problem with startsearches.net. Help!

I have read and followed Major Attitude's thread, "Read me first before asking for support", and followed all instructions to the letter. However, after i restarted in normal mode, IE wouldn't go to any page except startsearches.net. If i typed in a URL it would just go there. I'm in safe mode now - it's the only way I can go to any other site.

I also tried HijackThis!, but when I got rid of the entries relating to startsearches.net, they just reappeared when I did another scan.

Please help, I'm gonna throw my PC out the window if I can't fix this soon!

 

Here is the log file from hijack this! if anyone wants to take a look at it.
Any help would be greatly appreciated.

 

Your Operating System & Internet Explorer versions are WAY out of date and represent a major security risk. After we fix your current problems, you must get updated. You need to install Service Pack 2 for security purposes.

Also, this log appears to be from Safe Mode, If so, please attach a fresh log from normal mode.

 

new log

Cheers for the reply.
Here's the log from normal mode.
Also something else I noticed. startsearches.net only hijacks my browser if I try to go to one of my favourites. If I type a url in the address bar it seems fine.

Also, I can't access my e-mail account. It's with Hotmail. My inbox starts loading but then is hijacked by startsearches.

 

Again, I want to point out that your Operating System & Internet Explorer versions are WAY out of date and represent a major security risk. After we fix your current problems, you must get updated. You need to install Service Pack 2 for security purposes.

Download Pocket KillBox
(Don't run it yet)

Please look in Add or Remove Programs for the following and Uninstall them if found:

dopewars-1.5.10


Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.startsearches.net/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.startsearches.net/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.startsearches.net/

O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - C:\WINDOWS\System32\hp87FC.tmp

O23 - Service: dopewars server (dopewars-server) - Unknown owner - C:\Program Files\dopewars-1.5.10\dopewars.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and delete the following folder if it still remains:

C:\Program Files\dopewars-1.5.10 <-- Delete this whole folder!

NOW:
Click Start > Run > type services.msc and Click OK

Locate dopewars server (dopewars-server) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

NEXT:
Run CCleaner


Locate PocketKillbox

Now, Copy and Paste C:\WINDOWS\System32\shnlog.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\System32\intmon.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\System32\hp87FC.tmp into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES.


Now allow Killbox to reboot your system, after you have rebooted and windows has loaded, attach a fresh HJT log.

 

Here's my new log. It seems clean and I havn't had any problems with my homepage....yet! Thanks for the help! Now to sort out those updates.
Again, thanks a lot for the help!

 

Your HJT log is now clean!

Now, you MUST go to Windows Updates and get updated. Make sure you install Service Pack 2, without this critical update you will continue to have problems.

Are you having any further problems?

 

Got the updates and everything is fine now.
Thanks again for the help!

 

Your Welcome!

You should see this article on How to Protect yourself from malware!