Really bad spyware/trojan

[dynasty]

I don't know where I got this thing. But now when I open IE it goes to this about.blank page. I have run adaware, spybot search and destroy, several times, and done a few other things. But whenever switch the homepage back to what I want after a couple times of opening IE it switches back to the about.blank page. What would you guys recommend? I have tried to do a search for this, but have some up empty handed. Thanks

 

[Shivatron]

Google for CWShredder and HijackThis. Also, do you have the latest defs for AdAware and Spybot? Have you tried running them in Safe Mode?

 

[earthling30]

See if this helps.
http://forums.anandtech.com/messageview.cfm?catid=33&threadid=1258310&highlight_key=y&keyword1=mozilla

 

[earthling30]

If my last post doesn't help I have another link for you, I just got t find it. Yes about blank is very hard to remove.

 

[Jeff7]

Originally posted by: dynasty
I don't know where I got this thing. But now when I open IE it goes to this about.blank page. I have run adaware, spybot search and destroy, several times, and done a few other things. But whenever switch the homepage back to what I want after a couple times of opening IE it switches back to the about.blank page. What would you guys recommend? I have tried to do a search for this, but have some up empty handed. Thanks

Congratulations, you are likely the new owner of a CoolWebSearch variant. I got that about.blank thing, and found it to be CoolWebSearch. It is a hideous program; one part of it employs a hidden registry entry that instructs Explorer to hide a file in the Windows\system32 folder. Registrar Lite is able to see the entry. You can't even just delete the entry, otherwise it keeps coming back. Due to what I believe is an oversight on the CWS programmers' part, you can rename the 'folder' in the registry that the key is in - then you can delete the offending entry - then rename the folder. Then you can target the file in Windows\system32, which is another challenge.
Truly a horrid program.
Hopefully CWShredder will work for you - it didn't do a thing on my variant, as CWS prevented the program from running at all. It just popped up an error.
Thread on the subject; there are many others at that forum too.
Good luck to you.


I increased my browser security settings after this. On IE6 (yeah yeah I know, flame me about that), this brings up an error window every time the new security settings block something, which is very often. You need to disable this.
You'll need Reshacker and Killbox.
Go to the System32 folder in your Windows directory. Copy and paste the file shdoclc.dll to a temporary folder.
Open shdoclc.dll in the temp folder with Reshacker.
Navigate to String Table/503/1033.
In there, on the right pane, is the horrid error message, number 8033. Highlight and delete that entire line.
Click Compile Script, then File->Save.

Copy the edited file now to the System32\dllcache folder in the Windows directory. (This is for WinXP, maybe 2k). This is the backup file stash for Windows - if you just replace the file in the System32 folder, it will be overwritten by the "correct" file.
So overwrite the "backup copy" in the dllcache folder with the edited shdoclc.dll file.

Now open Killbox. Give it the path of shdoclc.dll - the one in Windows\System32. Check "End Explorer.exe while killing file", and click Kill File. Hopefully this will wipe out the file.

Now navigate to Windows\System32 in Explorer. If Windows didn't already put it there, put the edited shdoclc.dll there.

Windows may say something about the wrong file version, but it should only do this once.
The error should bother you no more.

 

[dynasty]

CWShredder got it. Thanks for the help guys. Greatly appreciated. Hey i opened CWShredder when i downloaded it. Do i need to download it every time i want to run it? Thanks

 

[Jeff7]

Originally posted by: dynasty
CWShredder got it. Thanks for the help guys. Greatly appreciated. Hey i opened CWShredder when i downloaded it. Do i need to download it every time i want to run it? Thanks

When you click the download link at the site, select Save, not Open. This'll let you stash the file on the hard drive and use it as you wish without re-downloading.

 

[earthling30]

It has been my experience that it appears to have been removed then it reinstalls itself through a hidden .dll file. Be sure and disable system restore during the removal. Look at the following below:
http://www.daniweb.com/techtalkforums/showthread.php?t=5160&page=3&pp=15
and
http://www.wilderssecurity.com/showpost.php?p=162440&postcount=4
These helped me out.

Edit: I haven't tried what Jeff7 suggested but it's worth a shot.

 

[Socio]

This thread might help you as well;

Text

 

[earthling30]

Originally posted by: Socio
This thread might help you as well;
Text

I've already posted that suggestion on the 3rd post. Good thread to post though