I don't think at this point that it's the pages that Luke is visiting that is causing the problem.
Since I got attacked 2-3 times last week, I've taken to just going to big name sites only: randi, pvponline, dilbert, yahoo, google, get fuzzy. My box is Win2K btw.
Saturday, at 4:06 PM CT, I fired up Diablo2 and was playing online with my friends.
I alt-tabbed out of the game, and went to check diabloii.net. I fired up IE and found: my home page hijacked yet again!
I did a search on any new/recent files in the last 24 hours. So what do a find? -> ghtml.dll (or something like it), sitting in my \winnt\system32 folder. With a timedate of - you guessed it - 4:06 PM CT.
After using 'HijackThis' and renaming it to ghtml.bak was I finally able to kill it.
After Saturday, I had turned off JS and activeX and bunch of other stuff. I was entering randi, dilbert, etc into the Trusted Site section of IE to allow activeX and JS. However, I was trying to get my taxes done, and needed full access to schwab.com. I COULD NOT get the page to display properly, until I re-enabled JS and activex. A minute later, my page was hi-jacked; WHILE I was on schwab.com! Grrr.
SOMETHING is on my and Luke's computers, and it's d/ling these stupid things into our system32 folders even when we're not using IE. If I don't d/l Firefox, I'm going to wipe the bloody harddrive and reinstall Windows etc all over again. I can not STAND having unauthorized code d/ling crap into my system32 folder without my permission. (You suck, Uncle Bill.)