.7730555556 O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://informatica.webex.com/client/latest/webex/ieatgpc.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CCS\Services\Tcpip\..\{EDE6489E-6285-4EED-A572-A3815C7B3748}: NameServer = 10.1.32.61,10.1.32.62 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = informatica.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = informatica.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 10.1.32.61 10.1.32.62

Assuming that you also ran CWShredder. Do not see the offending entry: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/ HijackThis! and CWShredder may have fixed the problem, however, for additional insurance, as long as you keep the offending website in Restricted Sites and your security settings are adequate, it should keep the site from placing a cookie on your system. To place another nail on the coffin, go back to IE>Tools>Internet Options, click on the Privacy tab, click the Edit button, and add the URL to the Block list.