about:blank

[Guest]

Running XP Pro. Was infected with trojan and spyware. Ran Norton Antivirus,
Spybot, Ad-Ware and Defender to clean off. All seems to be gone except when
using IE, my home page is set to "about:blank". I reset to the page I want
using IE tools but it never changes. It always stays set to "about:blank".

Can anyone help?

 

[siljaline]

Running XP Pro. Was infected with trojan and spyware. Ran Norton Antivirus,
Spybot, Ad-Ware and Defender to clean off. All seems to be gone except when
using IE, my home page is set to "about:blank". I reset to the page I want
using IE tools but it never changes. It always stays set to "about:blank".

Jon,
Run CWShredder to fix this issue - please be reminded that CWShredder is
*not* a Spyware scanner. It is designed to fix "Cool Web Search" Spyware
variants.
The tool > http://aumha.org/downloads/cwshredder.zip
Unzip, save to the following Programs Files Directory >
*If prompted to do so* this will be the default directory:
'C:\Program Files\InterMute\SpySubtract'
If /not/ prompted to install to a dedicated Programs Files Folder, please
create one; C:\Program Files > unzip the above file, copy and paste the executable
to your <user created> folder, named as you wish. Like, CWShredder.
Once done, run the tool with all running programs closed including IE.

Please post back your findings.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Guest]

Silj,

Thank you for your response. I did as you suggested but CWshredder
indicated that "Cool Web Search" was not on my computer. There was nothing
to fix. This is what I've been running into - all of the other programs that
I've used (Norton, Defender, Ad-Ware, Spybot) indicate there is no infection
but what I have going on is not normal.

Jon

 

[siljaline]

Silj,

Thank you for your response. I did as you suggested but CWshredder
indicated that "Cool Web Search" was not on my computer. There was nothing
to fix. This is what I've been running into - all of the other programs that
I've used (Norton, Defender, Ad-Ware, Spybot) indicate there is no infection
but what I have going on is not normal.

Thanks for posting back - sorry to hear CWShredder did nothing.
A reminder that it is not a Spyware scanner, therefore do not run it unless
instructed.

Please proceed as follows:
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.networktechs.com/forumdisplay.php?f=130)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)
(http://www.malwarebytes.org/forums/index.php?showforum=7)
(http://www.wilderssecurity.com/forumdisplay.php?f=26)
(http://makephpbb.com/phpbb/viewforum.php?f=2)
(http://forums.techguy.org/54-security/)
(http://forums.security-central.us/forumdisplay.php?f=13)
(http://castlecops.com/forum67.html)

Post back the URL where you posted your log, *not* the entire log.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Rob ^_^]

Hi Jon,

Did you use Spybot S&D? It has Homepage protection that would stop you
changing it back to what you want.

Regards.

 

[siljaline]

Hi Jon,

Did you use Spybot S&D? It has Homepage protection that would stop you changing it
back to what you want.

Good suggestion, Rob *but* presumably Windows Defender should detect a
home-page "lock" and subsequently flag the user of such.
It is an evenue worth persuing.

Thanks!

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Guest]

Hi guys,

Silj, I posted a log to Bleepingcomputer.com after running all of the
programs that were recommended. Rob, as part of the process I did for Silj,
I downloaded and ran SpyBot S&D. Before that, it was not on my system.

I hope they find something from the log I posted. Thank you both for taking
the time to respond and try to help!

Jon

 

[siljaline]

Hi guys,

Silj, I posted a log to Bleepingcomputer.com after running all of the
programs that were recommended. Rob, as part of the process I did for Silj,
I downloaded and ran SpyBot S&D. Before that, it was not on my system.

I hope they find something from the log I posted. Thank you both for taking
the time to respond and try to help!

Jon,
The URL where your log is posted;
http://www.bleepingcomputer.com/forums/topic52084.html
The handler is waiting for some action from you.

Good luck!

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Hans Le Roy]

Hi,

In addition: there is a known about:blank hijacker.

You might have a look at

How did my homepage get set to About:Blank?
http://www.pchell.com/support/aboutblank.shtml

Kind regards

Hans

 

[Guest]

Hans,

Thank you for the tip. I finally have this resolved. There is an
"about:blank" hijack that is difficult to remove. What was puzzling to all
was, even though I had the symptoms, my system did not have any of the
tell-tale signs of the hijack, i.e., known programs, registry values, etc.
It turns out that the cause of my problem was Ad-Aware. It apparently ships
with a program called "Ad-Watch.exe". You can configure the software to have
this execute at start-up and do real-time monitoring. Doing this caused my
"about:blank" problem. I initially renamed the program so it would not
execute to test the fix and it worked. I renamed it back to its' original
name, ran a program called Adware Away, selected the program and the registry
value it creates and allowed Adware Aware to run its' fix. I am finally
cured of this curse! I hope this information helps someone else trying to
correct this frustrating issue.

Jon