View Full Version : Evil about:blank homepage...


Kitrax
Tue, 27th Jul '04, 3:00am
Ok, whenever I open Internet Explorer, the home page it always goes to is about:blank...which is some stupid search page. I have ZoneAlarm running constantly, and use Ad-Aware to remove spyware. Ad-Aware identifies two registry values as "possible browser hijack atempt". So I remove them and any other piece of spyware, ect. from my PC and I reset my homepage back to MSN.

Saddly it still comes up as about:blank the next time I open IE. Is this a virus? How do I prevent my homepage from always being changed? :rolling:

Harbourboy
Tue, 27th Jul '04, 3:05am
Oh no, I hate it when stuff like that happens. The standard answer you will get from people on these Boards is:

"Microsoft is so evil. You fool, you should be using Linux or Mozilla or some such thing."

catbert
Tue, 27th Jul '04, 3:35am
Ad-aware, as good as it is, is not perfect and industrious people can fool it with a bit of effort.
I suggest you try going to your registry (Start - Run - Regedit) and look at the startup key (HKEY_LOCAL_MACHINE - Software - Microsoft - Windows - CurrentVersion - Run). A chance is, you'll see a bunch of programs there which do not look safe. That especially includes nonsensical keys (akdgafg-like) and keys that look like system names (eplorer.exe, msdli32 kind of names). If you see any of those - record the paths for the programs, wipe the keys, and then wipe the programs by the paths. You may need to close them through the task manager first.

The best advice all in all - do not use Internet Explorer at all. Opera (http://www.opera.com) or even Firefox are both better choices.

Tassadar
Tue, 27th Jul '04, 3:44am
Look for CWSshredder.exe. That was the only program that managed to revert all my home page settings back to default. If you want it, I can email it to you, it's quite a small program. Run it with all browser windows closed.

Taza
Tue, 27th Jul '04, 9:13am
First http://www.spybot.info/en/index.html
Then http://www.mozilla.org/products/firefox/
(Firefox's my favourite for converting, it's small, fast, low on functions and has the plugin system)

(Those links mean: Install SpyBot, get rid of & immunize from spyware, and then install Firefox, and learn the joys of Tabbed Browsing. :p )

chevalier
Tue, 27th Jul '04, 1:10pm
Block svchost.exe in your firewall. You can't remove it, but you can prevent it from all connecting to and from anything.

Taluntain
Tue, 27th Jul '04, 3:25pm
Kitrax, have you updated Ad-aware to the latest version before you used it? Because it's never failed to get rid of any hijacks for me. But I always run the update before I use it.

Kitrax
Tue, 27th Jul '04, 10:41pm
Tal, I update it about twice a week.

Chev, I thought that svchost.exe was required to connect to the internet. :rolling:

Harbourboy
Tue, 27th Jul '04, 11:25pm
I found that it was not svchost that was the problem, it was the trickily named scvhost (note the transposition of the c and the v). That program is insidious and will cause all sorts of problems. If you see it in your Task Manager, kill it immediately and, as Chev says, never let it connect to the Internet. It is removable, but it requires some deft editing of your Registry.

chevalier
Wed, 28th Jul '04, 12:54am
Sometimes svchost can't be killed. I mean, it can, but in kills your Windows in turn (45 seconds to be ejected forcibly). An easier way is to let it live but castrate it. A freeware firewall program will suffice for gelding knife.

Scvchost is a different story. Kill on sight, as well as any "eplorers" and the like. For the sake of principles, you can report the culprit (if identifiable) to appropriate authorities in his country or his server's country. Or even some agency. I don't know. I don't care. I typically write the companies a personal thank-you e-mail ending with "best wishes of prompt bankruptcy" and my full name below.

Perhaps your starting page isn't set to about:blank, but to some host which is hated by your system? Search for the "hosts" file and look for the name of your starting page. If it's listed there with 127.0.0.1 (local host) as the address, there you have it. Delete and save.

ejsmith
Wed, 28th Jul '04, 2:24am
?????????

To this day, I still type in "about:blank" on any browser start page. I'm using Mozilla 1.6 under Fedora Core2, and guess what my start page is? about:blank. I've got that on Konquerer and Epiphany, as well. :)

With windows, it's an internal shortcut to some .html pages in c:/windows/web. The first thing I do when I load a windows machine is delete that entire folder. So about:blank is exactly that; a white page.

If your homepage is always changing on you, then you can just have a bug in some .dll somewhere. A scandisk is in order, along with the antivirus and anti-spyware routes. And checking through your run-at-startup registry stuff. If you can't seem to cure the problem, crash it. Use autopatcher 4.6, and it will load a startup monitor for you.

[edit: oh. whooops. c:\windows\web.]

SleepleSS
Thu, 29th Jul '04, 1:20pm
What I did was:

Emty my Temporary internet files and Web maps in the Windows directory.

Set the internet explorer to your fav. page and then run spybot search and destroy and ad aware.

It helped for me.

dmc
Thu, 29th Jul '04, 7:08pm
Also, when using adaware, make sure you run a deep scan. If you don't know how to do it, you can navigate their faq to find out. Emptying cookies, temp folder and temporary internet folder seems to help as well.