[innerlight]

Hi friends!

I'm running WinXP and have a problem with a browser hijacker that attacked recently, and which seems totally immune to my Zone Alarm firewall (not Pro edition), my AdAware 6.0, my Spybot, my HouseCall Virus Scan, my BoClean Anti-Trojan, and my CW shredder!! I can use all of the above until my system seems devoid of all nasties of any kind....even my HijackThis scan is normal.....then, as soon as I open my homepage and open any website from there, my homepage address gets reset to the following address

mkMSITStore:C:\WINDOWS\start.chm::/start.html

If I do another H.T. scan, I will see 2 entries for this address in my registry, and I will, of course delete them, but I know they will come right back as soon as I visit another site....ANY site!! What can I do?? This damn thing is smarter than any protection I've got!! HELP!

Sincerely,

Innerlight

 

[mobo]

Download CWShredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
Unzip, run and hit the ->fix tab to fix all found problems

CWShredder takes advantage of seurity holes in windows so you should install all critical as well as hotfixes available from windows update.

Then repost a fresh Hijack this log .

Download 'Hijack This!'. http://www.tomcoyote.org/hjt/ and save it to a folder on your desktop.
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

 

[Ragenowski]

Hey man, I don't remember the address, but try a google search for "Browser hijacker blaster". It's free, and it might help out. Hope it helps, and if not, maybe at least you can use it to stop it from happening again.

 

[innerlight]

For Ragenowski............
Hey, thanks man! That blaster really works! I still haven't been able to get the source file off my hard drive yet, but whenever it tries to take over my browser, a flag comes up and tells me so, and gives me the option to stop the change or keep it. Of course I click to stop it, and it does. This takes all of one second to accomplish, and it gives me a great sense of "power at last" over this bug that was able to get past all my other protection and drive me crazy in the process! So, for anybody else out there who has this problem, Browser Hijack Blaster is really worth a try! And to Ragenowski, my friend, for de-stressing my life with your timely tip, may happiness and prosperity fill your days! - Innerlight -

 

[Ragenowski]

Well good, I'm glad I could be of service. With some of the "techie" sounding answers I've seen here in my short time, I'm happy something I said actually helps someone. Thanks for the reply, and good luck in finding the source of your problem.


Ragenowski