about:blank

[Richards]

I appreciate all of the help, guys! As it turns out, my wife (without having read this thread; she doesn't read EN World) took Torm's latest advice while I was at work today and is having a tech expert look at it. We should get the computer back tomorrow, or possibly not until Monday. (And in the meantime, I'm here posting at the local library.)

Seriously, though, I appreciate all of the assistance. I'll be printing out your responses to have on hand for the next time -- I'm pessimistic enough to believe that there will be a next time.

And who knows? After learning experiences like this, I might someday bear a vague resemblence to someone who might possibly be mistaken as being slightly computer savvy (well, maybe if you squint a bit).

Thanks again!

Johnathan

 

[KenM]

I'm having the same exact problem with my homepage being hijack by the same thing for that last month and half. I tryed both adaware and spybot, but its still there. I downloaded spysweeper and that at least gives me a warning when my homepage is changed, I can change it back with the warning, but I'm, still stuck with it.
I'll try the CWS shredder. I'll let you know how it goes.

 

[KenM]

I downloaded the CWS shredder. it picked stuff up but when I restarted spysweeper still had the changescoming up. I re ran the shredder with my cable modem unplugged, I deleted the files it found from the recycle bin, restarted, and it seems to worked. Thanks alot.

 

[Caspian Moon Prince]

bleepity bleep spyware

I would also recommend to anyone bazooka spyware scanner. It doesn't automatically remove the spyware, but it tells you that you have it, what type it is, and gives you a link to their site on how to remove it. Some of the things that both adaware and spybot missed, bazooka caught. If you do not have any problems with going into your registry and editing things, then bazooka is a quick download that can get rid of junk the others miss.

 

[LostSoul]

I'm having the same exact problem with my homepage being hijack by the same thing for that last month and half. I tryed both adaware and spybot, but its still there. I downloaded spysweeper and that at least gives me a warning when my homepage is changed, I can change it back with the warning, but I'm, still stuck with it.
I'll try the CWS shredder. I'll let you know how it goes.

I think - I'm not sure - but I think that usually there's a line in the registry that tells IE to set the new homepage to something else.

 

[KenM]

I'm still getting spy sweeper warnings that says it adds sites to my favorites. Also when I boot up my system after its off for a few hours, i casino webpage comes up along with my home page. There is also a shortcut added to my desktop for the casino that I delete.
I thought that was part of the other stuff, but now I don't know.

 

[Uzumaki]

I don't have the same problem, but I do have an issue with Windows Search Assistant. It just appeared one day in my taskbar. So I used 'Add/Remove Programs to get rid of it and restarted. All was well, until the next time I rebooted, and there it was again. I removed it again through 'Add/Remove Programs' then ran Ad-aware and Spybot, restarted, ran both again, and it was gone. It came back again. I checked the Net and many other people are having this problem. They have solutions like changing the registry key, but none of this is working. Damn you, Bill Gates. Hate that guy.

 

[Janx]

This will probably get long...
It's my basic process for manually cleaning a machine. When in doubt, back up the documents, and erase it and rebuild...

Otherwise, here it is:

Check Task Manager:
Control+Alt+Delete

On Win9x/winMe systems, it'll pop-up right away. On XP/win2k/win2k3, it'll be a button in the pop-up window. Pick it.

From the Task Manager, start doing a Google on any executables. SysTray and Explorer are standard windows stuff, so they're kosher. Googling the names of the other executables should teach you which ones are evil pretty quickly.

Make a list on paper of the evil ones. Then start killing those processes.

Don't reboot yet...

You'll be finding these evil things as .DLL and .EXE files. So be on the lookout. FYI, 'rundll' is the standard thing that loads DLL files. It's not evil, but when you see lines in the registry loading mystery DLLs, look up the DLLs, not RunDLL.

Next, do a RegEdit and look for "RunOnce" using the Find function (from the Edit menu in the menubar). Once you find RunOnce, look at the key right above it for "Run" (FYI, it's easier to find RunOnce, than Run) This is where lots of crap sets up shop. Once again, Google, and make a list of the evil ones. Right click the "Run" tree and back it up (for safety). Then start killing all the evil executables. Then do a search for "RunOnce" again, to find the other set of keys (there's 2 pairs in the registry).

Don't reboot yet...

Now, take that list and do a File Search (Start button, Search...) and look up all those evil files. Once you find them, you'll likely find them in odd directories of programs you didn't think you had. Or you'll find them in the Windows, Windows\System or Windows\System32 directory. Go delete the evil files or the directories to get the whole evil app. (NOTE: Do not be stupid and delete the Windows directory, etc...)

Don't reboot yet....

Last thing to hunt down is those pesky DLLs which are more invisible. They usually get launched via 'RunDLL' so you'll want to repeat the same set of hunting directions for the DLLs and EXEs.

Since you have a specific case of hunting down 'about_:blank' you've got a clue of what to find. When in doubt google for that specific string or if you've got an evil toolbar (there are a few) that won't die, google for the name of that toolbar that keeps showing up (check View/Toolbars to see the name, perhaps). Once you find it in Google, you should see a clue to what the files are. Do a file search and registry search for those files or directory and you should get lucky. That'll let you delete the file and registry instances.

It's tedious work, but I have used those steps to clean systems manually. When in doubt look stuff up in Google. And get a Google ToolBar (comes with Pop-Up blocker). And don't listen to pop-ups telling you to fix your PC. If your computer was really screwed up, it wouldn't be able to tell you...

Sometimes it is just easier to back up the data (over the wire is easiest) and then nuke and rebuild the box

Janx