www.search-space.com has hijacked my Explorer main page! Ad-Aware couldn't kill it, so here's my Hijack This log. What should I do now? Thanks!!! Logfile of HijackThis v1.97.7 Scan saved at 12:14:55 PM, on 12/7/2003 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\hidserv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Symantec\Ghost\ngctw32.exe C:\WINNT\System32\rconsvc.exe C:\WINNT\system32\regsvc.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINNT\wanmpsvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\Explorer.exe C:\PROGRA~1\TALLYS~1\TSCensus\bin\cclient.exe C:\PROGRA~1\Adaptec\DirectCD\directcd.exe C:\WINNT\loadqm.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe C:\winnt\mdmhelp.exe C:\Program Files\America Online 8.0a\aoltray.exe C:\Corel\Graphics8\Programs\MFIndexer.exe C:\Program Files\Digital Image\Monitor.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\PROGRA~1\WinZip\winzip32.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe C:\WINNT\system32\notepad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-space.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.creative.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.search-space.com/ R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {00110011-4B0B-44D5-9718-90C88817369B} - C:\WINNT\NavExt.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [CClient] C:\PROGRA~1\TALLYS~1\TSCensus\bin\cclient.exe O4 - HKLM\..\Run: [NGClient] C:\Program Files\Symantec\Ghost\ngctw32.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe O4 - HKLM\..\Run: [DSL Connection Tool] C:\Program Files\MSN\MSNIA\dslmon.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ljsuyzl] "C:\WINNT\System32\ljsuyzl.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\CreateCD.exe -r O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [mdmhelp] c:\winnt\mdmhelp.exe O4 - HKCU\..\Run: [QuickTime Task] c:\winnt\qttasks.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0a\aoltray.exe O4 - Global Startup: Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe O4 - Global Startup: Digital Image Monitor.lnk = C:\Program Files\Digital Image\Monitor.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O9 - Extra button: Real.com (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.creative.com O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} - O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vitnet.vit.org O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vitnet.vit.org O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vitnet.vit.org

Hi Jennifer, 1. Download and run CWShredder: CWShredder 2. Run HijackThis again and place a check in the box next to the following items. Next, close all browser Windows, and have HT 'fix checked'. You Must restart your computer when you're done. O4 - HKLM\..\Run: [ljsuyzl] "C:\WINNT\System32\ljsuyzl.exe" O4 - HKCU\..\Run: [mdmhelp] c:\winnt\mdmhelp.exe After restarting delete C:\WINNT\System32\ljsuyzl.exe c:\winnt\mdmhelp.exe

Worked beautifully! Thanks!!!!