At logon homepage gets reset to searchdot.net

[Rick Pettis]

When ever any user logons, some program runs in the
background which changes my home page to searchdot.net.
It also adds an entry in the registry which sets IE start
page to http://www.searhdot.net. I have tried finding
this program but have not been able to . How can I
determine what is being run so I can delete it? I have
looked in startup for all users but do not see anything.
Any help/suggestions will be appreciated.

 

[H Leboeuf]

Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

For a new variant ,

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/