Homepage Hijacked Please help!!!

hi, my homepage keeps staying on the same stupid search page, and i cant seem to change it. of course i have run all the spyware/adware programs out there. also, i have tried to unload the dll file that is causeing the problem, and it just keeps coming back. if anyone has any suggestions, please feel free to help me out, thanks a ton.

here is a hijackthis log....

Logfile of HijackThis v1.98.1
Scan saved at 2:24:26 AM, on 8/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\appos32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\netgx32.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pmeem.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://pmeem.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://pmeem.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pmeem.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pmeem.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://pmeem.dll/index.html#96676
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Matt\Application Data\Mozilla\Profiles\default\s23473vo.slt\prefs.js)
O2 - BHO: (no name) - {7B6574F7-6A9E-BCF5-6CA2-4CE75F164568} - C:\WINDOWS\system32\ipam32.dll
O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [netgx32.exe] C:\WINDOWS\system32\netgx32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [cryu.exe] C:\WINDOWS\cryu.exe

hi,
i think i can help you, as this sounds similar to something i have had, called coolwebsearch (aka coolwww).
I havent used hijackthis before, so i cant rally help you with that, but i have some knowledge of registrys, and by the looks of your hijackthis log, your page is being changed to something like res://pmeem.dll/index.h...etc. am a right? and are you getting a lot of popups, titled simply the best?
also what system are you on, eg winxp, winnt...etc.
Please reply back here and i am sure we can sort this out.

hey again, thanks for the help in advance. i am on winxp pro right now. i have done all that is possible to get rid of this thing, but it just keeps making my IE webpage change back to the same thing. yes, when i immediately get on IE it takes me to the webpage and a popup comes up, but it is random. any suggestions??

ok,
well when i had this, my homepage was being changed to a search page, and it was something like res://tydni.dll/index...etc, but all cases i have heard of have a different page, due to a different, randomely named file, which is casuing all teh problems.
now i got rid of it, by doing this:
1) scan with lavasoft adaware, and delete everything it finds.
2)search your computer for pmeem.dll . I exoect it to be somewher like c:\winxp , or C:\windows , or somewhere like that, but it would be easier just to use 'search', included in xp pro .
3)when you find pmeem.dll , open it in notepad.
4)select all the code and delete it.
5)save pmeem.dll .

Once you have done this, you should be cured of it; i was!

If you have any problems or questions, just post back here, or contact me at richard.merrick@kmwebsites.co.uk

thanks