about:blank page - where is this setting?

[jmev7]

I am trying to trace where in the windows registry is the
"about:blank" page set. Mine appears to be hijacked, and I can't get
any of the spyware apps to make any difference.

Thanks, in advance.

 

[Jan Il]

Hi jmev7

I am trying to trace where in the windows registry is the
"about:blank" page set. Mine appears to be hijacked, and I can't get
any of the spyware apps to make any difference.

It is likely you have parasites, spyware, adware, malware, or hijackware on
your system causing the problem, which your antivirus will not detect, as it
does not have the same definitions.

(Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?kbid=827315)

Download and install, then you *MUST* update the programs prior to running
to be sure they have the latest definitions, then run the programs below.
They are free and very effective. Be sure to run both SpyBot and Adaware,
as what one does not detect the other may. It is important that you do all
the steps and follow all directions carefully:

IMPORTANT:
Before trying to remove spyware using the programs below, download a copy of
LSPFIX from the URL below - some malware may kill your internet connection
when it is removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm

It is important that you run the programs in the order that they are listed
here. The first three programs will clear your machine of all other items so
that you can have a clear HiJackThis Log for the experts to read and analyze
for you.

CWShredder: Free
http://tinyurl.com/2l9kl

SpyBot Search & Destroy: Free
http://download.com.com/3000-8022-10289035.html?tag=lst-0-2

AdAware: Free
http://www.lavasoftusa.com/support/download/

HiJackThis: - Free

Go to
http://computercops.biz/downloads-cat-14.html ,
or
http://www.aumha.org/a/parasite.php#hjt
and download HiJackThis. Unzip to a folder other than your Desktop or the
Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open the copy of your log in NotePad and make a copy. Then you can go here
to post you log:

Jim Eshelman's site here:
AumHa Forums - HiJackThis section:
http://forum.aumha.org/

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

<<DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

HJT Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42


Hope this helps.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.

 

[JR]

You can find it in this key:
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main
or by searching the registery for about:blank ...

 

[jmev7]

Thanks for all the great links. I've tried PestPatrol & Ad-aware, and
even CWShredder, but the coolweb thing just comes back after a reboot.
I noticed that CWShredder hasn't been updated since April on their
site. I hope they're going to keep up the great work.

I also tried installing SpywareBlaster, but it won't run. It gives me
the following message:

"THE PROGRAM HAS BEEN DAMAGED, POSSIBLY BY A BAD SECTOR OF THE HARD
DRIVE OR A VIRUS. PLEASE REINSTALL IT."

I tried reinstalling, but no dice. Next step is to hack the registry,
but I'm not sure what to look for.

As for the coolweb thing coming back, I wonder if anything is in my
Internet Options|Content|Publishers list that needs to be removed???

I will try downloading HijackThis, though I'm losing so much time on
this, I may just have this sytem re-imaged (and lose all my nice
layout/settings/mp3 files/etc).

If you have an idea why my Spywareblaster doesn't start, I'd love to
hear it.

Thanks again.

 

[Mike]

SpywareBlaster is a preventer not a remover. Run HijackThis and save the
log, post the contents

 

[Jan Il]

Hi jmev7

You obviously have the newest and nastiest variant of this virus, so here is
the just recently (2 dyas ago) updated information on how to clean Mr.
MeanJeans. It replicates itself, that is why it is coming back after the
reboot.

Follow the instructions below carefully.

This is a newer variant of about: blank. Methods that previously
removed it may not have any effect on it

IMPORTANT!!
RUN ALL PROGRAMS OFF LINE IN SAFE MODE AND SHOW HIDDEN
FILES. THEN REBOOT AND RUN THEM AGAIN TO BE SURE ALL FILES
ARE ACCESSED, DELETING ALL ITEMS DISPLAYED IN RED IN SPYBOT

about:blank
http://www.atribune.org/downloads/AboutBuster.zip
or
http://tools.zerosrealm.com/AboutBuster.zip

res://C:\WINDOWS\<random name>.dll/sp.html#<random number>
http://www.hsremove.com/

HiJackThis:

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT install in your Desktop folder.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

Go to:
http://computercops.biz/downloads-cat-14.html ,
or
http://www.aumha.org/a/parasite.php#hjt
(If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip)

and download HiJackThis to the new folder. Unzip to a folder other than your
Desktop or the Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open the copy of your log in NotePad and make a copy. Then you can go to one
of the following to post your log:

<<PLEASE DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here:
http://forums.tomcoyote.org/index.php?act=idx

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

HJT Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42


Hope this helps.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[jmev7]

Since, I was warned not to post the log files here, what's the best place to do so?

 

[Jan Il]

Hi jmev7

Since, I was warned not to post the log files here, what's the best
place to do so?

Look in the first reply I posted for you under HiJackThis, about mid-way
down.

Jan