Still can't get rid of this Browser Jacker

[TexasDux]

As soon as Ad-Aware cleans it, SpyGuard immediately(as fast as I clicked clean on Ad-Aware) sends me a message an attempt is being made to change my homepage..... and its right back again.

Bill, Jeff,


Got anymore ideas?

[bill]

about.blank is a strain of coolweb and should be removed using this.
http://www.spywareinfo.com/~merijn/downloads.html

If not you will have to do a manual removal of the hidden .dll's

The following page at ComputerCops gives details and the programs needed with all links.
http://www.securiteam.com/securityreviews/5RP0L0UD5U.html

[ShadMan]

About.blank is not any kind of Ad-ware. It just means you don't have a homepage set. Do these two things and it should correct it.

1.) Under Tools-Internet Options-Advanced, uncheck "Enable third party browser extensions". This will require you to restart your machine. When it boots back up, verify that the setting has remained unchecked.

2.) Under Tools-Internet Options-General, set a valid homepage (ie.e http://www.yahoo.com) and click OK. Click the "Home" button a couple times to make sure it changed properly.

Then reboot again. Let me know if this continues to happen.

[bill]

read some of the stories. True, it is not ad ware but it is the default setting for IE. If you reset your homepage and it still changes you are hijacked. I have never seen a computer that had its homepage changed to about.blank or msn.com not be infected with a strain of coolwebsearch. This just might be a first.

[ShadMan]

It sounds to me like MSN toolbar is on the machine, changing the homepage, which is why I said to disable third party browser extensions...that kills any toolbars running in IE.

[Topcat]

Check out this page:
http://www.lavasoftsupport.com/index.php?showtopic=27767

I have my IE and Mozilla set to open with blank pages. In IE that results in "about:blank" in the Address block when the program opens. AdAware WILL squawk about this. That page I listed above mentions this.

Quit using IE. It's not safe. Try one of the other browsers. I like Mozilla the best! :D

[ShadMan]

Yep, TopCat found a good link explaining it. I couldn't find one to post up, but basically it just means that you don't have a homepage set. Follow my instructions above and it should correct the issue.

[bill]

O14 - IERESET.INF: START_PAGE_URL=http://us8l.hpwis.com

You should remove these:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)