Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
When I open internet explorer, my homepage and search page are set automatically set to searchv.com. I have run ad-aware, spybot, and hijackthis. Each time I do, I restart the computer and the problem is not corrected. After running hijackthis, I am given:
Logfile of HijackThis v1.97.3
Scan saved at 1:14:28 PM, on 10/11/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\DELLMMKB.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Netropa\OSD.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Browser Hijack Blaster\bhblaster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinAce\WinAce.exe
C:\Documents and Settings\Eric\Local Settings\Temp\HijackThis.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/www.searchv.com/w/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = <none>
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/w/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchv.com/w/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/w/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/w/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Eric\Application Data\winshow\winshow.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: America Online 6.0 Tray Icon.lnk = C:\Program Files\America Online 6.0\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MSupdater.exe
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} - http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37279.5624768519
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabI have gone through and deleted each portion that should be causeing the problem, but it still occurs again after restarting the computer. How can I completely get rid of the searchv problem?
I tried the manual removal instructions, but it says that the specified module can not be found. I also went through the winshow removal instructions, and removed everything for that in which I could find, but the searchv page still comes up.
0 
BigE2740, Hang in there and maybe one of the Hijack log experts will pop in and be able to help you get rid of that problem.
Tufenuf
0
BigE2740, If none of the Hijack log experts show up go to the link below.
Spyware and Hijackware Removal Forum
Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste your log into your new message explaining your problem.There's a lot of Hijack experts there who will be glad to help you and 99% of the time will get rid of the problem.
HTH,
Tufenuf
0
Hey Tufenuf,
You don't need to be an expert to use Hi Jack This. It is quite easy to read and interrupt them to be honest. Ya just gotta get used to looking at them.
KTTD
0
you must remove the program MSupdater.exe
as well or searchv will restart after you boot.good luck
0
Answer: SEARCHV is a well known browser "hijacker." It's likely that your Registry has been changed. Caution: always be careful when editing the registry. Here's how to check:
Click Start | Run and type regedit to open the Registry Editor.
Navigate to this key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main.
In the right pane, look for an entry called Start Page. Double click it.
In the Value Data box, if the URL is http://www.SEARCHV.com/, that's your culprit. Change it to your desired start page.
Click OK and close the Registry Editor.
0
search for the file sys.reg its in the winnt folder. Open it with Notepad.
It might look like this:Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.searchv.com/"
"Search Page"="http://www.searchv.com/html/"
"Search Bar"="http://www.searchv.com/"You can now edit it and save it to look something like mine does.
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/"
"Search Page"="http://www.google.com/"
"Search Bar"="http://www.google.com/"I did this and also did all the regedit stuff as well none of the regedit editing helped untill the sys.reg file was changed.
Also to keep this from happening again stay away from those "Questionable" sites.
Hope this info helps
0
Hi!
I also had this problem and I solved it, but this "hijacker" changed my "internet options menu". Normally there were two rows of options, and now I have only one. The row that was deleted included start page.
Can anybody help?
0
removing this this is very difficult. I tried many methods and none of them worked. Simply changing the values in the registry will not work, and besides, there are too many of them. I used spybot s&d and it worked pretty well. i still have winshow a resident on my machine, but at least i have full control back. i recommend spybot and then running the online visur check at housecall.antivirus.com
Good luck.
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
