about:blank error

[Dana]

I have done everything I could find to do to get rid of
this irritating change of my homepage to about:blank and
nothing works.

There is information all over the internet about how this
is a Microsoft problem. Do you have any intentions of
fixing it or are you forcing your customers to use other
browsers (which is what I plan on doing from today on).

I had considered upgrading my browser but until the
about:blank problem is corrected it makes absolutely no
sense, why stay with a product that isn't functioning or
supported by one of the largest companies in the world?

The fact that you just ignore this issue really speaks
VOLUMES about your attitude towards your customers.

 

[Jan Il]

Hi Dana


If you would like to file a complaint with Microsoft please do so. However,
this newsgroup is a peer-to-peer help group, and no one here is employed by
Microsoft. Microsoft provides the resources for the newsgroups to assist
users who may have problems. The Microsoft MVP's who come here are
volunteers who help on their own time. As does everyone else. No one who
posts or helps here is paid by Microsoft, or anyone else.

I can understand your frustration with the issue, but, it is not just a
Microsoft problem. Please read the information below. Perhaps this will help
resolve your problem.

ABOUT BLANK

Courtesy of Mike Maltby, MS MVP

You've been hijacked, quite possibly by a variant of the CoolWebSearch
parasite.
Possibly the CWS.Aboutblank variant
(http://www.spywareinfo.com/~merijn/cwschronicles.html#aboutblank)

Download and run CWShredder
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip) which is the best
way of getting rid of the many forms of the CoolWebSearch hijacker details
of which can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html
and also http://www.pestpatrol.com/pestinfo/c/cws.asp..

This would be a good time to download yourself a copy of the free Ad-Aware
6.0 from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also
SpyBot
Search & Destroy (http://www.safer-networking.org/) and use them to check
your system for other commercial parasites remembering that they are only as
good as when you last updated their reference files. I also use a program
called
BHODemon (http://www.definitivesolutions.com/bhodemon.htm that checks for
unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help prevent
some parasites getting a grip on your PC.

Hope this helps.

Jan

 

[Jim Byrd]

Hi Dana - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end disable System
Restore and then reboot your system in order to clear the malware garbage
from the backups after you've cleaned up. It's best to perform CWShredder
(and most other malware fixers too) from Safe mode and then reboot. After
cleaning things up, then you can disable and then re-enable System Restore.
See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In