CWS.Aboutblank
Variant 35: CWS.Aboutblank
Approx date first sighted: March 2, 2004
Log reference: Reconstruction
Symptoms: IE pages changed to about-blank.ws and 213.159.118.226
(1-se.com), hijack returning on system restart
Cleverness: 5/10
Manual removal difficulty: Involves some Registry editing and deleting a
randomly named file
This variant does everything in its powers to redirect you to a domain
owned by 1-se.com. IE is hijacked to it, the hosts file is replaced to redirect
about 100 porn and CWS domains to 1-se.com, and a randomly named stylesheet is
dropped that redirects to 1-se.com when certain keywords appear in
webpages.Restoring the IE pages by searching the Registry for about-blank.ws,
removing the hosts file, the svchost.exe file in the Windows directory (the one
in the System32 folder is legit) and the randomly named stylesheet (1079 or 1087
bytes in size) fixed this.
Download CWShredder here:
http://cwshredder.net/cwshredder/cwschronicles.html