My homepage has been hijacked by About:Blank.  When I open Internet Explorer
I keep getting the About:Blank page.  When I try to go another site, I keep
getting Popups that say I have Spyware running on my computer.   I ran,
HijackThis and made a log file but when I tried to open the log file, I got
an error message saying it couldn't find Notepad to open the file.  I tried
to launch Notepad from my MS Toolbar and couldn't.  Properties shows that
the Notepad shortcut is now Targeted to C:\RECYCLER\NPROTECTED\00036536.exe.
Can't launch Notepad from the Start-Programs-Accessories either.  Target
there is:  C:\WINDOWS\system32\actmovies.exe

Both Norton AV and Spybot are running but it got through both of them.  It
also got through both the WinXP firewall and the D-Link Firewall.

I've run Spybot and Norton AV but neither detect anything.  I'm not sure if
I have two seperate problems or if About:Blank is causing both.  Any help
will be appreciated.   Thanks,  Mac

(WinXP Home SP1)

[ Post a follow-up to this message ]

AboutBlank hijacked my homepage and somehow I got the CWS SearchX at the
same time.  It screwed up my shortcuts to Notepad too.  After reading a few
posts here and elsewhere and looking at my notes from a somewhat similar
experience with ISearch, here is what I did to finally fix the problem and
got rid of AboutBlank as my homepage.  I'm not a computer tech. so I don't
know the technical aspects of the process but it worked for me.  (Note:  I'm
running WinXP Home.  I had Norton Antivirus, Spybot, WinXP Firewall and
D-link Firewall running but still got the problem).



I ran Norton AntiVirus but it didn't detect anything.

I ran Spybot but it didn't detect anything.

I ran CW Shredder and it found CWS SearchX.  I removed it.

I downloaded and ran AdAware (run the update and get the latest revision
first).  It found a slug of problems in my Folders and Registry.  I had
AdAware fix them.  (Note:  Some had to be fixed after a reboot)

I rebooted in Safe Mode and then completed the following:


Make sure you are set to Show Hidden Files and Folders and delete the
following files/folders:



Delete files/folder from the following directories (But not the directory
itself, for example delete all files/folder IN temp; but not temp itself!)


[*]C:\Windows\Temp\
[*]C:\Documents and Settings\<Your Profile>\Local Settings\Temp\
[*]C:\Documents and Settings\<All other users Profile>\Local Settings\Te
mp\
[*]C:\Documents and Settings\<Your Profile>\Local Settings\Temporary
Internet Files\ [*]C:\Documents and Settings\<All other users Profile>\L
ocal
Settings\Temporary Internet Files\
[*]Empty your "Recycle Bin"

[*]Reboot



I then ran HijackThis.  This first item on the list was an R1-HKCU that
ended in AboutBlank.  I checked the box and had HJT remove it.

I rebooted and everything was back to normal, except my shortcuts to Notepad
were still screwed up.  I right clicked on the shortcuts, selected
properties and changed the Target to:   C:\WINDOWS\NOTEPAD.EXE  and cleared
the stuff that was in the Start-In box.



My computer seems to be back to normal.  Hope this works for you.     Good
luck.  Mac



PS:  I just read a post where a guy with a similar problem was able to
resolve it by just going back to a RESTORE POINT prior to getting infected.
You may want to give that a try before doing all of the above.

[ Post a follow-up to this message ]

Do you have multiple log in in Window XP? or will I have to clean out everyo
nes profiles.  As for going to a restore point it would or couldn't retore t
o any clean point but I will give this a try myself.

"MacKenrick" wrote:

> AboutBlank hijacked my homepage and somehow I got the CWS SearchX at the
> same time.  It screwed up my shortcuts to Notepad too.  After reading a fe
w
> posts here and elsewhere and looking at my notes from a somewhat similar
> experience with ISearch, here is what I did to finally fix the problem and
> got rid of AboutBlank as my homepage.  I'm not a computer tech. so I don't
> know the technical aspects of the process but it worked for me.  (Note:  I
'm
> running WinXP Home.  I had Norton Antivirus, Spybot, WinXP Firewall and
> D-link Firewall running but still got the problem).
>
>
>
> I ran Norton AntiVirus but it didn't detect anything.
>
> I ran Spybot but it didn't detect anything.
>
> I ran CW Shredder and it found CWS SearchX.  I removed it.
>
> I downloaded and ran AdAware (run the update and get the latest revision
> first).  It found a slug of problems in my Folders and Registry.  I had
> AdAware fix them.  (Note:  Some had to be fixed after a reboot)
>
> I rebooted in Safe Mode and then completed the following:
>
>
> Make sure you are set to Show Hidden Files and Folders and delete the
> following files/folders:
>
>
>
> Delete files/folder from the following directories (But not the directory
> itself, for example delete all files/folder IN temp; but not temp itself!)
>
>
> [*]C:\Windows\Temp\
> [*]C:\Documents and Settings\<Your Profile>\Local Settings\Temp\
> [*]C:\Documents and Settings\<All other users Profile>\Local Settings\
Temp\
> [*]C:\Documents and Settings\<Your Profile>\Local Settings\Temporary
> Internet Files\ [*]C:\Documents and Settings\<All other users Profile>
\Local
> Settings\Temporary Internet Files\
> [*]Empty your "Recycle Bin"
>
> [*]Reboot
>
>
>
> I then ran HijackThis.  This first item on the list was an R1-HKCU that
> ended in AboutBlank.  I checked the box and had HJT remove it.
>
> I rebooted and everything was back to normal, except my shortcuts to Notep
ad
> were still screwed up.  I right clicked on the shortcuts, selected
> properties and changed the Target to:   C:\WINDOWS\NOTEPAD.EXE  and cleare
d
> the stuff that was in the Start-In box.
>
>
>
> My computer seems to be back to normal.  Hope this works for you.     Good
> luck.  Mac
>
>
>
> PS:  I just read a post where a guy with a similar problem was able to
> resolve it by just going back to a RESTORE POINT prior to getting infected
.
> You may want to give that a try before doing all of the above.
>
>
>
>
>
>
>
>
>
>
>
>
>
>

[ Post a follow-up to this message ]