Browser home page trying to be hijacked but I cannot find source. Thanks for help...

[Joe Donaldson]

Was helping my girlfriend on her Windows 98SE (ugh) PC runing IE 6.

It is a laptop for what it is worth.

It has Mcafee AV on it.
It now has Spybot on it with all updates
It also has Adaware on it with all updates
I loaded BHODEMON on it
I immunized it with Spybot for the nasties of BHO's and spyware,
malware
I immunized ith witha blocklist at
http://www.spywareguide.com/blockfile.php

I looked at the Objects (View Objects in IE)
Flushed all caches
Reviews Add/Remove programs and got rid of what she did not need.

Downloaded special RegCleaner to look at all Startup programs and
installed programs. This utility also does a clean up as well of bad
keys and such.


***Ran all of the above including a search in the registry for
searchhh.com
Found nothing


*****************Where can this be?

Note: Win.ini and System.ini I forgot to look at.

At least now when she boots and runs IE, Mcafee or SpywareGuide
pops-up asking if you want to keep current page or hijack the page...

Could not find anything in my searches for this BHO, but did not do a
full file contains search on the whole drive.

Thanks for any help.

Sincerely
Joe

 

[Jan Il]

Hi Joe

Try the following and see if it helps.

HiJackThis: - Free

Go to
http://computercops.biz/downloads-cat-14.html ,
or
http://tinyurl.com/2oce8
and download HiJackThis. Unzip to a folder other than your Desktop or the
Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open the copy of your log in NotePad and make a copy. Then you can go here
to post you log:

Jim Eshelman's site here:
AumHa Forums - HiJackThis section:
http://forum.aumha.org/

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx


<<DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

Also download, install and run this program to be sure all malware is
cleaned off your system.

CWShredder: Free
http://tinyurl.com/2l9kl


Hope this helps.

Jan