Hijacked Browser, please help

Here is my log:

Logfile of HijackThis v1.97.7
Scan saved at 9:14:06 AM, on 5/24/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ATI2EVAE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\MIXER.EXE
C:\PROGRAM FILES\ASUS\PROBE\ASUSPROB.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\SHARP\SHARPDESK\SHARPTRAY.EXE
C:\PALM\ALARMAPP.EXE
C:\PALM\HOTSYNC.EXE
C:\WESYNC\WESYNC.EXE
C:\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\SHARP\SHARPDESK\SDFTP.EXE
C:\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
C:\PROGRAM FILES\OPENOFFICE.ORG1.0.1\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\DOWNLOAD\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [nil] C:\WINDOWS\nil.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evae.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\SYSTEM\msgked.exe
O4 - HKLM\..\RunOnce: [Ad-aware] "C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE" "+b1"
O4 - Startup: CorelCENTRAL 10.lnk = C:\Program Files\Corel\WordPerfect Office 2002\Programs\CCWin10.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: WeSync.lnk = C:\WeSync\wesync.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
O4 - Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
O4 - Startup: Acrobat Assistant.lnk = C:\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Alarm Manager.LNK = ..\..\..\..\..\Palm\AlarmApp.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37918.243287037
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.196.0.38,151.196.0.39

 

Hi Hogarth2,

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

O4 - HKLM\..\Run: [nil] C:\WINDOWS\nil.exe

O4 - HKCU\..\Run: [msmc] C:\WINDOWS\SYSTEM\msgked.exe

Then reboot and delete:
C:\WINDOWS\SYSTEM\msgked.exe

Could you mail C:\WINDOWS\nil.exe to the address in my profile

Regards,

Pieter

 

Pieter,

Oddly, I cannot find nil.exe on my hard drive, though I should be able to see all hidden files. Am I missing something?

Hogarth

 

Pieter,

Sorry to bother you again, but I am still having problems. When I type a search in google, yahoo, etc, I get redirected to some spyware's site. Log below.


Hogarth2

Logfile of HijackThis v1.97.7
Scan saved at 1:01:35 PM, on 5/24/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ATI2EVAE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\MIXER.EXE
C:\PROGRAM FILES\ASUS\PROBE\ASUSPROB.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\SHARP\SHARPDESK\SHARPTRAY.EXE
C:\PALM\ALARMAPP.EXE
C:\PALM\HOTSYNC.EXE
C:\WESYNC\WESYNC.EXE
C:\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\SHARP\SHARPDESK\SDFTP.EXE
C:\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
C:\PROGRAM FILES\OPENOFFICE.ORG1.0.1\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\DOWNLOAD\HIJACKTHIS.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evae.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - Startup: CorelCENTRAL 10.lnk = C:\Program Files\Corel\WordPerfect Office 2002\Programs\CCWin10.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: WeSync.lnk = C:\WeSync\wesync.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
O4 - Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
O4 - Startup: Acrobat Assistant.lnk = C:\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Alarm Manager.LNK = ..\..\..\..\..\Palm\AlarmApp.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37918.243287037
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.196.0.38,151.196.0.39

 

Hi Hogarth2,

Can you tell me which site you are being hijacked to?
There is nothing left in your log and that information might give me a clue what to investigate next.

Regards,

Pieter

 

Pieter,

If I go to google and seartch "fark," this is the address in my toolbar: http://www.google.com/search?hl=en&ie=UTF-8&q=fark

Rather than showing my search results, I get:

1. a page full of advertising listings (Html source Code posted below); and

2. a pop under advertising (a) FREE 2020Search Toolbar; and (2) Free WebSearch Tools

Note, if I click on the second page of search results, I am sent to my search results: http://www.google.com/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=0&sa=N

Any thoughts? Thank you again.


Hogarth2




source HTML:


<html><head><meta HTTP-EQUIV="content-type" CONTENT="text/html; charset=UTF-8"><title>Google Search: fark </title><style><!--
body,td,div,.p,a{font-family:arial,sans-serif }
div,td{color:#000}
.f,.fl:link{color:#6f6f6f}
a:link,.w,a.w:link,.w a:link{color:#00c}
a:visited,.fl:visited{color:#551a8b}
a:active,.fl:active{color:#f00}
.t a:link,.t a:active,.t a:visited,.t{color:#000}
.t{background-color:#e5ecf9}
.k{background-color:#36c}
.j{width:33em}
.h{color:#36c}
.i,.i:link{color:#a90a08}
.a,.a:link{color:#008000}
.z{display:none}
div.n {margin-top: 1ex}
.n a{font-size:10pt; color:#000}
.n .i{font-size:10pt; font-weight:bold}
.q a:visited,.q a:link,.q a:active,.q {color: #00c; }
.b{font-size: 12pt; color:#00c; font-weight:bold}
.ch{cursorointer;cursor:hand}
.e{margin-top: .75em; margin-bottom: .75em}
.g{margin-top: 1em; margin-bottom: 1em}
//-->
</style>
<script>
<!--
function ss(w){window.status=w;return true;}
function cs(){window.status='';}
function clk(n,el) {if(document.images){(new Image()).src="/url?sa=T&start="+n+"&url="+escape(el.href);}return true;}
//-->
</script>
<script>
<!--
function ga(o,e){if (document.getElementById){a=o.id.substring(1); p = "";r = "";g = e.target;if (g) { t = g.id;f = g.parentNode;if (f) {p = f.id;h = f.parentNode;if (h) r = h.id;}} else{h = e.srcElement;f = h.parentNode;if (f) p = f.id;t = h.id;}if (t==a || p==a || r==a) return true;location.href=document.getElementById(a).href}}
//-->
</script>
</head><body bgcolor=#ffffff onLoad="document.gs.reset()" topmargin=2 marginheight=2><table border=0 cellpadding=0 cellspacing=0><tr><td valign=top><a href=http://www.google.com/webhp?hl=en><img src=images/logo_sm.gif width=150 height=55 alt="Go to Google Home" border=0 vspace=12></a></td><td>&nbsp;&nbsp;</td><td valign=top><table cellpadding=0 cellspacing=0 border=0><tr><td colspan=2 height=14 valign=bottom><script><!--
function qs(el) {if (window.RegExp && window.encodeURIComponent) {var qe=encodeURIComponent(document.gs.q.value);if (el.href.indexOf("q=")!=-1) {el.href=el.href.replace(new RegExp("q=[^&$]*"),"q="+qe);} else {el.href+="&q="+qe;}}return 1;}
// -->
</script><table border=0 cellpadding=4 cellspacing=0><tr><td class=q><font size=-1><font color=#000000><b>Web</b></font>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t1a class=q href="http://images.google.com/images?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wi" onClick="return qs(this);">Images</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t2a class=q href="http://groups.google.com/groups?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wg" onClick="return qs(this);">Groups</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t4a class=q href="http://news.google.com/news?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wn" onClick="return qs(this);">News</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t5a class=q href="http://froogle.google.com/froogle?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wf" onClick="return qs(this);">Froogle</a>^{<a href="http://froogle.google.com/froogle?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wf" style="text-decoration:none;" onclick="return qs(this);"><font color=red>New!</font></a>}&nbsp;&nbsp;&nbsp;&nbsp;</font><font size=-1><b><a href="/options/" class=q>more&nbsp;&raquo;</a></b></font></td></tr></table></td></tr><tr><td nowrap><form name=gs method=GET action=/search><input type=hidden name=hl value="en"><input type=hidden name=lr value=""><input type=hidden name=ie value="UTF-8"><input type=hidden name=c2coff value=1><input type=text name=q size=41 maxlength=2048 value="fark"><font size=-1> <input type=submit name="btnG" value="Search"><span id=hf></span></font></td><td nowrap><font size=-2>&nbsp;&nbsp;<a href=/advanced_search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1>Advanced Search</a><br>&nbsp;&nbsp;<a href=/preferences?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1>Preferences</a>&nbsp;&nbsp;&nbsp;&nbsp;</font></td></tr></table><table cellpadding=0 cellspacing=0 border=0><tr><td><font size=-1></font></td></tr><tr><td height=7><img width=1 height=1 alt=""></td></tr></table></td></tr></form></table>
<style><!--
.fl:link{color:#7777CC}
-->
</style>
<table width=100% border=0 cellpadding=0 cellspacing=0><tr><td bgcolor=#3366cc><img width=1 height=1 alt=""></td></tr></table><table width=100% border=0 cellpadding=0 cellspacing=0 bgcolor=#e5ecf9><tr><td bgcolor=#e5ecf9 nowrap><font size=+1>&nbsp;<b>Web</b></font>&nbsp;</td><td bgcolor=#e5ecf9 align=right nowrap><font size=-1 color=#000000>Results <b>1</b> - <b>10</b> of about <b>1,370,000</b> for <b><b>fark</b></b>. (<b>0.73</b> seconds)&nbsp;</font></td></tr></table><p><font color=#cc0000 class=p>Did you mean: </font><a href=/search?hl=en&ie=UTF-8&c2coff=1&q=dark&spell=1 class=p><b><i>dark</i></b></a>&nbsp;&nbsp;<br><div> <br><a href="http://www.searchassistant.net/rd.php?affiliate=cm1&Terms=fark&b=%200.05&abctime=1085430059&id=441&hash=22df76356e8882cfc41bc6a7b3dc3526" onmouseover="window.status='http://service.bfast.com';return true;" onmouseout="window.status=' ';return true;">Find fark at SMARTpages.com - Online Yellow Pages</a><br>Find local business listings for fark at SMARTpages.com, the online yellow pages directory of SBC Communications. SMARTpages also offers city guides, shopping guides, white pages and more.<br><br><a href="http://www.searchassistant.net/rd.php?affiliate=cm1&Terms=fark&t=uggc%3A%2F%2Fhf05.kzyfrnepu.svaqjung.pbz%2Fova%2Fsvaqjung.qyy%3Fpyvpxguebhtu%40l%5E82089%40k%5EvL6nD99uyp6fUWgIAneyQVeH7yFyvB2mP4cdD2STUObGQ2c%3B94Q8RgCovXbHOh2N4CYiAMdgPp4WQVzYlqegvhy9rprQPdEboCkCg9xhZgMxUVKpyqQoD6r7NPyTfXrtteYUAvSjDgyx4zd0tdxVg4yePzSDogI2A4lvVT%24%247&b=%200.00&e=SvaqJung&abctime=1085430059&hash=69cd412988ab2ad8356a1f63e4b59ca7" onmouseover="window.status='http://www.qksrv.net';return true;" onmouseout="window.status=' ';return true;">EBay.com - Save Money and Buy Fark On Ebay!</a><br>Find Fark and anything you are looking for on Ebay. Opening an account is free. Bidding is free. Try it today.<br><div class=n><table border=0 cellpadding=0 width=1% cellspacing=0 align=center><tr align=center valign=top><td valign=bottom nowrap><font size=-1>Result&nbsp;Page:&nbsp;</font><td><img src=/nav_first.gif width=18 height=26 alt=""><br><td><img src=/nav_current.gif width=16 height=26 alt=""><br><span class=i>1</span><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=0&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>2</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=20&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>3</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=30&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>4</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=40&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>5</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=50&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>6</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=60&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>7</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=70&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>8</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=80&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>9</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=90&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>10</a><td nowrap><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=0&sa=N><img src=/nav_next.gif width=100 height=26 alt="" border=0><br><span class=b>Next</span></a></table></div><center>
<br clear=all><br><table cellspacing=0 cellpadding=0 border=0 width="100%"><tr><td class=k><img height=1 alt="" width=1></td></tr><tr><td align=center bgcolor=#e5ecf9>&nbsp;<br><table border=0 cellpadding=0 cellspacing=0 align=center><form method=GET action=/search><tr><td nowrap>
<font size=-1><input type=text name=q size=31 maxlength=2048 value="fark"> <input type=submit name=btnG VALUE="Search"><input type=hidden name=hl value="en"><input type=hidden name=lr value=""><input type=hidden name=ie value="UTF-8"><input type=hidden name=c2coff value=1></font></td></tr></form></table><br><font size=-1><a href=/swr?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&swrnum=1370000>Search&nbsp;within&nbsp;results</a> | <a href=/language_tools?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1>Language Tools</a> | <a href=/help/>Search&nbsp;Tips</a> | <a href=/quality_form?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1 target=_blank>Dissatisfied? Help us improve</a></font><br><br></td></tr><tr><td class=k><img height=1 alt="" width=1></td></tr></table></center><center><p><hr class=z><table width=100% cellpadding=2 cellspacing=0 border=0><tr><td align=center><font size=-1><a href="http://www.google.com/">Google&nbsp;Home</a> - <a href="/ads/">Advertising&nbsp;Programs</a> - <a href="/services/">Business&nbsp;Solutions</a> - <a href=/about.html>About Google</a></font></table><br><font size=-1 class=p>&copy;2004 Google</font></center><script language=javascript>function run(){newwindow=window.open('','test','width=500,height=400,scrollbars=yes,resizable=yes,toolbar=yes');newwindow.close();newwindow=window.open('','test','width=500,height=400,scrollbars=yes,resizable=yes,toolbar=yes');newwindow.document.open();newwindow.document.write('<br><a href="http://cassandra.searchassistant.net/servlet/link?link=P_MzMzMzMzMAAAABAAAWYQAAAAAAAAAAAA4yMDIwc2VhcmNoLmNvbQE4o4imwpG6AARmYXJrAAAACT-EeuFHrhR7AAAAAPy4rFj1P4zMzQADeG1sAQpodHRwOi8vcGFydG5lcnMubXlnZWVrLmNvbS9wcmVzdWx0cy5qc3A_cGFydG5lcmlkPTk4NTI4JnZlbmRvcklkPTgyMjEyJnR5cGU9NSZjb2RlPTEmcmF0ZT01NDMzNjIzNjImY3I9NTQzMzYyMzYyJmRvbWFpbj13d3cuMjAyMHNlYXJjaC5jb20mcXVlcnk9MTA4NTQzMDA1MjQxMCUzQSUzQTY4LjE2My43My4yMzUlM0ElM0FmYXJrJnVybD1odHRwJTNBJTJGJTJGd3d3LjIwMjBzZWFyY2guY29tJTJGdG9vbGJhciUyRmluc3RhbGwuaHRtbCUzRktleXdvcmRzJTNEZmFyawAAAAAAAAA_8zMzMzMzMw.." onmouseover="window.status=\'2020search.com\';return true;" onmouseout="window.status=\' \';return true;">Find fark Using the FREE 2020Search Toolbar!</a><br>Having trouble finding fark? Get the 2020Search toolbar and say "good-bye" to those annoying pop-ups. Many other useful features such as: text highlighter, multi-search engine, drag & drop, e-mail results and more!<br><br><a href="http://cassandra.searchassistant.net/servlet/link?link=P_MzMzMzMzMAAAABAAAWYQAAAAAAAAAAABZkb3dubG9hZC53ZWJzZWFyY2guY29tATijiKbCkboABGZhcmsAAAAJP4R64UeuFHsAAAAA_LisWPVADMzNAAN4bWwBOGh0dHA6Ly9wYXJ0bmVycy5teWdlZWsuY29tL3ByZXN1bHRzLmpzcD9wYXJ0bmVyaWQ9OTg1MjgmdmVuZG9ySWQ9ODI1MTUmdHlwZT01JmNvZGU9MSZyYXRlPTQ4MzY2NDM2MiZjcj00ODM2NjQzNjImZG9tYWluPWRvd25sb2FkLndlYnNlYXJjaC5jb20mcXVlcnk9MTA4NTQzMDA1MjQxMCUzQSUzQTY4LjE2My43My4yMzUlM0ElM0FmYXJrJnVybD1odHRwJTNBJTJGJTJGZG93bmxvYWQud2Vic2VhcmNoLmNvbSUyRmluc3RhbGwlMkZ0Yl9sYW5kaW5nX3NlYXJjaC5hc3B4JTNGaWQlM0Q1MDAxOSUyNnElM0RmYXJrJTI2c2UlM0RXJTI2Y2IlM0Q1MDAxOQAAAAAAAAA_8zMzMzMzMw.." onmouseover="window.status=\'download.websearch.com\';return true;" onmouseout="window.status=\' \';return true;">Find fark with Free WebSearch Tools</a><br>Click here to download WebSearch Tools and search 15 engines for fark at once now with FREE Pop-up Blocker, Yellow/White Pages, Free Games, Maps, Skins, Cursors and more!<br>');newwindow.document.close();newwindow.document.title='fark';newwindow.blur();window.focus();}run();</script></body></html>

 

Hi Hogarth2,

Download and run: http://www.spywareinfoforum.com/~merijn/files/CWShredder.exe
Use the Fix button and follow the instructions you will receive.

If that does not help surf to http://www.billsway.com/vbspage/ and scroll down to
Registry Search Tool
Download, unzip and run RegSrch.vbs
Copy and paste this in the dialog box: WebSearch

After a while a prompt will come up. Click OK to write the results to wordpad and post them.