Hi, I need help with removing the file(s) that reset my IE homepage back to SearchV.com whenever my comupter is reset. I don't know much about scripting and so forth so the more indepth explanation of the steps to go about this is greatly appreciated. I understand that I may have to edit the registry file, but for starters, I don't know where that is. See, I told you. Thanks. T.

use spybot search and destory (google) what you have is spyware, and this will remove it alternatly try ad aware personal version

here is my HijackThis log file Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\sesinetd.exe C:\WINNT\System32\hserver.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\Tablet.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.exe C:\WINNT\System32\3DLman.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Microsoft Hardware\Mouse\point32.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\Program Files\WinZip\WZQKPICK.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Documents and Settings\Administrator\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchv.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchv.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/w/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/w/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/w/ O1 - Hosts: 209.66.114.130 sitefinder.verisign.com O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Administrator\Application Data\winshow\winshow.dll O2 - BHO: (no name) - {785188D6-A2BF-4437-AF7D-77FED8208D4B} - C:\WINNT\system32\dvtkqy.dll (file missing) O2 - BHO: (no name) - {BF2D19B6-D5F6-42EB-B5CC-181E256475D8} - C:\WINNT\system32\kjxlkhd.dll (file missing) O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file) O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [3Dlabs Taskbar Display Manager] C:\WINNT\System32\3DLman.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [StillImageMonitor] C:\WINNT\System32\STIMON.exe O4 - HKLM\..\Run: [sys] regedit /s C:\WINNT\sys.reg O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Run DAP (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37879.9067013889 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

seems like spyware.. give those 2 progs a try

Interesting: http://www.computing.net/security/wwwboard/forum/6856.html

Hi! I´m in trouble. Can someone help me? I think I can´t erase searchv by myself. This is my HijackThis scan: Logfile of HijackThis v1.97.3 Scan saved at 19:36:05, on 18/10/2003 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\svchost.exe C:\Archivos de programa\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Archivos de programa\Winamp\Winampa.exe C:\WINDOWS\System32\ctfmon.exe C:\Archivos de programa\Messenger\msmsgs.exe C:\Archivos de programa\Netscape\Netscape\Netscp.exe C:\Archivos de programa\Hewlett-Packard\AiO\hp officejet v series\Bin\hpoant07.exe C:\Archivos de programa\Hewlett-Packard\AiO\hp officejet v series\FRU\Remind32.exe C:\Archivos de programa\OpenOffice.org1.0.1\program\soffice.exe C:\ARCHIV~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\ARCHIV~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe C:\Archivos de programa\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe C:\Archivos de programa\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe C:\WINDOWS\System32\devldr32.exe C:\Archivos de programa\Internet Explorer\iexplore.exe C:\Archivos de programa\Internet Explorer\iexplore.exe C:\ARCHIV~1\DAP\DAP.exe C:\Documents and Settings\gabi\Escritorio\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos O1 - Hosts: 209.66.114.130 sitefinder.verisign.com O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file) O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Archivos de programa\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Archivos de programa\Winamp\Winampa.exe" O4 - HKLM\..\Run: [sys] regedit /s C:\WINDOWS\sys.reg O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Archivos de programa\Netscape\Netscape\Netscp.exe" -turbo O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Archivos de programa\Hewlett-Packard\AiO\hp officejet v series\FRU\Remind32.exe O4 - Startup: OpenOffice.org 1.0.1.lnk = C:\Archivos de programa\OpenOffice.org1.0.1\program\quickstart.exe O4 - Global Startup: HPAiODevice(hp officejet v series) - 1.lnk = C:\Archivos de programa\Hewlett-Packard\AiO\hp officejet v series\Bin\hpoant07.exe O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm O9 - Extra button: Descargas (HKLM) O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab O16 - DPF: {73F0FD85-BD47-4A95-86D1-DE38860462C1} (PremiumHTML Class) - http://213.201.69.103/data/dialercab/IberoDialerHTML.cab O16 - DPF: {94118C19-B178-4E43-BBE8-0EFDBB391BDB} (SysWebTelecom Class) - http://www.sponsoradulto.com/SysWebTelecom2.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37886.6495833333 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab OK! Thanks for all!! Gabi

I found the fix. It is a registry import that that happens on startup. Not sure where it is getting called from. Still looking for that. It is in a file in the windows directory Called "sys.reg". I moved it to the desktop and renamed it and reboot my machine and it did not reset the page. Here is the text of the file. Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.searchv.com/" "Search Page"="http://www.searchv.com/search.html" "Search Bar"="http://www.searchv.com/search.html" I did not get any error on boot up and my home page was not reset. None of the spybot or Adaware stuff found it. I downloaded a program called "StartEd" and saw that a .reg file was getting loaded on startup. Went and looked at with notepad and there it was. So I hope this helps somebody else out.