homepage

[andy]

I have used CWShredder in the past when my homepage keeps
resetting itself. This has happened again but CWShredder
is not working. The page is
mkMSITStore:C:\WINDOWS\start.chm::/start.html#8
Any other ideas?
UPDATE - Have tried
http://support.microsoft.com/default.aspx?scid=kb;en-
us;312456 (alan edwards) but still no luck!

 

[H Leboeuf]

Other issues here.

http://www.generation.net/~hleboeuf/msitstor.htm

 

[Guest]

Have run http://www.master-search.com/remove.exe but not
sure what to do next. Need to delete those files, but how?
In DOS? and what do i type? (something of a novice). I
also need HijackThis. I have tried before but had
difficult. Also, how can I improve my 'defense'?

Thanks

-----Original Message-----
Andy,
I have used CWShredder in the past when my homepage keeps resetting itself"
If this continually happens your "Defense" is lacking .....

"The page is

mkMSITStore:C:\WINDOWS\start.chm::/start.html#8"
The is caused by the "CHM exploit" ......

http://www.master-search.com/remove.exe

Run that and then delete c:\windows\start.chm and c:\windows\start.html

Shows up in HijackThis as:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
mkMSITStore:C:\WINDOWS\start.chm::/start.html
--
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
__________________________________________________________ __
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09- 04]
Please post replies to this Newsgroup, email address is invalid
--

I have used CWShredder in the past when my homepage keeps
resetting itself. This has happened again but CWShredder
is not working. The page is
mkMSITStore:C:\WINDOWS\start.chm::/start.html#8
Any other ideas?
UPDATE - Have tried
http://support.microsoft.com/default.aspx?scid=kb;en-
us;312456 (alan edwards) but still no luck!

.

 

[Mike Burgess]

Andy,
I have used CWShredder in the past when my homepage keeps resetting itself"
If this continually happens your "Defense" is lacking .....

"The page is mkMSITStore:C:\WINDOWS\start.chm::/start.html#8"

The is caused by the "CHM exploit" ......

http://www.master-search.com/remove.exe

Run that and then delete c:\windows\start.chm and c:\windows\start.html

Shows up in HijackThis as:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
mkMSITStore:C:\WINDOWS\start.chm::/start.html
--
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09-04]
Please post replies to this Newsgroup, email address is invalid
--

 

[Mike Burgess]

Hi,
To undo the "CHM exploit" hijack:
Download and run: http://www.master-search.com/remove.exe

Next, delete the following files:
c:\windows\start.chm
c:\windows\start.html

C:\Documents and Settings\<username>\Local Settings\Temp
Delete the entire contents of that folder as one of the
trojan files ("xxxx.bat") exists there.

Note: where "<username>" is the profile (account) you normally use.

Next, completely delete your cache folders, as one of the
trojan files ("access.exe") exists there also.

How To: Delete the Internet Explorer Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

Next,
Go to: http://mvps.org/winhelp2002/unwanted.htm
Download "Hijack This!" [freeware]

Unzip, double-click "HijackThis.exe" and Press "Scan".
Place a check in the following items, then click "Fix checked"

Shows up in HijackThis as:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
mkMSITStore:C:\WINDOWS\start.
chm::/start.html
--

"Need to delete those files, but how?"

Open Windows Explorer and delete them.

"Also, how can I improve my 'defense'?"

http://mvps.org/winhelp2002/unwanted.htm (items 1-7)
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09-04]
Please post replies to this Newsgroup, email address is invalid
--

Have run http://www.master-search.com/remove.exe but not
sure what to do next. Need to delete those files, but how?
In DOS? and what do i type? (something of a novice). I
also need HijackThis. I have tried before but had
difficult. Also, how can I improve my 'defense'?

Thanks

-----Original Message-----
Andy,
I have used CWShredder in the past when my homepage keeps resetting itself"
If this continually happens your "Defense" is lacking .....

"The page is

mkMSITStore:C:\WINDOWS\start.chm::/start.html#8"
The is caused by the "CHM exploit" ......

http://www.master-search.com/remove.exe

Run that and then delete c:\windows\start.chm and c:\windows\start.html

Shows up in HijackThis as:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
mkMSITStore:C:\WINDOWS\start.chm::/start.html
--
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
__________________________________________________________ __
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09- 04]
Please post replies to this Newsgroup, email address is invalid
--

I have used CWShredder in the past when my homepage keeps
resetting itself. This has happened again but CWShredder
is not working. The page is
mkMSITStore:C:\WINDOWS\start.chm::/start.html#8
Any other ideas?
UPDATE - Have tried
http://support.microsoft.com/default.aspx?scid=kb;en-
us;312456 (alan edwards) but still no luck!

.