About:blank IE

[willisd]

Every time i open IE, by home page is Defaulted to About:Blank, which then opens a site, warning me that i have some spyware.

I've ran spysweeper, and adaware, and they appear to remove spyware, and when i open IE, it's ok (back to google), but then after a re-boot, or just a short period of time, when i go back to IE, its there again.

I've ran a viruscan on the system but there aren't any viruses. I've tried removing "about:blank" from the registry, but it keeps coming back.

I've check out the installed programs on the workstation, and there doesn't appear to be anything non-company-related.

Can anyone help? There are lots of products on the net that claim to remove the cause of this problem, but they are usually for XP, or 2K. Or I have to pay for them.

 

[golflm]

Hi,

Sounds like you have this browser hijacker:

http://www.sophos.com/virusinfo/analyses/trojstartpaer.html

you need to set your AV to delete infected files found, assuming it is right up to date

thanks

 

[mattjurado]

What I do in this situation, is run scans of ad-aware, spybot, pestpatrol, spysweeper, and hijackthis. I then boot to safe mode, and run them again.

Boot to safe mode and scan again, may get rid of it.

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[RichardMoran]

You may have the PWSteal.Bankash.A trojan. I had to deal with a couple of machines earlier in the week with the same symptoms. I thought we were protected, but a couple of machines hadn't picked up the latest virus definitions. I only realised when I noticed some unusual ftp traffic coming from the PCs in questions. This trojan steals logon details for online bank accounts. If the users have been using the machines for online banking, advise them to change their bank password asap.

Read this page on the Symantec site for details and removal instructions.

http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.bankash.a.html

Hope this helps.

Rik

 

[mattjurado]

Oops, after rereading this, I just realized you have NT, sorry about the safe mode suggestion, hope that didn't confuse you.

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.