Unwanted and Un-eraseable Homepage - "about:blank"

P

Peter T

Afternoon All!

Help needed here, please. (I have searched the archives,
but no matches found.)

On launching IE from the shortcut icon on the taskbar, my
usual homepage has been taken over by URL "about:blank",
with "Search for...." at the top of the page and a
large "Web Site Directory". This seems to be a search
page linked to "SearchX.cc".

I choose my normal "homepage" from Favourites and select
it as such in the Internet Options/General Homepage
box,clicking "Use Current"

I also delete all cookies/files/and clear history in the
same.

When I close IE and reopen, once again I have the
about:blank page as my homepage once again.

Have run both Spybot and HijackThis. The former does not
find anything; the latter notes 3 similar related lines on
it's scan, including:

R1-HCKU\Software\Microsoft\Internet
Explorer\Main,HomeOldSP=about:blank

(I select and delete all 3 - perhaps I'm not seeing other
related lines...)

I run Ad-aware, and it lists 3 CoolWebSearch Malwares in
the Registry Scan, one RegValue and two RegKey - pasted
from the scan log:

Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegValue
Data :
Rootkey : HKEY_CURRENT_USER
Object : SOFTWARE\Microsoft\Internet
Explorer\Main
Value : HOMEOldSP


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 1


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 1


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : PROTOCOLS\Filter\text/html


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : PROTOCOLS\Filter\text/plain

(Note HomeOldSP mentioned in both HijackThis and Ad-aware
scans.)

I remove all 3 as directed in Ad-aware, but as soon as I
open IE the next time, I get the "about:blank" page as my
homepage once again.

To put it at it's most restrained, I am a little annoyed
at this situation, and ask for your help in removing this
annoyance once and for all.

Apologies for the length of this post.

Thanks in advance!

Peter T
 
M

Mike Burgess

Peter,
searchx.cc = CWS.Searchx (coolwebsearch trojan)

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09-04]
Please post replies to this Newsgroup, email address is invalid
--

Afternoon All!

Help needed here, please. (I have searched the archives,
but no matches found.)

On launching IE from the shortcut icon on the taskbar, my
usual homepage has been taken over by URL "about:blank",
with "Search for...." at the top of the page and a
large "Web Site Directory". This seems to be a search
page linked to "SearchX.cc".

I choose my normal "homepage" from Favourites and select
it as such in the Internet Options/General Homepage
box,clicking "Use Current"

I also delete all cookies/files/and clear history in the
same.

When I close IE and reopen, once again I have the
about:blank page as my homepage once again.

Have run both Spybot and HijackThis. The former does not
find anything; the latter notes 3 similar related lines on
it's scan, including:

R1-HCKU\Software\Microsoft\Internet
Explorer\Main,HomeOldSP=about:blank

(I select and delete all 3 - perhaps I'm not seeing other
related lines...)

I run Ad-aware, and it lists 3 CoolWebSearch Malwares in
the Registry Scan, one RegValue and two RegKey - pasted
from the scan log:

Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegValue
Data :
Rootkey : HKEY_CURRENT_USER
Object : SOFTWARE\Microsoft\Internet
Explorer\Main
Value : HOMEOldSP


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 1


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 1


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : PROTOCOLS\Filter\text/html


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : PROTOCOLS\Filter\text/plain

(Note HomeOldSP mentioned in both HijackThis and Ad-aware
scans.)

I remove all 3 as directed in Ad-aware, but as soon as I
open IE the next time, I get the "about:blank" page as my
homepage once again.

To put it at it's most restrained, I am a little annoyed
at this situation, and ask for your help in removing this
annoyance once and for all.

Apologies for the length of this post.

Thanks in advance!

Peter T
 
F

Frank Saunders, MS-MVP

Peter T said:
Afternoon All!

Help needed here, please. (I have searched the archives,
but no matches found.)

On launching IE from the shortcut icon on the taskbar, my
usual homepage has been taken over by URL "about:blank",
with "Search for...." at the top of the page and a
large "Web Site Directory". This seems to be a search
page linked to "SearchX.cc".

I choose my normal "homepage" from Favourites and select
it as such in the Internet Options/General Homepage
box,clicking "Use Current"

I also delete all cookies/files/and clear history in the
same.

When I close IE and reopen, once again I have the
about:blank page as my homepage once again.

Have run both Spybot and HijackThis. The former does not
find anything; the latter notes 3 similar related lines on
it's scan, including:

R1-HCKU\Software\Microsoft\Internet
Explorer\Main,HomeOldSP=about:blank

(I select and delete all 3 - perhaps I'm not seeing other
related lines...)

I run Ad-aware, and it lists 3 CoolWebSearch Malwares in
the Registry Scan, one RegValue and two RegKey - pasted
from the scan log:

Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegValue
Data :
Rootkey : HKEY_CURRENT_USER
Object : SOFTWARE\Microsoft\Internet
Explorer\Main
Value : HOMEOldSP


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 1
Objects found so far: 1


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 1


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : PROTOCOLS\Filter\text/html


CoolWebSearch Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : PROTOCOLS\Filter\text/plain

(Note HomeOldSP mentioned in both HijackThis and Ad-aware
scans.)

I remove all 3 as directed in Ad-aware, but as soon as I
open IE the next time, I get the "about:blank" page as my
homepage once again.

To put it at it's most restrained, I am a little annoyed
at this situation, and ask for your help in removing this
annoyance once and for all.

Apologies for the length of this post.

Thanks in advance!

Peter T
Click to expand...

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/
 
G

Guest

http://www.spywareinfo.com/~merijn/cwschronicles.html see CWS.Searchx

This variant is not very hard to spot, but slightly harder to troubleshoot since its symptoms look a lot like those of CWS.Xmlmimefilter. It drops a randomly named DLL in the system folder and sets the IE homepage/search pages to it. A BHO is also added pointing to the same DLL. The about:blank page is modified by creating two new protocol filters for text/html and text/plain which allows the DLL to control most of the content flowing through the IE browser as web pages. The trojan keeps a record of all actions in a log file at c:\filter.log. Removing the two filters in the Registry, deleting the BHO, the DLL and the logfile and restoring the IE pages fixes this hijack.

----- Peter T wrote: ----

Afternoon All

Help needed here, please. (I have searched the archives,
but no matches found.

On launching IE from the shortcut icon on the taskbar, my
usual homepage has been taken over by URL "about:blank",
with "Search for...." at the top of the page and a
large "Web Site Directory". This seems to be a search
page linked to "SearchX.cc"

I choose my normal "homepage" from Favourites and select
it as such in the Internet Options/General Homepage
box,clicking "Use Current

I also delete all cookies/files/and clear history in the
same

When I close IE and reopen, once again I have the
about:blank page as my homepage once again

Have run both Spybot and HijackThis. The former does not
find anything; the latter notes 3 similar related lines on
it's scan, including

R1-HCKU\Software\Microsoft\Internet
Explorer\Main,HomeOldSP=about:blan

(I select and delete all 3 - perhaps I'm not seeing other
related lines...

I run Ad-aware, and it lists 3 CoolWebSearch Malwares in
the Registry Scan, one RegValue and two RegKey - pasted
from the scan log

Started registry sca
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â

CoolWebSearch Object recognized
Type : RegValu
Data :
Rootkey : HKEY_CURRENT_USE
Object : SOFTWARE\Microsoft\Internet
Explorer\Mai
Value : HOMEOldS


Registry scan result
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â
New objects :
Objects found so far:


Started deep registry sca
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â

Deep registry scan result
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â
New objects :
Objects found so far:


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â


Deep scanning and examining files (C:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â


Performing conditional scans.
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯Â

CoolWebSearch Object recognized
Type : RegKe
Data :
Rootkey : HKEY_CLASSES_ROO
Object : PROTOCOLS\Filter\text/htm


CoolWebSearch Object recognized
Type : RegKe
Data :
Rootkey : HKEY_CLASSES_ROO
Object : PROTOCOLS\Filter\text/plai

(Note HomeOldSP mentioned in both HijackThis and Ad-aware
scans.

I remove all 3 as directed in Ad-aware, but as soon as I
open IE the next time, I get the "about:blank" page as my
homepage once again

To put it at it's most restrained, I am a little annoyed
at this situation, and ask for your help in removing this
annoyance once and for all.

Apologies for the length of this post.

Thanks in advance!

Peter T
 
P

Peter T

Sincere thanks to Arnold, Mike and Frank for your valued
suggestions. Think I've cracked it with your help. I
really appreciate your time and efforts.

Thanks

Peter
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

valid registry entries 1
Homepage change 1
Malware Software 2
Unable to Change Home Page 1
Alexa hidden hijacker 3
How do I get rid of this Pest? 15
Everytime I try to search in the address bar, my browser gets spyware... 7
CWS about:blank - successfully removed 1

Top