Mike
Fri Jul 30 08:43:36 CDT 2004
One thing to remember is that anti virus applications tend to check for
viruses rather than trojans and commercial parasites. What you are seeing is
a commercial parasite and few commercial AV vendors target such pests.
There are two or more home page hijackers (parasites) that alter the file used
by those who like to launch Internet Explorer with a blank "homepage" rather
than always opening a site such as their ISP's portal or Google.
One of these parasites is a variant of the CoolWebSearch parasite. For
details of the CWS.Aboutblank variant see
(
http://www.spywareinfo.com/~merijn/cwschronicles.html#aboutblank).
Unfortunately there is a more cent variation of this hijacker which cannot be
removed by CWShredder (see below) and if this is the case your only resort
will be to follow the advice in the last paragraph.
Download and run CWShredder
(
http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip) which is the best way
of getting rid of the many forms of the CoolWebSearch hijacker details of
which can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html
and also
http://www.pestpatrol.com/pestinfo/c/cws.asp..
There is also another newer variant aboutblank parasite which is particularly
resistant to removal.
For details of this second variant and possible help see recent posts by Mow
Green in various threads at
http://forum.aumha.org/viewforum.php?f=30 such as
that initiated by JENNY entitled "Blank page is BACK!
(
http://forum.aumha.org/viewtopic.php?t=6437). You will need to download for
later use the tool About:Buster from either
http://www.atribune.org/downloads/AboutBuster.zip
or
http://tools.zerosrealm.com/AboutBuster.zip
This would be a good time to download yourself a copy of the free Ad-Aware 6.0
from Lavasoft (
http://www.lavasoftusa.com/software/adaware/) and also SpyBot
Search & Destroy (
http://www.safer-networking.org/) and use them to check your
system for other commercial parasites remembering that they are only as good
as when you last updated their reference files. I also use a program called
BHODemon (
http://www.definitivesolutions.com/bhodemon.htm that checks for
unwanted Browser Help Objects and SpywareBlaster
(
http://www.wilderssecurity.net/spywareblaster.html) which can help prevent
many parasites getting a grip on your PC.
Finally if you still continue to experience problems download a copy of
HijackThis from (
http://www.spywareinfo.com/~merijn/downloads.html). Create a
folder called HJT on C: and copy the file you downloaded to that folder.
Close as many applications as you can including all instances of Internet
Explorer and then run hijackthis.exe and post as a new thread to the
HijackThis Forum at
http://forums.spywareinfo.com/ or alternatively
http://forum.aumha.org/viewforum.php?f=30 and hopefully this will enable
someone to identify the cause of your problem.
See also: Dealing with Unwanted Malware, Parasites, Toolbars and
Search Engines
http://mvps.org/winhelp2002/unwanted.htm and also Browser
Hijacking
http://www.spywareinfo.com/articles/hijacked/
--?
Mike Maltby
mcmaltby@hotmail.com
Angry <anonymous@discussions.microsoft.com> wrote:
> Ok, here is a new issue for me, but by far the most
> frustrating. I have run all 3 of my virus programs, all
> say I'm clean, yet when I go launch my home page (yahoo),
> it loads for a second, then switches to "about:blank"
> (some search page virus). What's worse, is when I go to
> MSN to check my Hotmail, it will let me sign in, see that
> I have 12 messages there, then quick flash to
> that "about:blank". I have not been able to get my email
> in days, nor will it let me get to any "Help" or "Contact
> us" pages at either MSN or Yahoo. I continually edit the
> information in the registry to remove any mention
> of "about:blank", yet even with system restore off, it
> does not save may changes. Any help offered would be very
> appreciated, I am so ready to give up and just toss this
> thing out the window.