Hijacking Browser Aided by Microsoft Antispyware

[RWX]

About.blank seems to be hijacking my browser start page
using the Microsoft Antispyware program. It seems to take
over and put itself in as the default.

res://C:\WINDOWS\iosiq.dll/sp.html#10001 seems to be
doing the same thing with my browser search.

Spybot and Adaware run in sequence seemed to work prior
to my installing the Microsoft Antispyware program. Each
of the three programs seem to catch threats the others
miss. The Microsoft Antispyware program worked well until
the default process became hijacked. Any solutions out
there?

 

[Ron Kinner]

This is the about:blank hijacker. AntiSpy does not yet
understand it.

Try cwshredder.exe which you can get from

http://cwshredder.net/bin/CWShredder.exe

If it asks you if a file is random tell it NO and write
the file name down and come back and ask me.

There are two German programs which I've had some success
with:

SPhjFix.exe

http://www.trojaner-info.de/cgi-bin/download.cgi?
file=sphjfix

and Spoonweg.

http://mmrealisation.de.vu/

then click on
"...oder drücken Sie hier um die Homepage ohne vorladen zu
betreten."
then when the little picture of a floppy appears click on
that.


I think both will reboot your system after running.

Also get HijackThis.exe from

http://www.tomcoyote.com/hjt/HijackThis.exe

SCAN your system, SAVE LOG and send me the log (after
running CWShredder and one or both of the german programs)
as an attachment or copy and paste the
text here.

One other way which might work is to change your Windows
Explorer so it can see Hidden and System Files and
extensions then find the file C:\WINDOWS\iosiq.dll/ and
then change it from Large Icons to Details and find the
Modified Date. Then Click on the Modified at the top of
the column and find all files Modified at the same time as
the iosiq.dll and delete them. Check the
C:\windows\System32 folder and the C:\windows\System32
\dllcache too and delete any files with the same dates.


http://www.pchell.com/support/aboutblank.shtml

also has useful tips on getting rid of this nasty.

Ron Kinner MVP Servers

rkinner AT att DOT net

 

[chevyqc]

I have the same type of problem, only mine is being
hijacked by teenbiz.com. I have tried microsoft, spybot,
hijack this, winpatrol,as well as start page guard. So far
nothing is working to eliminate this hijacker. I reset
manually back to my start page and without reboting at
some point it reverts back to the hijacked page.