+chorpeac MVC Posted October 13, 2003 MVC Share Posted October 13, 2003 Ok I have just recently had this weird start page automatically start showing on all my user accounts. It always takes me here http://www.searchv.com/w/ I have reassigned the start page to something else. I have cleared the registry of all mentioning of the site. I have cleared the temporary internet files and cookies. I can't get rid of it! This is ****ing me off. Can anyone recommend something else? Is it happening to anyone else? I have no search bars like the google one, never have. What the heck could this be?? I am using IE 6... Link to comment Share on other sites More sharing options...
Liquid Posted October 13, 2003 Share Posted October 13, 2003 Click on your Start button and select Run.... Type in the words regedit and click OK When the Registry Editor pops open press "F3" button, enter: NoBrowserOptions and press Find. If regedit found this string - erase it from registry. Simply select one and press "Delete" button at your keyboard. Link to comment Share on other sites More sharing options...
+chorpeac MVC Posted October 13, 2003 Author MVC Share Posted October 13, 2003 what does that do? Or...what is that setting for? Has this happened to you? NoBrowserOptions Was not found in the registry Link to comment Share on other sites More sharing options...
Liquid Posted October 13, 2003 Share Posted October 13, 2003 yah, happend to me once. ill look for more info Link to comment Share on other sites More sharing options...
sbweb77 Posted October 13, 2003 Share Posted October 13, 2003 Sounds like spyware. Have you tried running Adaware or Spybot Search and Destroy? Have also heard of some viruses doing this. Link to comment Share on other sites More sharing options...
+chorpeac MVC Posted October 13, 2003 Author MVC Share Posted October 13, 2003 (edited) haven't tried spybot, I will begin running a virus scan again, but it has been running the whole time. Spybot has found a few things...I'll clean them. Edited October 13, 2003 by chorpeac Link to comment Share on other sites More sharing options...
Blaise Veteran Posted October 13, 2003 Veteran Share Posted October 13, 2003 moved to internet, network & security Link to comment Share on other sites More sharing options...
dougkinzinger Posted October 13, 2003 Share Posted October 13, 2003 Ad-ware. An updated Ad-aware scan will take care of it. Link to comment Share on other sites More sharing options...
+chorpeac MVC Posted October 13, 2003 Author MVC Share Posted October 13, 2003 Ad-ware. An updated Ad-aware scan will take care of it. Do you have any idea how it got on there? Do you know what program/website caused it's initialization? Link to comment Share on other sites More sharing options...
Frank Posted October 13, 2003 Share Posted October 13, 2003 http://www.google.com/search?hl=en&lr=&ie=...rchv+.com/w/%22 - Here is a couple of different pages Link to comment Share on other sites More sharing options...
+chorpeac MVC Posted October 14, 2003 Author MVC Share Posted October 14, 2003 http://www.google.com/search?hl=en&lr=&ie=...rchv+.com/w/%22 - Here is a couple of different pages Thanks for the link. I ran adaware and it seems to have fixed it. Thanks for the help! Link to comment Share on other sites More sharing options...
+chorpeac MVC Posted October 15, 2003 Author MVC Share Posted October 15, 2003 OK sorry to revive this topic, but this problem is not going away. Here is what I have done. 1. I have cleared browser cache, cookies, visited sites. 2. I ran the adaware tool and it found items, I deleted them. 3. I ran this worm checking tool from Symantec, and it said no worm found. However when I reboot my machine, this annoyance is still plaging my computer. Can I delete the C:\WINDOWS\System32\wins\DLLHOST.EXE file? What is this HyjackThis program? I have not run that yet. Am I doing something wrong, if so what? Thanks for the help. Link to comment Share on other sites More sharing options...
[hxc] Posted October 15, 2003 Share Posted October 15, 2003 if you've tried adaware and it didnt work. the next step would be to try a different spyware removing program. try spybot - search and destroy security.kolla.de see if that works :) Link to comment Share on other sites More sharing options...
+chorpeac MVC Posted October 15, 2003 Author MVC Share Posted October 15, 2003 Have you heard of this HyjackThis program? Is it a spyware removing program too? Link to comment Share on other sites More sharing options...
Frank Posted October 15, 2003 Share Posted October 15, 2003 if you have the file "C:\WINDOWS\System32\wins\DLLHOST.EXE file" located on your PC.... it sounds like you got the welchia virus.... check this out http://www.pchell.com/virus/welchia.shtml Link to comment Share on other sites More sharing options...
[hxc] Posted October 15, 2003 Share Posted October 15, 2003 i have not heard of it, but from what i have just read on a couple sites, its looks like its a cleanup tool just like spybot and adaware. Link to comment Share on other sites More sharing options...
smittyofdhs Posted October 15, 2003 Share Posted October 15, 2003 I had this same problem (different page) on one of my client's machines. I spent over an hour trying to remove it. Turns out the app was starting from a CLSID instead of the normal way of starting up. Basically, the class id was loading a DLL at startup, which in turn called an EXE program. The EXE would rewrite the reg entries every time, which include startup items, start pages, and IE toolbars. I was able to search the registry for a portion of the name of the app (I think it was SurferSearch) and I found the class id registry entry and removed it. Once that was removed I was able to delete the exe file and all other registry points that were effected. The key to fixing this was to get all instances of the DLL and EXE and reg entires deleted at one time. If any one of those entries were left or files left on the system, it would restart and replicate itself to all points again. It was such a pain in the ass but it's do-able. Link to comment Share on other sites More sharing options...
Recommended Posts