-----Original Message-----
I found this one entry in a search result. Hopefully, it will help you.
====================================================
I was getting this stupid Searchv.com start page in my IE browser, and for
the life of me I couldn't get rid of it last night.
I had this stupid thing on my Browser before and got rid of it with no
problem with Hijackthis but last night HJ kept finding it.
Everytime I would use HJ to get rid of Searchv and I would re-start my
system and open up my IE browser that darn Searchv page would show up again.
I also use Ad-Aware, Spywareblaster, AVG antivirus, CWShredder,Xcleaner.
What was wierd was that everytime I used HJ I would check my registry and it
seemed fine, in other words the Searchv.com was not showing as my default
start page, yet HJ kept finding it and my browser page kept opening up with
it after every re-start of my system.
But there was one entry in the HJ log file that I wasn't to sure about
because it looked important and that was this:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVers
ion\Run]
"sys"="regedit /s sys. reg
So I did a search on Google for sys.reg and this is what I found:
http://www.itsecurity.com/asktecs/aug3903.htm
Quote from page if the link doesn't work:
" SYS.REG is an exported registry file. *.REG is normally associated with
REGEDIT, and so double clicking on one will cause REGEDIT to import the
settings therein into your registry.
SYS.REG is not a normal file, but something on your machine, or some site
you've visited has dropped it on your machine, together with something that
references it (perhaps a shortcut in the 'Startup' group) that forces it to
be reloaded every time you boot Windows. If you can find that, then you can
remove it (and the SYS.REG file if you wish).
The sys.reg is not needed by ME; this is from a spyware software. Click on
Start-->run and type msconfig and press enter. Go to startup tab and look
for an entry relating to sys.reg and uncheck the box.
First you must delete this line in the registry:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVers
ion\Run]
"sys"="regedit /s sys.reg"
Then you can definitely delete the file sys.reg.
In this way windows will not search sys. reg file anymore and all will work
well. "
I followed the above instructions and vwallah, no more Searchv.com taking
over my browser
So if anyone has the same problem I had and see this sys.reg entry in your
HIjackthis log file, it's safe to remove.
I hope this little tip helps
========================================================= ================
Recently, I have been fighting this pesky hijacker named
searchv.com. Everytime I hit my browser, instead of
getting my home page, I get this searchv.com. I have
installed and run Spybot 1.2, Ad-Aware 6, hijackthis.exe,
and CWShredder.exe. The searchv.com continues to install
itself as homepage, even though I have "locked" my
homepage. Does anyone know how to kill this searchv.com.
I'm getting ready to reformat my hard drive. Thanks!
