My browser has been Hijacked by CWS.searchx. When Internet Explorer starts instead of my Home Page opening, the browser shows "about:blank" and launches a page of rubbish links.

I have used CWShredder to find out that it is CWS.searchx causing the problem. CWShredder thinks that it has removed the problem, but it returns.

What more do I need to do?

Gary, June 2004

I refered with some other website abd found this issue remians after you clear with your antivirus and spyware tools. I would like to suggest the following steps to get ride of it.

solution 1: Go to internet options, General Tab, Tempory internet files section, Settings, View Objects and deleted an Object that had a status "unknown", Creation date "none" and last accessed "none".

Solution 2: finding the pogous DLL file and deleting it from your computer.

1. Open Internet Exploer

You will see about:blank and the crap page

2. Click "view" -> "Source"

You will see something like following:
res://%44%3a%5c%57%49%4e%44%4f%(etc,), highlight and right click and copy

3. Go to this website
http://www.simplelogic.com/Developer/URLDecode.asp

4. Paste the code you just copy.

You will see a ***.dll files shows up.

5. Use windows exploer and Go to the directory where it's in (windows/system32) and activate "show hidden files" in this directory. Close all applications. Removing the dll file is not possible, but you can rename it, so do that! Than restart.


Note : By the way, in order to reanme, you have to select the file and then press F2 key on the keyboard.
To show hidden files, you have to click "Tool" -> "Option" and then "View" check "Show hidden files".
Thanks to Rick.

Also check the hidden culprit in the following registry key.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

You need to remove it. Some folks say to change the registry key value to random characters using the free reglite utility (which may work as well) but I removed the key. The value of the key is hidden and causes Windows to load the trojan DLL every time any application is run.

Don't foget to block your computer from feature infection with norton firewall.

Download Norton Personal Firewall.
Configure a rule to always block Port 138
Configure a rule to completely block IP address 192.168.1.255 (or other x.x.x.255, depending on your network) and this should stop about:blank

Say good bye to this issue untill you get the next!.

Muthu Kumaran, January 2005

I got the same CWS.SEARCHX i been hackin at it for hours, i've used cwshredder in safe mode after using spy doctor(says it was removed)unchecked all unnecessary things in msconfig, started jumping for joy ...restarted, same damn illegal operations(explorer, system tray,messenger) ive been at this since 12 last night its now 6:32. My msn does work if anybody knows how to fix my problem i dont know what i should do with rewriting files in notepad or registry or...? JUST HELP ME I DONT WANT MY GRANDMA TO THINK IM STUPID , LIKE IM 15 AND SHE OWNS THE COMP STORE IM SUPPOSED TO BE THE APRENTICE

Email me please! cory_69@hotmail.com or instant msg me! Thx apreciate it...PEACE

cory, January 2005

I find that whenever my browser gets hijacked by CWS.searchx, a file called 'sp.html' is created in my documents and settings/temp directory on my system drive. I delete - erase - this file first, then run CWShredder which removesCWS.searchx. Finally, I run HijackThis and fix the references to 'about:blank' on the log. Start IE and setup your home page again. It should be o.k. now.

Interestingly, I have found that even with the supposed patch from Microsoft, I still get re-infected from time, although the evil file is now 'sp.dll' - the price one pays for free internet porn, I guess. The same procedure for removal works though.

Michael, December 2004

I tried to get rid of this program myself with the CWShredder but it DID NOT work.... i still have this problem and i am trying to get rid of it... someone please help both of us... send me a message on aim if possible, but the CWS.searchx has messed that up as well so i might not always be on....

xx3rdwrightxx, December 2004

I heard from several people that this workaround works as well:
Open the DLL you get hijacked to in Notepad
Select all content (Ctrl-A) and delete it
Save the file and exit Notepad
Find the file in Explorer, right
select Properties, put a checkmark in 'Read-Only' and click OK.If you can't find the DLL file, make sure your settings allow you to view "Hidden files". Open up any explorer windows and click on "Tools", "Folder Options", "View" and be sure to check off "Show Hidden Files and Folders".

Thomas Anderson, July 2004

Hi gary

I have had this aswell i used cwshredder...you can get it free withthe link below..
http://www.chip.de/downloads/c_downloads_11353799.html

Dave...., July 2004