Royalsearch.net has taken over my computer. I ran hijackthis, here is the log file. Any help would be greatly appreciated. Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\PROGRAM FILES\SYMANTEC\SAV8\RTVSCN95.exe C:\PROGRAM FILES\SYMANTEC\SAV8\DEFWATCH.exe C:\WINDOWS\SYSTEM\EXSHOW95.exe C:\WINDOWS\SYSTEM\EXSHOW.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\WINDOWS\STARTER.exe C:\WINDOWS\GWHOTKEY.exe C:\PROGRAM FILES\DIRECTCD\DIRECTCD.exe C:\WINDOWS\SYSTEM\QTTASK.exe C:\PROGRAM FILES\SYMANTEC\SAV8\VPTRAY.exe C:\PROGRAM FILES\MEDIA\MEDIA\UPDATESTATS.exe C:\WINDOWS\RunDLL.exe C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.exe C:\PROGRAM FILES\AIM95\AIM.exe C:\PROGRAM FILES\MICROSOFT HOME PUBLISHING\MHPRMIND.exe C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\PROGRAM FILES\WINAMP\WINAMP.exe C:\WINDOWS\EXPLORER.exe C:\PROGRAM FILES\WINZIP\WINZIP32.exe C:\WINDOWS\TEMP\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.clickyestoenter.net/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.clickyestoenter.net/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.royalsearch.net/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ncsu.edu/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.royalsearch.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.royalsearch.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.royalsearch.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.royalsearch.net/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sexpatriot.net/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.royalsearch.net/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.royalsearch.net/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\system32\search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://acc.count-all.com/--/?cxlow (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.royalsearch.net/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.royalsearch.net/search.html R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.0.176 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.foxnews.com/ R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://acc.count-all.com/--/?cxlow (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://acc.count-all.com/--/?cxlow (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html R3 - URLSearchHook: (no name) - - (no file) F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\info32.exe N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\sdgdh4p5.slt\prefs.js) O1 - Hosts: 66.98.142.163 auto.search.msn.com O1 - Hosts: 66.98.142.163 search.msn.com O1 - Hosts: 66.98.142.163 msn.com O1 - Hosts: 66.98.142.163 www.msn.com O1 - Hosts: 66.98.142.163 yahoo.com O1 - Hosts: 66.98.142.163 www.yahoo.com O1 - Hosts: 66.98.142.163 google.com O1 - Hosts: 66.98.142.163 www.google.com O1 - Hosts: 66.98.142.163 thenun.com O1 - Hosts: 66.98.142.163 www.thehun.com O1 - Hosts: 66.98.142.163 thehun.net O1 - Hosts: 66.98.142.163 www.thehun.net O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\kmouse\IE_SPY.DLL O2 - BHO: (no name) - {78F09560-16C9-11D8-BC29-005004D4D2C3} - C:\WINDOWS\SYSTEM\IR50_3L2.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [EAPCISetup] c:\windows\SYSTEM\sbsetup.exe c:\windows\SYSTEM O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\DIRECTCD\DIRECTCD.exe O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\PROGRAM FILES\REAL\REALJUKEBOX\tsystray.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe" O4 - HKLM\..\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.exe" -atboottime O4 - HKLM\..\Run: [Tapicfg.exe] C:\WINDOWS\SYSTEM\tapicfg.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANTEC\SAV8\vptray.exe O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe O4 - HKLM\..\Run: [Msoffice] C:\WINDOWS\FONTS\msoffice.hta O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANTEC\SAV8\rtvscn95.exe O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANTEC\SAV8\defwatch.exe O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Internet Washer Pro] C:\PROGRAM FILES\INTERNET WASHER PRO\IW.exe min O4 - Startup: Microsoft Greetings Reminders.lnk = C:\Program Files\Microsoft Home Publishing\MHPRMIND.exe O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O9 - Extra button: AIM (HKLM) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) - O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) - O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37921.2291898148 O16 - DPF: {421A63BA-4632-43E0-A942-3B4AB645BE51} - http://64.156.188.99/iwasher/pptproactauth/internetwasherpro.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O19 - User stylesheet: C:\WINDOWS\Web\win.def (file missing) O19 - User stylesheet: C:\WINDOWS\default.css (file missing) (HKLM)

http://www.computing.net/security/wwwboard/forum/6433.html

I have tried both ad-aware and spybot, to no avail with either.

Try cwshredder: http://www.spywareinfo.com/~merijn/files/cwshredder.zip

I went into the registry editor and deleted anything that had to do with royalsearch. That worked for about 2 days until it reset all the values back to royalsearch again. There's supposedly a virus called Bootconf.VBS that causes this however I ran a search for it and turned up nothing on my comp.

See the portion of your output about the hosts file: O1 - Hosts: 66.98.142.163 auto.search.msn.com O1 - Hosts: 66.98.142.163 search.msn.com O1 - Hosts: 66.98.142.163 msn.com O1 - Hosts: 66.98.142.163 www.msn.com O1 - Hosts: 66.98.142.163 yahoo.com O1 - Hosts: 66.98.142.163 www.yahoo.com O1 - Hosts: 66.98.142.163 google.com O1 - Hosts: 66.98.142.163 www.google.com O1 - Hosts: 66.98.142.163 thenun.com O1 - Hosts: 66.98.142.163 www.thehun.com O1 - Hosts: 66.98.142.163 thehun.net O1 - Hosts: 66.98.142.163 www.thehun.net It's remapped some well known web sites to 66.98.142.163. You have to go into your hosts file and delete those and reenter the valid hosts.

I had a similar problem, my search page and homepage being set to royalsearch.net, adaware or search and destroy did nothing for me. If you have msconfig, run that and go to the startup tab, see if there are anything being loaded at startup that has a vbs extension or hta, I had a C:\Windows\Fonts\fonts.hta, the title in the registry was Adobe Fonts, open it up with a text editor shows the reg keys that are being altered and takes effect every time I restarted. Deleted the reg key and the file and restarted to make sure, and I was able to set everything back to normal. Hope that helps :)