Last time something like this happened to me, I found that as soon as IE
would start, it would quickly go to several websites before it went to the
homepage.  See if that is the case, and go to those websites and try to
download the Javascripts that they run.  Those in turn will possibly point
to any files/registry entries on the infected computer.

Also, there might be a entry in the registry called like Internet Explorer
Startup or something, and its value will reference whatever Internet
Explorer is trying to start.  I have seen that one before...

And, lastly, try clearing the history, closing IE, and then starting it
again.  See if there is anything wierd in there (on mine there was
something called "M" that was "located in My Computer".  It was a
javascript that I found actually called "hbar.htm" in \windows\system.

Hope these suggestions are of some help, good luck.

On Wed, 22 Jan 2003, Ian wrote:

> Anyone had a run-in with this search engine\spyware program?  I ran across
> it today on a customer's W98\IE 5.5 machine, where it was set as his
> homepage.
>
> I changed his homepage to Google, but a few boots later, Mixsearch was back.
> I changed it again, and it came back again.
>
> Google found virtually nothing on the net when I searched for 'mixsearch'.
> And a Registry 'Find' for the name took so long (on the customer's venerable
> P75) that I stopped it.
>
> Any clues would be appreciated.
>
> TIA
>
> Ian Porter
> Computer Guys Inc.
> Arrowtown
> New Zealand
> [log in to unmask]
>
>              Do you want to signoff PCSOFT or just change to
>                     Digest mode - visit our web site:
>                    http://freepctech.com/pcsoft.shtml
>
>

--

-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/-\_/

             Do you want to signoff PCSOFT or just change to
                    Digest mode - visit our web site:
                   http://freepctech.com/pcsoft.shtml