RE: Internet Explorer has been hijacked by "About:Blank"

From: billie (billie_at_discussions.microsoft.com)
Date: 10/11/04


Date: Sun, 10 Oct 2004 22:19:01 -0700

rocketmann007, I am going to try this, for I have been infected with about
blank, in the past few days. I have earthlink total access, which has pop
up blocker on it, but after I started getting about blank, My pop up blocker
has disappeared. I have spent several hours with earthlink by email, chat,
phone trying to get my pop up blocker back. Nothing worked. I am able to get
onto my home page by keep changing back to my default page in internet
options. Now I can not do my computer task any longer, like scan files,
defrageting. Is this because of about blank do you think. I can across this
site by chance, I was trying to find info. about ...about:blank since
earthlink was no help and virus scan showed no virus. Has anyone else lost
their popup blocker program due to this. also does any one know how I got it,
the only thing I can think of is my son downloaded asolute poker from the
internet and play pocker on the internet. I want to uninstall it, even with
his objections, for he does not feel this causes the problem. Thank for any
help to my questions. Billie Ann

"rocketmann007" wrote:

> I tried all the above to remove this culprit but nothing worked. I've used
> adaware, spybot, pestpatrol..they did not prevent this culprit from
> reinstalling upon rebooting. I also searched for about:blank in my registry
> and deleted all references to it. I also searched for coolwebsearch in my
> registry and deleted what I found. Upon reboot, all the previously mentioned
> hijackers returned to the registry. I also went into the advanced properties
> of my internet explorer and changed the setting to disable 3rd party browser
> plug-ins. That didn't help. I also went into my security settings and under
> the restricted sites list, I added coolwebsearch.com and cool-web-search.com
> and then searched the registry again and found everything again so I deleted
> everything pertaining to this culprit again and then restarted and everything
> returned as usual.
>
> I also ran norton's 2004 antivirus and upon updating my virus definitions
> and turning off system restore, I found that norton did not find anything
> too.
>
> BUT....I then decided to run a program from McAfee called Stinger to see if
> it would find anything and it found a virus called w32.backdoor.cfb and it
> was removed. Norton did not find this virus but McAfee did. I rebooted
> again and searched the registry and found nothing..no traces of the culprit.
>
> You can find the Stinger from McAfee here:
>
> http://vil.nai.com/vil/averttools.asp
>
>
>
>
> "a1_andy" wrote:
>
> > I'm waiting on microsoft to get back to me on this. I know how to fix it and
> > i know how to prevent it for the future. hope fully they respond soon. It
> > took me 5 comps with all difernt microsoft os's and a week's worth of spare
> > time to figger it out. but i cracked its code! and its the toughest i've ever
> > seen to date and not easly removed due to its "random" filename generator
> > but it is removable.
> > Its a cross betwean a virus/spyware/adware/hijacking



Relevant Pages

  • Re: can not use system restore
    ... A new install of Windows XP is one option. ... fixed so we can now get into the registry but we are still having ... The virus is still there. ... When we try to use the internet it sometimes redirect our pages. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: can not use system restore
    ... Is this a commercial or home computer? ... can now get into the registry but we are still having problems. ... virus is still there. ... When we try to use the internet it sometimes redirect our pages. ...
    (microsoft.public.windowsxp.perform_maintain)
  • RE: can not use system restore
    ... can now get into the registry but we are still having problems. ... virus is still there. ... When we try to use the internet it sometimes redirect our pages. ... We then turned off system restore because I read that it will keep ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: MAKING YOUR COMPUTER SYSTEM SECURE AFTER IT’S BEEN COMPROMISED
    ... Jesus Debbie, have you never heard of Ghost? ... >malicious activity always virus check your CD-ROM. ... Virus check your CD-ROM with what? ... Then Select Registry, Export Registry File ...
    (alt.computer.security)
  • Re: MAKING YOUR COMPUTER SYSTEM SECURE AFTER IT’S BEEN COMPROMISED
    ... Jesus Debbie, have you never heard of Ghost? ... >malicious activity always virus check your CD-ROM. ... Virus check your CD-ROM with what? ... Then Select Registry, Export Registry File ...
    (microsoft.public.security)