Jewish World Review Feb. 16, 2005 / 4 Adar I, 5765


Spyware tough to boot, but HijackThis, volunteers can help

By James Coates

http://www.NewsAndOpinion.com | (KRT) Q. I've got this really nasty spyware, ``about:blank'' that has invaded my computer and won't let me use the Internet very much and keeps taking over my home page. I must have downloaded something I wasn't supposed to. Ordinarily I'm very suspicious about opening Web sites, but somehow they got me.

Anyhow, here's what I've tried:

1. Went to Start/Control Panel Internet Options, and reset it to Default, hit Apply, and OK. Seconds later about:blank is back as the start page and I can't use Internet Explorer.

2. Deleted all of my cookies, temp files and temp Internet files.

3. Phoned my cable company. They recommended anti-spyware software that didn't work for me.

What do you suggest?

Dale Harder

A You have trouble indeed, Mr. H., but there is no need to despair. Yet.

You'll need to do some work to fix this. As background: Coiled under a rock somewhere is a nest of sophomoric slack-jawed Sad Sacks who make this about:blank home page hijacking a particular nightmare.

It started out as a scheme to drive Web surfers to a Web site that would sell ads and make money. Then somebody got the idea of using about:blank attacks to sell software ostensibly to remove the scourge itself. Yet another group, virus writers, piled on by inserting the nasty code into other hacking schemes.

The results are particularly vile because the malicious code attaches itself to what are called processes that Windows runs to handle various networking and file-tracking tools. Then, when whatever process has been compromised kicks in, the attack causes some kind of program hidden on the hard drive to be run to restore the home page to about:blank.

There are so many variables of these booby-trap programs that nobody can write some magic bullet program to kill it all. That's why you don't see the makers of Norton, McAfee and other big-time anti-virus shops offering fixes.

While there are some versions of the bug that can be fixed by existing software, most are immune.

The fix starts with using a program called HijackThis that will run a scan of a computer to detect all running processes. It will find dozens at a time. You need to disable the bad ones to perform a fix. As a result of this strange situation there are a number of Web sites where volunteers will check out these lists and suggest fixes.

To find details, point your browser to Downloads.com and type HijackThis as a search term. This will give you a link to acquire the HijackThis program and a clearly written explanation of what to do afterward.

The idea is to try to fix the problem on your own, and if that fails, to copy the log of suspicious items made by HijackThis and send it to volunteers for help.

Forums including SpywareInfo.com and CastleCops.com (formerly ComputerCops.com) have folks who will help you out.

Be cautious, however, because you're likely to encounter pitches for costly spyware killers that may or may not help your particular version of the about:blank nightmare.

On the upside I can tell you that I've tried it, and HijackThis does indeed work.

I just wish I could say it's easy. It's not.

Appreciate this type of reporting? Why not sign-up for the daily JWR update. It's free. Just click here.

James Coates is a columnist for the Chicago Tribune. Let us know what you think of this column by clicking here.

Having other problems? Check out Coates' archives

Up


© 2005, Chicago Tribune; Distributed by Knight Ridder/Tribune Information Services