After reading the posts about 'about:blank' I am so confused.

  • Thread starter Thread starter Dave
  • Start date Start date
D

Dave

I have apparently been infected with the 'about:blank' virus.

After reading the posts here I am more confused than when I started.

One post referenced this site which seems authoritative:
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

But then another post talks about the "demise of the CWShredder" which is
recommended as a solution on the above site.

Can anyone explain to me what I should do in clear and certain terms?
 
Hi Dave -

The About:blank (trojan; not a virus) *is* managed and removed by
CWShredder, and is a specific item that is a CWS item which is listed. As
far as the demise of CWShredder, that isn't precisely true. What Merijn has
stated is that there will probably be no further updates (beyond ver.1.59.1
I am assuming) as the new variants are becoming increasingly difficult to
"get a handle on".

Read here:
http://209.133.47.200/~merijn/index.html

<paste>
Q. When will CWShredder be updated again?
A. It won't be again, probably. I have a few bugs to fix, but after that
there's not much left to do - I simply do not have the tools to remove the
latest variants, they are too agressive or complicated to allow automated
removal by CWShredder.
<paste/>

Note here at the top of the image the "About:blank"
http://img7.imageshack.us/img7/4912/cwshredderaboutblank.jpg

It will no doubt continue to be effective against those items listed, should
these Trojans continue to be used. As for new Variants...well..., you read
what the man said. :-|

HTH-
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
 
You might be referring to my post to inform MVPs of a tool called BOClean
which seemed to do what everything else failed to do for a friend of mine
who is not the sort of person to be defeated by one of these things, even to
the extent of removing it manually.

Unfortunately it's not a free program and there's no trial version (but
there is a trustworthy refund policy) and so I addressed my comments and his
comments primarily to the MVPs here rather than be accused of "Spamming" the
group.

The free tools are good, very good, but it seems the perpetrators are
getting nastier and so there must be a limit as to how far "Free" can go, as
Merijn explained the situation is worsening as you can see by simply looking
through posts here.

Adaware gets some things, Spybot gets some Adaware misses and many of the
same things and CWShredder gets most versions currently used of one
particular nasty, perhaps I should have said future demise or "Lack of
future development" instead eh?

Anyway, I would always suggest working through the free ones first because
BOClean is a trojan detector, not specifically a spyware detector and you
will probably find at this time that the free ones will work. As of now that
page is still perfectly valid.

Charlie
 
Thanks guys.

I followed the instructions at
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch and basiaclly did the
following to remove the about:"blank virus:"

Ran CWShredder
Ran HijackThis
Ran Spybot 1.3

"about:blank" is now gone. However, subsequently when I run a scan under
Spybot, I get a report of malicious files:

DSO Exploit: Data source object exploit (Registry change, nothing done)

I run the fix under Spybot but when I scan again the files are still there.

Does anyone know what these files are?
 
I spoke too soon.

The "about:blank" has returned as my default home page and when I load my
browser for the first time I get a master search page with links to all
known human vices followed directly by a popup of cartoon viruses
copulating.

All that work trying to eradicate this virus with absolutely no effect. I
feel like the Simpson's character McBain in the "Radioactive Man" episode
where he exclaims: "Za goggles, zey do nothing!:

Will Norton anti-virus help at all with this?
 
NAV fix a DSO exploit? Not likely as that isn't it's province, BUT, I don't
use NAV so cannot say for sure. I've seen that DSO exploit before in Spybot
and it normally was able to fix it. If for some reason it cannot, try this:

Have "Search & Destroy" look for problems the usual way, then:
(1) highlight (by single left click) one of the "Data source object exploit"
items,
(2) Right click the highlighted item to bring up the menu list and select
"More details"
(3) Click "Jump to location"
(4) You should now be viewing the Registry and can use the path shown in the
Search & Destroy window to get to the key shown.

Export the Keys, and then Delete them in the registry. That should do the
trick.

If all else fails, try Spybot scan in Safe-Mode. Note: your Desktop icons
will probably change positions, so take a screenshot (if you don't have a
program which restores their locations) of where they are so you can
relocate them after you are finished.
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------

Dave said:
Thanks guys.

I followed the instructions at
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch and basically did the
following to remove the about:"blank virus:"

Ran CWShredder
Ran HijackThis
Ran Spybot 1.3

"about:blank" is now gone. However, subsequently when I run a scan under
Spybot, I get a report of malicious files:

DSO Exploit: Data source object exploit (Registry change, nothing done)

I run the fix under Spybot but when I scan again the files are still there.

Does anyone know what these files are?
Click to expand...
<snipped...>
 
OK then, here is a post from Jim Byrd - MVP dealing with this About:Blank
nuisance, copied and pasted (thanks Jim) Apply the fixes only as far as they
will apply to your particular instance. I agree with Jim Byrd in that using
a spyware removal fix from the actual spyware installer is a questionable
practice with a degree of inherent spookiness built in, if you know what I
mean. The Fox and the Hen-House routine, as it were.

Jims Post:
<paste>
You can try this AT YOUR OWN RISK. I normally wouldn't advise
using a malware provider's uninstall, but this particular approach has been
reported to work. Paste the following IP into your browser:

195.190.118.131

On the screen you arrive at, you see a "Search For" window, and below it a
red "Uninstall Software". Download their uninstaller, uninstall.exe. At
this point I would either use TotalUninstall or make a complete backup of my
system for safety's sake. Total Uninstall,
<http://www.geocities.com/ggmartau/tu.html> or direct dwnld here:
<http://files.webattack.com/localdl834/tun234.zip>


Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

<http://www.cexx.org/lspfix.htm>
<http://www.spychecker.com/program/winsockxpfix.html> (if your OS is Win2k
or
XP) The process of removing certain malware may kill your internet
connection. If this should occur, this program, LSPFIX, will enable you to
regain your connection

Run this uninstall program program that you downloaded from the malware
site, then UPDATE them and go to Safe mode to run UPDATED versions
CWShredder, AdAware and SpyBot per the following directions:

Note that this symptom often indicates the possibility of other malware.
You might want go to this page at Jim Eshelman's site, here:
<http://aumha.org/a/noads.htm> or here:
<http://inetexplorer.mvps.org/parasite.htm> and wait a little bit (be
patient), while an analysis of a number of possible parasites on your
machine will be made to help you identify and remove them. NOTE: You will
need to disable Ad Blocking in Zone Alarm 3.x, if present or any other Ad
Blocking software which interferes with Java Scripting for this scan to
work. You should get a message between the two lines of **** giving the
results of the scan.

All of these removal tools should be run from Safe mode when possible

For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here: <http://www.lavasoftusa.com/support/download/>.
UPDATE and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: <http://security.kolla.de/> SpyBot Support Forum here:
<http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi>. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.


Note that sometimes you need to make a judgment call about what these
programs report as spyware. See here, for example:
<http://www.imilly.com/alexa.htm>


A currently common parasite is some malware called CoolWebSearch. Do the
following:

Download, UPDATE before running, and run:
<http://209.133.47.200/~merijn/files/CWShredder.exe> to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: <http://www.zerosrealm.com/downloads/CWShredder.zip>

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:

HOW TO Restart in Safe Mode

HOW TO Enable Hidden Files
HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
(WinXP)
(WinME)

Then download and run:
<http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg> to restore your
tabs and remove any restrictions that the parasite has put in place.
<paste/>
END ~~~~~~~~~~~~~~~~~~~~~~~~~ END
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------
 
Thanks LuckyStrike

I got rid of the DSO Exploit by going into safemode and then Spybot gave me
an "all clear."


However, when I reboot and launch ie6, it loads to "about blank" and I get
the same master search page with links to sleasy sites as before. And I
cannot set a new homepage.

Here is the message I get now when I run Spybot S&D:

Error during check!: Common hijacker (Datei
C:\WINNT\system32\drivers\etc\hosts kann nicht geöffnet werden. The process
cannot access the file because it is being used by another process) ()

Congratulations!: No immediate threats were found. ()

--- Spybot - Search && Destroy version: 1.3 ---
2004-06-16 Includes\Cookies.sbi
2004-06-16 Includes\Dialer.sbi
2004-06-17 Includes\Hijackers.sbi
2004-06-16 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-06-16 Includes\Malware.sbi
2004-06-16 Includes\Revision.sbi
2004-06-16 Includes\Security.sbi
2004-06-16 Includes\Spybots.sbi
2004-06-16 Includes\Tracks.uti
2004-06-16 Includes\Trojans.sbi

There is no file at the referenced path,

Hhs anyone seen this before?

Dave
 
YW. One down and what... Ten to go? <g>

Tried running the program two times? Once to disable, and the second to
clean? Sometimes as the file is in use it cannot be deleted nor written to,
as you well know.

The .sbi files are Spybot S&D Add-on Info Files located in Spybot S&D
program>Settings>File sets. Same for the .uti (usage tracking)

I have all you've listed, plus:
QA Tests.sbi (for testing detections)
Temporary.sbi (for internal testing of new stuff only)

I don't enable the usage tracking (tracks.uti)

Hope I understood you correctly.
--

LuckyStrike
(e-mail address removed)

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------
 
Back
Top