MySearch.com, how to kill it dead

I have an annoying popup called MySearch.com, that puts a search bar over the top of the task bar in all applications. When I do a Hijack, I get the following report, but removing references to mysearch with hijack will kill it on the first reboot, but it keeps coming back shortly thereafter. Spybot and Adaware didn't kill it either.

Any ideas?

Logfile of HijackThis v1.97.7
Scan saved at 9:36:30 PM, on 6/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\BLEHCORNSCR\Cdrom Delete Tray.exe
C:\Program Files\MSI\Core Center\CoreCenter.exe
D:\Program Files\palm\Hotsync.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\AOL Messaging Utility\aim.exe
C:\WINDOWS\system32\spider.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Utility\Utilities to remove Hijack and ad software\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mysearchnow.com/passthrough/index.html?http://www.foxnews.com/
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Program Files\palm\HOTSYNC.EXE
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

 

Its probaly extra >stuff< install along with messeger plus.

Dont fix anything for a day or two then post a log,, we need to see what were dealing with clearly
a popup called MySearch could be an number of nasties

Just to check Spybot 1.3 that is updated and Ad-aware 6 build 181 correct ?

So Post a new log, and It appears you havent posted the whole thing please do so. and if youve disabled anything since the problems started re-enable them, and dont have anything ignored in hijackthis.

can you give us some info on spider.exe ?

 

Lonny

In my system spider.exe is a card game. I do not know why someone would have it running all the time.

Daniel

 

MySearch removal

Pete C., thanks for the links. They suggest just unistalling MySearch from the control panel. Currently there is no such program in the control panel, but if it comes back, I'll look there.

Lonny, as Dan mentioned, Spider seems to be just a card game that my kids have been playing that was bundled with XP. It might have been lit up when I ran the HiJack list.

Is there any concern about 03 Toolbar: &Radio . . . . I cannot think of what that might be.

I'll do some checking on Messenger 3 Plus. Has a place in the Program Files directory and Control Panel, and looks legit, but I didn't put it there. I'll ask my kids, and if they didn't put it on, I'll kill it.

Terry

 

Hi

My canned text for messeger plus

apparently It can be installed without the added LOP parisite but when installing you have to not let it do so, there is an option to not uninstall the extra stuff or so called enhancements