"about:blank" problem and other unknown programs

[Guest]

G'day,

A few weeks ago i had some trouble with IE - mainly, it just wouldn't start
up. So i managed to update it to IE6 but from when it first loaded there was
a lot of trouble with my computer.

It started with the page loading with "about:blank" (which i have since
discovered is some kind of spyware/malware program). To those familiar with
this problem, no matter what happens, the IE home page is always set at
"about:blank" and ttehre is also a "Reset Web Settings" option i've never
seen in my Tools menu.

Now, in the past week the whole computer has begun to slow down - and i can
only guess its related to this problem somehow. Whenever IE loads it now
always takes a few minutes (literally) when it used to only take a few
seconds and there are also a bunch of other little, and unknown, programs
running in teh background when it loads up - which is slowing everything down.

I've used spybot, adaware, cws shredde, bho demon and norton anti virus -
all with teh latest updates, regularly lately but the problem keeps returning
and just never goes away. Not only is it a hassle with using the internet, it
has now become difficult using the computer sometimes.

please help me if you can.

RT.

 

[Don Varnau]

Hi,
There appear to be several varieties of this parasite and it can be
difficult to remove.
See this discussion for some possible solutions:

http://groups.google.com/groups?hl=...s_miny=2004&as_maxd=20&as_maxm=9&as_maxy=2004

or
http://tinyurl.com/664za

Hope this helps,
Don
--
MVP IE/OE
Please reply to the newsgroup so that others may participate.

"RT - Needing Help" wrote in message
news:[email protected]...

 

[Jan Il]

Hi RT

This is a very nasty variant of about:blank. Methods that removed the
previous variant may not have any effect on it. Try the following and
follow and instructions carefully to clean your system fully. This variant
replicates itself, thus, you must fully clean it from your system. This
coolwebsearch infection uses a hidden dll to reinfect, thus it replicates
itself over and over if not removed properly.

It is important that you read these instructions carefully first, then run
the programs in the order that they are listed here. The first three
programs will clear your machine of all other items so that you can have a
clear HiJackThis Log for the experts to read and analyze for you.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

Also, get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
or ........
Winsock Fix Utility for other OS's
http://www.dfwonline.net/files/WinsockFix.zip

IMPORTANT!!
RUN ALL PROGRAMS OFF LINE IN SAFE MODE AND SHOW HIDDEN
FILES. THEN REBOOT AND RUN THEM AGAIN TO BE SURE ALL FILES
ARE ACCESSED, DELETING ALL ITEMS DISPLAYED IN RED IN SPYBOT.

HOW TO Restart in Safe Mode
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

About Buster
http://www.majorgeeks.com/download4289.html

CWShredder
http://www.majorgeeks.com/download4086.html

SpyBot Search & Destroy: Free
http://download.com.com/3000-8022-10289035.html?tag=lst-0-2

AdAware: Free
http://www.lavasoftusa.com/support/download/
HOW TO: Reconfigure Ad-aware for a Full Scan
http://forum.aumha.org/viewtopic.php?t=5877

HiJackThis:

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT install in your Desktop folder.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

Go here and download HiJackThis to the new folder.
http://www.majorgeeks.com/download3155.html
Unzip to a folder other than your Desktop or the Temp folder, doubleclick
HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open the copy of your log in NotePad and make a copy. Then you can go to one
of theforums listed below to post your log:

<<PLEASE DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

Post to:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/
Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
or Tom Coyote here:
http://forums.tomcoyote.org/index.php?act=idx

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

HJT Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42


If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Jan Il]

Hi Don

We really must stop meeting this way.......people will begin to talk...;=)))

Jan
Smiles are meant to be shared,
that's why they're so contagious.

 

[Jan Il]

Hi Don

We really must stop meeting this way.......people will begin t
otalk... =)))

......and they might 'talk' too (dnag sellp cechkre).....<sigh>....

Jan

 

[Don Varnau]

Howdy Jan,
I don't recall seeing you around here at this hour. I generally see folks
from NZ, AU and IN when it's predawn in the middle of the US.

Anyhow... see ya later,
Don