Have Spyware installed but CANNOT find the source!

Every day when i run Ad-adare/Spy-doctor/Counterspy/Microsoft Antispyware it finds new things, only to find them again the next after i delete them. Can someone please help me?
I am posting the Hijack log here. THank you!

Edit by chaslang: Unrequested inline log removed

 

Please follow forum guidelines, always ATTACH your log to your post as a .txt or .log attachment.

Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:
Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
(C:\Program Files\HJT) and click Next.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.

You have not followed the READ ME so lets start by doing this.

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:


Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

I am sorry. I have run all spyware programs with no solution anywhere! Here is the Hijack log as an attachement file.

 

You still have not ran the online scans listed in the READ ME!

Did you set this as your homepage? locators.com

Do these online scans before we do anything else:

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

 

The answer to your question is NO. The site www.locators.com is hijacking my regular home page (my.yahoo.com).
I have run 3 out of the 4 scans with no positive results. Is there anything else i can do?

THANKS

 

Thats what I wanted to hear, did you finish those online scans? If so, what were the results?

 

Those three scans did not produce any logs but i ran hijack again with a new log if that's what you were refering to.

 

bjgarrick - those online scans DID NOT produce any results!

They did not find any viruses or trojans. Is there anything else i can do?
It is pretty obvious that something is causing my homepage to change to www.locators.com.

Thanks

 

You must CLOSE ALL browsers for this to work!

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.locators.com/homepage/?ver=1.0.0.51
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.locators.com/search.php?que=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.locators.com/search.php?que=%s

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After doing the above, reboot and post one last HJT log and tell us how things are running now.

 

Thank you very much!

It seems that it helped and the locator.com page is not loading no more. Thank you very much.
However, for some reason after i log on to WinXP and type in my password - it takes me a long time to get in and the message "loading your personal settings" is on for about 2-3 minutes until it lets me in. I wonder what i have touched to cause that.

Here is the new Hijack log.

 

Your log is clean!

As far as the other problem you mentioned you can try this, it wont hurt anything.

If you like you can have HJT fix this entry, this will work without this startup entry, as the active component is an integrated Internet Explorer browser plugin.

O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

How much memory do you have? Reason I ask is because Norton is a resource hog.