My problem is that I have either a virus or spyware that directs me to
"Searchdirs.com" as my internet homepage.  When I go to Internet
Options and change it to msn.com, it will work only if I log on during
that session.  If I turn off my computer and log back on, it goes back
to Searchdirs.com, not msn.
Questions: 
1.  What is this messing with my computer: a virus or spyware?  
2.  How do I get rid of it?  (my Norton antivirus doesn't detect a virus)
(By the way, on its searchdirs.com webpage, if you hit the button to
uninstall it, it tries to download a virus named "bizten."
HELP!

Hi dodthmakai!!

You must download three programs to get rid from this pest:

-CWShredder:
http://209.133.47.200/~merijn/files/CWShredder.exe
or
http://www.spywareinfo.com/~merijn/files/CWShredder.exe
or
http://www.majorgeeks.com/download4086.html


-HijackThis:
http://209.133.47.200/~merijn/files/HijackThis.exe
or
http://majorgeeks.com/download3155.html


-Adaware:
http://www.lavasoft.de/software/adaware/
or
http://majorgeeks.com/download.php?det=506


--------------------------------------
What to do after download these tools?
--------------------------------------

First of all read carefully this page:
http://209.133.47.200/~merijn/downloads.html

Then run the file CWShredder.exe and let it fix everything it finds, and reboot.
Your problem may be solved at this point.

Notes:
·If you get a message saying 'A required dll, MSVBVM60.DLL, was not
found', install this first:
http://download.microsoft.com/download/vb60pro/Redist/sp5/WIN98Me/EN-US/vbrun60sp5.exe

·If you get a virus warning for W32/Generic.worm!p2p, try this link
instead (use a download manager if you cannot download this with the
IE):
http://www.spywareinfo.com/~merijn/files/cwshredder_u.zip


If the problem persists you must use HijackThis, here is a good tutorial:
"How to use HijackThis":
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Run Hijackthis:
"Create a folder where you would like the HijackThis file to reside.
It is important that you download this file to its own folder as this
folder will be used when HijackThis makes backups. If you run it out
of a compressed file, like a zip file, then the backups will not be
made.
Once it is downloaded navigate through Windows Explorer or My Computer
to the location your downloaded it to and double click on the icon for
HijackThis.exe"
Then follow the instructions at the tutorial page.

Close all aplications except HijackThis, then check and fix the items
like the ones that appears at the following list at the scan results
window:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.searchdirs.com/panel/?aff=1020&exp=4

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.searchdirs.com/?aff=1020&exp=4

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.searchdirs.com/?aff=1020&exp=4

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
= http://www.searchdirs.com/panel/?aff=1020&exp=4

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://www.searchdirs.com/?aff=1020&exp=4

See the following thread for reference:
http://www.majorgeeks.com/vb/showthread.php?t=32350


Reboot your computer.


Finally run Adaware and let it do its work removing any trace of
spyware in your computer.


I hope that this helps you. If you need further assistance or this
method does not work in your computer feel free to request for a
clarification. This answer is not considered ended until your feel
satisfied with it, so I will gladly respond all your requests for more
help.


Best regards.
livioflores-ga

---

Request for Answer Clarification by dodthmakai-ga on 18 Jun 2004 06:43 PDT

Sorry for not posting earlier.  Your method worked perfectly!  I am spyware-free.  
Thanks for your help. 
Your answer was flawless and just what I needed.  
Dodthmakai

---

Clarification of Answer by livioflores-ga on 18 Jun 2004 21:24 PDT

Hi!!

I am really glad to know that your computers problem are fixed.
Note that the kaikoura's comment is very useful, specially when he/her
recommend SpywareBlaster, use it after update Adaware (remember to
keep it updated) and scan your computer (in other words, ensuring
yourself for install it in a clean PC).
Download it from:
http://www.javacoolsoftware.com/sbdownload.html

Thank you for the good opinion about my answer, I will be here for any
help that you need in the future.

Regards.
livioflores-ga

Hey, just as a bit of extra info, i use programs called 'Spybot:
Search and Destroy' and SpywareBlaster to keep these pests away.
They've both proved very useful. Info and dowloads are free and easily
available - just search for the names in good old Google.com!

The only thing that is necessary to get rid of Search Dirs as your
internet home page is the following:

At the bottom of the screen on the right-hand side is the word
"uninstall".  Simply click on "uninstall", follow the instructions,
and Searchdirs is removed.  Then go to Tools, Internet Options, the
General Tab, & type in the address of the homepage you wish to use.

NONE of the above instructions for downloading files to remove
Searchdirs are needed.

I have uninstalled, & my computer is now free of Searchdirs.

To get rid of that pest, i did this:
1.  run regedit.exe
2.  search all keys named 'run'
3.  under all keys (named 'run') found, delete all values

maybe a little drastic, and it does not remove the infected file, only
stops it executing on startup.