IE6 keeps going to sprinks.com 1

[Les129]

I've got a customer who is running IE6 on Win98SE. Whenever his browser cannot load the page for whatever reason (404 or Auth Req. etc) he is redirected to a search page called sprinks.com. I've looked everywhere on his system (registry, run ad-aware etc) but cannot find what is doing this. Any suggestions?

 

[shmoes]

the page? what page would that be .. any page?

is it his homepage?

tools/internet options

 

[braddds]

From looking at the "sprinks" website. Which is an advertising website dealing with searches to aid advertisers. I'd say they have a browser hijacker or some other nasty on the persons computer. See link for more info:

http://www.spywareinfo.com/articles/hijacked/

They provide a description, downloads and help!



Cheers

Thx to all who respond

 

[Pennanti]

I was going to say try running Spy Bot Search and Destroy as it will often pick up what Ad-Aware cannot, but the site is currently experiencing difficulties. Possibly you could download a copy from Download.com. Sprinks sounds like what is called a hi-jacker, it takes over the browsers search function and redirects the browser to the sprinks site.

 

[Les129]

Shmoes,

It happens when you try to connect to any webpage which gives you an error like 404 or Auth Req.

braddds,

I've had a look at HijackThis based on your recommendation, I might try this util onsite when I can get out there, thanks.

Pennanti,

Thanks for your reply, a lot of other people have also recommended Spy Bot. I'll give it a go.

 

[zacker7]

Is Spy Bot better than Ad-Aware, or do they just find differents sets of culprits?

Zacker

 

[vickero007]

Each one has a few benefits the other does not, I use both. Where have you looked in the registry? Did you try

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main ?

or the same key in the other roots.

-Volkoff007

 

[Crustyoldbloke]

A quick footnote to this thread since I feel that spyware/scumware is the culprit. The latest update of SPYBOT S&D also has a registry checker and an immunization feature, which stops the spyware being downloaded within IE. IMHO Spybot is by far better than AdAware.

Kind regards

Phil

 

[carrr]

Here, here...seconding crustyoldbloke's sentiments.
I've consistenntly found SpyBot to be the far superior tool. I only buy into the argument that one finds things that the other doesn't in a one-directional sense. SpyBot finds things that AdAware missed (provided the user is applying the updates as they are available).
And...I've not yet forgotten that not long ago, AdAware left its fan-base hanging by ceasing to support v. 5.83 while they developed 6.0. It wasn't until much negative hue and cry was raised that they even acknoledged that their product had been outdated and ineffective for months. Of course, I am griping about what was freeware, but....

 

[MitchCumstein]

Les129, the redirected search page is in the registry at:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="

http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

This is for a default IE install, and sends you to MSN for the search.

 

[Les129]

MitchCumstein,

I had a look at that registry entry you mentioned, however changing it has no effect whatsoever on my machine. I even tried changing the string to the sprinks site and it still redirected me to ninemsn on page errors.

I wonder what is the use of a registry key that does nothing. No wonder my registry is 5MB long and my computer chugs more often than not.

Thanks Microsoft... Another hidden, unmovable misfeature!

 

[PCLine]

Have you tried clearing the index.dat files?

 

[Les129]

I tried using HijackThis on the customer's computer this morning. IT WORKS!

From the internal memo I wrote this morning for my company:

"A sprinks hijack is confirmed by the presence of the following files:

c:\windows\system\msinfosys.dll
c:\program files\primesoft
c:\program files\primesoft\aswnk

and the presence of references to primesoft, autosearch, autosearchBHO, and aswnk in the registry."

If you run HijackThis and remove the associated registry keys and remove the associated files in safe mode, Sprinks will disappear.

Customer very happy, technician very happy. Thankyou to all who responded. HijackThis is a very good program, and seems to be fairly stable.

Thank you once again. Everyone has been a great help.

Cheers!