Re: about:blank page - where is this setting?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Jan Il (abuse_at_localhost.com)
Date: 07/09/04 

Date: Thu, 8 Jul 2004 20:36:03 -0700

Hi jmev7 :-)

You obviously have the newest and nastiest variant of this virus, so here is
the just recently (2 dyas ago) updated information on how to clean Mr.
MeanJeans. It replicates itself, that is why it is coming back after the
reboot.

Follow the instructions below carefully.

This is a newer variant of about: blank. Methods that previously
removed it may not have any effect on it

IMPORTANT!!
RUN ALL PROGRAMS OFF LINE IN SAFE MODE AND SHOW HIDDEN
FILES. THEN REBOOT AND RUN THEM AGAIN TO BE SURE ALL FILES
ARE ACCESSED, DELETING ALL ITEMS DISPLAYED IN RED IN SPYBOT

about:blank
http://www.atribune.org/downloads/AboutBuster.zip
or
http://tools.zerosrealm.com/AboutBuster.zip

res://C:\WINDOWS\<random name>.dll/sp.html#<random number>
http://www.hsremove.com/

HiJackThis:

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT install in your Desktop folder.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

Go to:
http://computercops.biz/downloads-cat-14.html ,
or
http://www.aumha.org/a/parasite.php#hjt
(If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip)

and download HiJackThis to the new folder. Unzip to a folder other than your
Desktop or the Temp folder, doubleclick HiJackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button. Press that, save the log some place you remember where it is.
Most of what it lists will be harmless or even required, so DO NOT fix
anything yet.

Open the copy of your log in NotePad and make a copy. Then you can go to one
of the following to post your log:

<<PLEASE DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?s=d3c2c886d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here:
http://forums.tomcoyote.org/index.php?act=idx

You will need to register to open a new thread to post you log. It is free,
and no one will Spam you, it is one of many that provides this service. Once
registered, go to the HiJackThis section on the forum list and click to
open. Then start a new post and post your log. The experts there will
analyze the log and report back the results. Please allow at least a few
hours or a days time for a response, depending on when you post the log

Remember, you must return to the HJT site to get your answer. It is a good
idea to click the "Notify" box so that you will get an electronic
notification by e-mail to let you know when a response has been posted.
But, you must still return to the site of your answer

HJT Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Hope this helps.

Jan :)

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 <jmev7@yahoo.com> wrote in message
news:c72a6456.0407071240.4e0df84d@posting.google.com...
> Thanks for all the great links. I've tried PestPatrol & Ad-aware, and
> even CWShredder, but the coolweb thing just comes back after a reboot.
> I noticed that CWShredder hasn't been updated since April on their
> site. I hope they're going to keep up the great work.
>
> I also tried installing SpywareBlaster, but it won't run. It gives me
> the following message:
>
> "THE PROGRAM HAS BEEN DAMAGED, POSSIBLY BY A BAD SECTOR OF THE HARD
> DRIVE OR A VIRUS. PLEASE REINSTALL IT."
>
> I tried reinstalling, but no dice. Next step is to hack the registry,
> but I'm not sure what to look for.
>
> As for the coolweb thing coming back, I wonder if anything is in my
> Internet Options|Content|Publishers list that needs to be removed???
>
> I will try downloading HijackThis, though I'm losing so much time on
> this, I may just have this sytem re-imaged (and lose all my nice
> layout/settings/mp3 files/etc).
>
> If you have an idea why my Spywareblaster doesn't start, I'd love to
> hear it.
>
> Thanks again.
>
>
> "Jan Il" <abuse@localhost.com> wrote in message
news:<e$zaTeFYEHA.716@TK2MSFTNGP11.phx.gbl>...
> > Hi jmev7 :-)
> >
> > > I am trying to trace where in the windows registry is the
> > > "about:blank" page set. Mine appears to be hijacked, and I can't get
> > > any of the spyware apps to make any difference.
> > >
> >
> > It is likely you have parasites, spyware, adware, malware, or hijackware
on
> > your system causing the problem, which your antivirus will not detect,
as it
> > does not have the same definitions.
> >
> > (Unexplained computer behavior may be caused by deceptive software
> > http://support.microsoft.com/default.aspx?kbid=827315)
> >
> > Download and install, then you *MUST* update the programs prior to
running
> > to be sure they have the latest definitions, then run the programs
below.
> > They are free and very effective. Be sure to run both SpyBot and
Adaware,
> > as what one does not detect the other may. It is important that you do
all
> > the steps and follow all directions carefully:
> >
> > IMPORTANT:
> > Before trying to remove spyware using the programs below, download a
copy of
> > LSPFIX from the URL below - some malware may kill your internet
connection
> > when it is removed, this program will enable you to regain your
connection.
> > http://www.cexx.org/lspfix.htm
> >
> > It is important that you run the programs in the order that they are
listed
> > here. The first three programs will clear your machine of all other
items so
> > that you can have a clear HiJackThis Log for the experts to read and
analyze
> > for you.
> >
> > CWShredder: Free
> > http://tinyurl.com/2l9kl
> >
> > SpyBot Search & Destroy: Free
> > http://download.com.com/3000-8022-10289035.html?tag=lst-0-2
> >
> > AdAware: Free
> > http://www.lavasoftusa.com/support/download/
> >
> > HiJackThis: - Free
> >
> > Go to
> > http://computercops.biz/downloads-cat-14.html ,
> > or
> > http://www.aumha.org/a/parasite.php#hjt
> > and download HiJackThis. Unzip to a folder other than your Desktop or
the
> > Temp folder, doubleclick HiJackThis.exe, and hit "Scan".
> >
> > When the scan is finished, the "Scan" button will change into a "Save
Log"
> > button. Press that, save the log some place you remember where it is.
> > Most of what it lists will be harmless or even required, so DO NOT fix
> > anything yet.
> >
> > Open the copy of your log in NotePad and make a copy. Then you can go
here
> > to post you log:
> >
> > Jim Eshelman's site here:
> > AumHa Forums - HiJackThis section:
> > http://forum.aumha.org/
> >
> > Spyware and Hijackware Removal Support, here:
> > http://216.180.233.162/~swicom/forums/
> >
> > or Net-Integration here:
> >
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?s=d3c2c886d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949
> >
> > or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
> >
> > <<DO NOT POST YOUR LOG FILE TO THIS NEWSGROUP>>
> >
> > You will need to register to open a new thread to post you log. It is
free,
> > and no one will Spam you, it is one of many that provides this service.
Once
> > registered, go to the HiJackThis section on the forum list and click to
> > open. Then start a new post and post your log. The experts there will
> > analyze the log and report back the results. Please allow at least a
few
> > hours or a days time for a response, depending on when you post the log
> >
> > Remember, you must return to the HJT site to get your answer. It is a
good
> > idea to click the "Notify" box so that you will get an electronic
> > notification by e-mail to let you know when a response has been posted.
> > But, you must still return to the site of your answer
> >
> > HJT Tutorial
> > http://www.bleepingcomputer.com/forums/index.php?showtutorial=42
> >
> >
> > Hope this helps.
> >
> > Jan :)
> >
> > Smiles are meant to be shared,
> > that's why they're so contagious.
> >
> > Please reply to the newsgroup so others may benefit.

Quantcast