browser hijack question

[osidak]

At random intervals when I crank up IE 6 w/SP1 my home page is redirected to the following site

mk:@MSITStore:C:\WINNT\start.chm::/spplain.html

When this happens I delete the start.chm file and search for the spplain.html file and I am unable to find it. If I open the start.chm file it is just a bunch of characters with nothing of any real meaning.

It will reappear again at some random interval.

Mcaffee and Ad-aware will not remove it. Any tips

O/S is Win2K Pro

Please don't suggest a mac.

[RickM]

Sounds like Prolivation, which I can't get rid of on one of my laptops. I'm just going to reformat and reinstall the OS....I hate these scums.

Check this out

http://www.computing.net/security/wwwboard/forum/11009.html

Edit: removed second link....don't trust it.

[RickM]

Here's another method. However, I expect it to be a bandaid approach....perhaps good enough till more is known.

"This is what I finally had to do to stop it from hijacking my start page. I tried everything and could never find out where it was replicating itself from.

First I went into windows and deleted the start.chm files there was two originally and one would replicate itself after about five minutes and place another start.chm file. It was a 11k, so I went into the windows help folder and found another file that was 11k copied it and renamed it start.chm. Then I went into the properties of the file and made it read only. That stopped it from replicating into my windows folder.

Now I did try and make a file from scratch called start.chm and made it read only but (it was not 11k) but that didnt work it still was able to replicate itself somehow. So again that is why I went and copied an already existing 11k chm (help) file."

[osidak]

well I just finished doing the copy / rename a file. We will see how that works. I have been beating my head on this one and I have been stumped.

Glad it isn't only me. Thanks

[id10t]

Get a Mac? No! They are expensive... just run Linux instead

You've got some nasty spyware/adware or a virus... if ad aware and/or spybot search/destroy can't get rid of it, and if the McAffee "stinger.exe" program can't I'd just reinstall the operating system.... Good luck.