about:blank and pop up problems

Question

I am running Dell XPR 400 upgraded to 1Ghz, WIN 98 SE with the latest Norton Anti virus and Personal firewall activated.  I was surfing the internet and my screen froze and I had to reboot.  Now my home page has been changed to the address 'about:blank' and I'm geting a bunch of pop up ads.  I set Yahoo as my default but I can't change the default from 'about:blank'.  I have SpyBot search and Destroy and Lavasoft Adware and ran them both.  Spyware found nothing but Adware did find some stuff that I deleted.  However, my problem remains-- home page reset and pop ups.   Why didn't Personal Firewall find it?  Anty thoughts on how to fix?   Thanks, Dave K.

ky331 · Answer

the (outgoing) firewall simply keeps tracks of which programs (such as Internet Explorer) you permit to access the internet.... the firewall itself does not scan for malware (viruses/trojans/worms/adware/spyware).

your norton anti-virus should offer you resident ("passive") protection against viruses/worms/trojans.

however, both spybot & ad-aware, in their most basic forms, offer "active" scans, when actually run, after the fact. that is to say, they don't (by default) offer real-time ("passive") protection/prevention, and so spyware/adware can get through and infect your system.

spybot has an option, called Tea-Timer, which, if enabled, can offer you real-time "passive" protection. i believe the free version of ad-aware does not have such an option --- but that the paid version does.

hope that explains how the problem "got thru your firewall".

***************

here's what i suggest you try. (no guarantee this will fix your problem(s), but it shouldn't hurt anything by trying)

download CWShredder 2.14 from http://majorgeeks.com/download3019.html

let it scan your system, and fix anything that it finds.

(if that doesn't help, we can take the HiJackThis approach next... but let's try the simpler approach first).

****************

on the matter of popups:

Are you running a popup blocker?

there are several free popup blocker programs available, including the following:

1) Yahoo Toolbar offers a popup blocker

http://toolbar.yahoo.com/ie?.cpdl=iy

I believe other Toolbars (perhaps Google) also offer popup blockers... you can do the research.

2) 12Ghosts popup killer

http://12ghosts.com/ghosts/popup.htm

note: this is a free popup blocker... you do NOT have to buy their entire suite.

You don't need both of these; any one should work.

Message Edited by ky331 on 05-06-2005 10:03 AM

ky331 · Answer

Dave,

as best as i understand it, about:blank is spyware/adware related (rather than virus related). on that basis, i don't believe that running the (suggested) anti-virus scanners (symantec and eTrust) would solve this particular about:blank problem. on the other hand, they certainly couldn't hurt matters any... and moreover, since there's always the possibility that you have other (yet to be found) infections, they might indeed find SOME viruses/worms/trojans.

as for the spyware/malware/adware suggestions, you've already indicated running ad-aware and spybot. i have little (if any) experience with the Microsoft Malicious Software Removal Tool and the Dell recommended Counter Spy Spyware scanner. again, both of these are things you could try... as i've said a few times already, neither should make things any worse.

about:blank is a well-known, very specific problem. and i'm confident that the HijackThis forum WILL be able to help you out and fix things. if you wish, you can proceed directly there... i'll give you explicit instructions momentarily...

two tools that often help with about:Blank are CWShredder, which is why i had suggested that one.... another potential tool here is about:Buster (which i was holding off on). the point being, that if either of these tools can solve your problem, it's much simpler than going thru HiJackThis analysis. so i think at least CWShredder (and perhaps Buster) are worth trying first.

but since you've asked (and especially if the above don't work), then you should download the latest version of HJT(hijackthis) (version 1.99.1) from

http://majorgeeks.com/download3155.html

you must create a separate folder and place it there.... people commonly use C:\HJT. Note: do *NOT* use a TEMP folder, nor a DESKTOP folder, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use a DESKTOP folder.

The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer).

After Unzipping, double click on HiJackThis.EXE

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.

Hopefully, one of the HJT experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.

Message Edited by ky331 on 05-06-2005 11:29 AM

Dave Kitch · Answer

What about trying the fixes suggested by Dell above in the "I think my system is infected, what do I do...... before posting to the High Jack forum? Is it worth a try?

about blank has now taken over my desk top when I boot up!

Regards,

Dave Kitch

ky331 · Answer

also, you said: 'I am getting what appears to be a Microsoft pop up window saying that Windows detects a security breach in my system and wants to know if I want it to take action.' if there's any chance it's a phony/forgery, then no, that may just make matters worse.  the HJT experts may know more about this one as well.

ky331 · Answer

Dave,   unfortunately, there is more than one type of about:blank infection.  one version a variation of CoolWebSearch... in which case CWShredder may be able to handle it.  often, a symptom will be the computer accessing Home Search Assistant... in which case About:Buster may be able to handle it.  these are two versions/programs that i've seen many people experience/use, which is why i suggested them.   *IF* they work, it will be a very simple fix.   but about:blank can be rather tricky... there are many web-sites that talk about other/additional removal tools (or long manual procedures).   HiJackThis is, in many senses, the 'ultimate' tool, in that it 'digs deeply' into your computer, and tends to find things that are 'hidden' from other/simpler removal tools.   the bottom line here is, i can't say, definitively, that either CWS or Buster will fix the problem in your case.   (they MIGHT, but then again, they may not).   i'm repeating myself here.... i feel you have nothing to lose by trying.   but even if they appear to work, you should still go on to generate and post an HJT log, because there may still be other forms of malware lurking in your system.   so at this point, the choice is yours:   run cws (and perhaps buster) if you choose... in any event, go post your log.   there's really nothing more i can say here.   (by the way, be advised that if you choose to run Buster, it will change your home/search pages to Google.com ... which really isn't a problem, since your current page is an 'unchangable' about:blank.   you should be able to change it afterwards, from google to whatever you really want)

Dave Kitch · Answer

Ky,

The problems that I am now experiencing include the default web page now is about:blank and can't be changed, numerous pop up ads when running on the web and my boot up desktop page is the about:blank home page. Are these all related to about:blank?

Secondly, I am getting what appears to be a Microsoft pop up window saying that Windows detects a security breach in my system and wants to know if I want it to take action. I've canceled out of this and not started the action. Should I accept this the next time that I get this popup?

Non of this ocurred before I had the crash reproted earlier.

Regards,

Dave K.

Virus & Spyware

about:blank and pop up problems

Was this post helpful?