Actually, I see you have the same DLL issue as many others I am working with - can you run AdAware for me (with an updated REF file) and post the log, so I can check something out please.

Can you run AdAware (make sure REF files are the most current) and post the log from it --- this is a problem with several people, and by looking at the log from that, I can tell if yours is the same...

I think I now know what your problem is, and the source of the 'morphing' DLL... can you run Adaware again, and post the results log here so I can see something - Thanks!

I stand corrected... thank you Michael.

I have been assessing logs for a year, and never had any recurring problems when it came to the (obfuscated) entries.

However, I am enlightened today.
...

Rurun Hijack This again and get rid of these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\efje.dll/sp.html (obfuscated)

R1 -...

WHOO HOO! A will!!!!

Rerun one last time and get rid of these (make sure browser is closed):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =...

Oooopps,

I cut and paste the whole log into notepad as I go thru it, and then repaste here - sorry I missed removing that one.

I don't reformat ever. But that is because I have never had the need to for any system I have worked on.

I know that there are occasions that it will have to be done - but it is the absolute LAST...

Rerun Hijack This with all browser windows closed and tick the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html

R1 - HKCU\Software\Microsoft\Internet...

I 100% agree with Crunchie!

DO NOT REFORMAT YOUR COMPUTER!

First if it keeps coming back, it is probably in System Restore so do the following:


Delete temp, temp internet files and...