PDA

View Full Version : IE About:blank homepage hijacked ?



Woof
21-04-2004, 09:35 AM
I have chosen for my IE 6.1 homepage "about:blank" but suddenly last night I noticed that instead of a blank page I now get a listing of links, some kind of directory BUT the address bar stayes "about:blank"

I have tried repairing IE6 as well as the obvious resetting of the homepage under "Tools/Internet options" to no avail

I bet I'm not the first to ask so can someone post a link to any previous thread

Cheers
Woof

Jim B
21-04-2004, 09:58 AM
Download and run these two programs to remove spyware.
If you are still having a problem post back as some spyware requires specific programs to remove them.

http://www.lavasoftusa.com/software/adaware/

http://www.safer-networking.org/

Pheonix
21-04-2004, 10:11 AM
Also, run CWShredder in case it is a variation of CoolWeb hijacker. Use this in conjunction with adaware and Spybot that JimB has given you. You can get CWShredder from here (http://www.majorgeeks.com/downloadget.php?id=4086&file=3&evp=6742c4ccda2599a3d6c5901960cc6e24)

Woof
21-04-2004, 10:15 AM
Thanks for the reminder - AdAware didn't fix this issue (but picked up 4 others !!!)

I'm at the office now and have printed out the FAQ #8b and from quickly reading that I think I need to dig into nsconfig or (worse) registry

Might be time to ensure full backups and look at reformatting - at least I NOW have separate partitions for data and other so reformatting and reloading Windows (ME) etc should be a bit easier than in the past ...

Woof
21-04-2004, 10:16 AM
Also I seem to recall something about javascript - does this prompt anything more specific .....

Jim B
21-04-2004, 10:20 AM
If you advise the site you are being directed to it may help narrow down the type of spyware involved and there may be specific removal instructions available for it.

Woof
21-04-2004, 02:30 PM
to Jim B

The address bar stays "about:blank" and I haven't let it 'go' anywhere yet - I have disconnected immediately and otherwise just fired up my homepage withOUT logging on to the 'net.

Maybe I should let it connect and see if that reveals more identifiction...

Slightly off-topic but how do I "cut'n'paste" the conetent or whatever so as to post a sample of it here on PressF1

metla
21-04-2004, 02:34 PM
press your printscreen button,then open up Paint,open>new document>paste,then save to the desktop.

You will now have a snapshot of the homepage,you can then upload it to the press f1 picture viewer whatever site

Woof
21-04-2004, 10:37 PM
to metla

Here is a link to a snapshot :-
url=[http://sal.neoburn.net/imagef1/files/aboutblank.jpg]

Hope this helps

tweak\'e
21-04-2004, 10:44 PM
if adaware or spybot don't help then try hijackthis. if in doubt post the hijackthis log. read the instructions first !

hijackthis download (http://www.majorgeeks.com/download3155.html)

metla
21-04-2004, 10:55 PM
By any chance does that page apear when you start the browser without being online?

Woof
21-04-2004, 11:32 PM
to metla

In a word = ALWAYS

and with the pop-up warning "Scripts are usually safe. Do you want to allow scripts tp run ?" because of my security settings in IE

Fire-and-Ice
21-04-2004, 11:37 PM
Do what Pheonix suggested and run CWShredder.

Pheonix
21-04-2004, 11:59 PM
After you download and unzip cwshredder, use the FIX button. Then use the Scan button to check it got it.

Woof
22-04-2004, 09:36 AM
Done

Originally running AdAware did NOT clear the problem but last night I updated AdAware and ran again with success, it seems

Just shows the value of keeping security programs up to date as well as running them.

Building upon this my next project will be to thoroughly test ZoneAlarm for various ports being open and to double check ALL settings in Zone Alarm and to REcheck all security settings in Internet Explorer

Thanks everyone and to the authors of the FAQs and for the other product 'tips' which I shall also be checking

Oxie
22-04-2004, 10:31 AM
Woof

Now that you have solved your problem you might like to take a look here (http://hacker-eliminator.com/safebrowsing) and configure IE differently.

Oxie (Lyn)

mark c
22-04-2004, 11:09 AM
If you have installed Spybot S & D you can open it up and under tools I think it is you can "lock homepage". That is you can specify what homepage to have in IE and stop others taking it over.

Well, at least make more of an obstacle. HTH :)