Jump to content


Photo

About:Blank, CWS.Searchx, ewizard.cc


  • Please log in to reply
4 replies to this topic

#1 bmw323

bmw323

    Member

  • Full Member
  • Pip
  • 4 posts

Posted 18 June 2004 - 05:02 PM

:gasp: I downloaded the most recent CWShredder and it says that it removed CWS.Searchx, but it keeps returning. I open up Internet Explorer and the home page "About:Blank" pops up. Also, when I open up AIM a pop-up appears telling me I may have spyware and to click here to search for spyware removal programs. I keep removing this, but it won't go away. What should I do?

#2 Delmar601

Delmar601

    Member

  • New Member
  • Pip
  • 2 posts

Posted 18 June 2004 - 10:17 PM

I have the same problems. Spent a few evenings trying to fix it but to no avail. Ran HijackThis after cleanup and found no suspicious lines but the bloody about:blank keeps coming back everyday, sometimes with the pop-ups.

Please help!

#3 Scoff

Scoff

    SWI Junkie

  • Retired Staff
  • PipPipPipPip
  • 294 posts

Posted 19 June 2004 - 09:45 PM

Delmar601, you need to start a separate post for your problem.

Both, download HijackThis here: HiJackThis v1.97.7
Unzip to a convenient permanent folder
For example: C:/HiJackThis/HiJackThis.exe
Double click HijackThis.exe, and hit "Scan".
Then post the fresh log in the Malware removal forum.
Regards
Scoff

We've heard that a million monkeys at a million keyboards could produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true. - Robert Wilensky

#4 Delmar601

Delmar601

    Member

  • New Member
  • Pip
  • 2 posts

Posted 19 June 2004 - 10:21 PM

Hi Scoff,

I put my PC on safe mode and then ran Ad-aware. It found two entries which were not found before:

obj[0]=RegKey : WMPPublsihCntr.WMPPublsihCntr
obj[1]=RegKey : WMPPublsihCntr.WMPPublsihCntr.1

I also deleted all *.temp files. The problem hasn't come back in the last day. I hope the above measures have finally resolved it. If not, I'll post the log as advised.

Thanks,

Ivan

#5 Mr. Swenk

Mr. Swenk

    Co-Owner of TechnoFusionElite.com

  • Full Member
  • PipPipPipPip
  • 271 posts

Posted 19 June 2004 - 10:36 PM

Hello Ivan, would you mind telling me how you found those entries? I'm working on a tool to help detect CWS, which variant, without using CWShredder.
Useful Links
Cleaners
Ad-Aware CWShredder Hijack This!
Sasser virus Removal
Sasser Removal

Proudly Developped CWS Search in VB6 and VB7(.NET)


Co-Owner of TechnoFusionElite.com > Personal Domain




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button