I have been struggling with a homepage being hijacked to cashsearch.biz for several days. After some intense research I have figured out a quick and efficient way to get rid of this scumware. Do the following:

1.) Find and delete system32.dll, it should be located in c:\windows\system32\system32.dll - You may have trouble accessing the file. If you can not delete it then rename it.

2.) Backup your registry

3.) Search the registry for every instance of system32.dll. You will notice that it is pointing to the same folder as the file you just deleted. Delete this registry entry everytime you find it.

4.) Search the registry for cashsearch.biz. Everytime you find it, replace it with your prefered home page.

5.) Change your home page in IE. DO NOT open IE, right click on the icon and go to properties to change the home page.

6.) Run HijackThis and make sure you do not see any registry entries for cashsearch.biz Remove any entries if you find them.

7.) Reboot your PC

Good luck. I hope this helps. This one was driving me nuts.

EriktheGeek

I had to start up in Safe MOde to delete the system32.dll file. Otherwise worked fine. After 2 days of fighting this thing.
Thank you