Reply #2: Yep, I analyze them quite a bit [View All]

[tkmorris]

You could post it here and we could all have a look over it; I'm sure we could find all the baddies hiding in there.

You should know though that many of the most persistent hijacks will reinstall themselves even after you've deleted them using HijackThis. In such cases it is neccessary to find the file or files hiding on your hard drive which reinstall the hijack. This can be difficult since they often are randomly named but the information HijackThis provides can help. For example, one I recently had to get rid of generated a random name for the file which would reinstall it every time I deleted it using HT but by knowing which particular hijacker was being installed I knew exactly where to look for the file, in this case in Windows/system32. It was a .dll file that matched no known dll file names.

One of the things you want to watch for is if something you remove via HT shows back up when you run it again. If that happens you have to manually find the file and get rid of it.

If you are willing to post a log here I'd be happy to look at it.

On the other hand if you are sure it is SmartSearch that is causing your headaches you can look here: http://ftp.officefive.org.uk/sites/cwshredder.net/cwshredder/cwschronicles.html#smartsearch for the known files that hide on your system and reinstall the thing. If you have any of those files on your computer in the locations listed, they are bad files and need to be deleted. If CWShredder didn't take care of it than you have one of the more sophisticated variants and will likely have to delve into your registry and make some changes to reaqlly fix it, in addition to tracking down the file containing it. In my experience just lately I've seen this thing hiding in a file called "Notepad32.exe" most often but it could be in any of the files listed at the link above.

Try not to get discouraged. SmartSearch is one of the hardest to get rid of there is.