about:blank virus

How to start computer in safe mode

You Have A Variant of the CoolWebSearch Trojan.

Please Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

reboot computer and post a new log

I hate 20 Questions

Team Colleague

13,066 posts since Aug 2003

Reputation Points: 1,064

Solved Threads: 812

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.

I hate 20 Questions

Team Colleague

13,066 posts since Aug 2003

Reputation Points: 1,064

Solved Threads: 812

I have same problem. Nothing gets rid of it. The only difference between what I've tried and what you said is running in safe mode. I'll give it a shot.

Phaelax

Practically a Posting Shark

858 posts since Mar 2004

Reputation Points: 92

Solved Threads: 51

Any results?

iris_eye

Newbie Poster

9 posts since May 2004

Reputation Points: 10

Solved Threads: 2

I have same problem. Nothing gets rid of it. The only difference between what I've tried and what you said is running in safe mode. I'll give it a shot.

Phaelax,

If you need to repost, please start your own thread insteAd of continuing here. To keep threads clear and concise, we ask that members abide by our policy of "one member, one problem" per thread.

Thanks :)

DMR

Wombat At Large

Team Colleague

7,229 posts since Dec 2003

Reputation Points: 221

Solved Threads: 370

Go to this blog and read the post of April 21, 2004

http://bubdaddy.blogspot.com/

I had the exact problem you're describing and I used Ghost Surf, and then checked it with Ad-aware, which I update daily. I have deleted all of the other free programs.
I don't have any problems anymore.

Seaward

Newbie Poster

3 posts since May 2004

Reputation Points: 10

Solved Threads: 1

sry. Didn't think much of it considering it was the same problem. But anyway, running the fixes in safe-mode did the trick. case closed.

Phaelax

Practically a Posting Shark

858 posts since Mar 2004

Reputation Points: 92

Solved Threads: 51

sry. Didn't think much of it considering it was the same problem.

No problem- it just makes it easier (and faster) for us to get to the bottom of a given member's problem if he/she starts their own thread, and that thread remains dedicated to their problem alone. In others words, that approach helps us all. :)But anyway, running the fixes in safe-mode did the trick. case closed. Very cool- glad we could help you get it sorted.

DMR

Wombat At Large

Team Colleague

7,229 posts since Dec 2003

Reputation Points: 221

Solved Threads: 370

sry. Didn't think much of it considering it was the same problem. But anyway, running the fixes in safe-mode did the trick. case closed.

Don't count you chickens ! It can return ,and don't forget to run you windows updates .

I hate 20 Questions

Team Colleague

13,066 posts since Aug 2003

Reputation Points: 1,064

Solved Threads: 812

i have had this virus for about a month and i just did everything the messages instructed...it said to post the log that i got from hijackthis...so i guess i can post it here..I am new to all this so any help i recieve would be greatly appreciated. When exactly will the about:blank thing go away? Is it gone now or do I still need to do more?

Thanks,
RSuave427

Logfile of HijackThis v1.97.7
Scan saved at 1:13:26 AM, on 5/31/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\svchosd.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://yellow-pages.ws/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
F0 - system.ini: Shell=Explorer.exe svchosd.exe
F1 - win.ini: run=C:\WINDOWS\system32\services\wmplayer.exe
F2 - REG:system.ini: Shell=Explorer.exe svchosd.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [win32.exe] C:\WINDOWS\win32.exe
O4 - HKLM\..\Run: [mswspl] C:\WINDOWS\sb.exe
O4 - HKLM\..\Run: [Aplune Service] svchosd.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.flingstone.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

rsuave427

Newbie Poster

6 posts since May 2004

Reputation Points: 10

Solved Threads: 0

Hey rsuave427

you should not post a new problem on this thread. create your own. As DMR said (If you need to repost, please start your own thread instead of continuing here. To keep threads clear and concise, we ask that members abide by our policy of "one member, one problem" per thread.). Also did you try CAPERJACK's instructions.

JR85023

Junior Poster in Training

86 posts since May 2004

Reputation Points: 17

Solved Threads: 6

http://daniweb.com/techtalkforums/thread5531.html

The most direct response to the about|blank hijack I've seen is in this topic:

Catweazle

Grandad

Team Colleague

4,335 posts since Mar 2004

Reputation Points: 229

Solved Threads: 149

You have more than about blank ,like this one --O4 - HKLM\..\Run: [Aplune Service] svchosd.exe.
This is why its always best to start your own thread instead of piggie backing to one like this one.
Everyones log is different!!Everyones problems are different!

Run this free online virus scan ,check off auto fix.and and then Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

I hate 20 Questions

Team Colleague

13,066 posts since Aug 2003

Reputation Points: 1,064

Solved Threads: 812

about:blank trojan removed!
(aka HomeOldSP hijacker)

I tried most adware programs to no avail.
The wicked pest kept returning.
Now I am happy to report that there is a cure:
Adware Away.
It is as easy as pie to use.
The about:blank trojan was killed in minutes.

Click "more" on Adware Away's menu.
Icons with names of various hijackers are displayed.
Click on those bothering you, and they're gone!!

In fact it also trashed
CoolWebSearch, Lycos SideSearch and IstBar -
trojans I didn't even know I had. All I can say,
"Adware Away is FANTASTIC".

www.AdwareAway.com

happyguy

Newbie Poster

4 posts since Jun 2004

Reputation Points: 10

Solved Threads: 1

Does the program actually remove them, or just disguise them?? I am trying to get more info on it. If it only prevents the running of these programs it's not much cop. You also have to pay for it.

crunchie

Most Valuable Poster

Moderator

20,095 posts since Feb 2004

Reputation Points: 1,142

Solved Threads: 985

Does the program actually remove them, or just disguise them?? I am trying to get more info on it. If it only prevents the running of these programs it's not much cop. You also have to pay for it.

Yeah crunchie. Adware Away actually zaps about:blank trojan!
They have a five day free trial. The tech support guy is great. Responded to me immediately. And even updated his fine program the same day with a suggestion of mine.

After running Scan on the first page of Adware Away, click on More. This takes you to a menu of Hijackers. Click on the about:blank icon. It is zapped instantly! The trojan, that is! (not the icon.) hehe

It was like finding the cure for cancer. This guy was so happy he paid ten bucks extra for their CD. The program even found other malware on my PC that I was ignorant of, as mentioned above.

happyguy

Newbie Poster

4 posts since Jun 2004

Reputation Points: 10

Solved Threads: 1

I was afflicted with the same virus and thanks to this message post I was able to fix it. I just wanted to say thank you very much for all your help! :mrgreen:

Dreg_02

Newbie Poster

18 posts since Jun 2004

Reputation Points: 10

Solved Threads: 0

I was afflicted with the same virus and thanks to this message post I was able to fix it. I just wanted to say thank you very much for all your help! :mrgreen:

Not related to happyguy are you?? Noticed it was you first post.

crunchie

Most Valuable Poster

Moderator

20,095 posts since Feb 2004

Reputation Points: 1,142

Solved Threads: 985