My home page keeps changing

[czkid]

Recently my home page started changing by itself. The
header reads-
mk@MSITStore:C:\WINDOWS\start.chm::start.html. What the
heck is this. I tried using a homepeage lock offered by
Norton but this thing tossed out me home page selection and
put itself in even though I tried to lock it out. Norton
does not see it after I try to scan for it. Spybot doesn't
see it nor does spy blaster. Any suggestions. This thing
is aggressive and invasive. Thank you

 

[eddie]

Recently my home page started changing by itself. The header reads-
mk@MSITStore:C:\WINDOWS\start.chm::start.html. What the heck is
this.

snip

Here is something that might help you find the solution
http://support.microsoft.com/default.aspx?scid=kb;en-us;312456

 

[Squid]

I just had fun trying to remove something similiar.
Check your msconfig for a startup item similiar to
regedit -s sysdll.reg. Uncheck this from starting. This
changes your internet settings in the registry. It would
direct me to www.search-town.net or nkvd.us/1520 or
searchpage.cc/1520.

But it seems to also erasing the HOST file, so you cant
block sites. But even by stopping that reg file from
loading this malware or virus will run again.

Make sure script blocking is active in antivirus and/or
services. Also scan the services for anything that
doesnt look familar & stop it... something like NORPA
should appear listed. After I did that I regained
control of the browser.

I also used CWShredder.

 

[H Leboeuf]

From a previous post by Mike Burgess.

To undo the "CHM exploit" hijack:
Download and run: http://www.master-search.com/remove.exe

Next, delete the following files:
c:\windows\start.chm
c:\windows\start.html

C:\Documents and Settings\<username>\Local Settings\Temp
Delete the entire contents of that folder as one of the
trojan files ("xxxx.bat") exists there.

Note: where "<username>" is the profile (account) you normally use.

Next, completely delete your cache folders, as one of the
trojan files ("access.exe") exists there also.

How To: Delete the Internet Explorer Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

Next,
Go to: http://mvps.org/winhelp2002/unwanted.htm
Download "Hijack This!" [freeware]

Unzip, double-click "HijackThis.exe" and Press "Scan".
Place a check in the following items, then click "Fix checked"

Shows up in HijackThis as:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
C:\WINDOWS\start.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
mkMSITStore:C:\WINDOWS\start.
chm::/start.html
--

"Need to delete those files, but how?"

Open Windows Explorer and delete them.

"Also, how can I improve my 'defense'?"

http://mvps.org/winhelp2002/unwanted.htm (items 1-7)
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
** NOTE NEW ADDRESS **
Pages at generation.net will no longer be updated.
===