about:blank

Check Internet options to see if that entry is in "Home page Location" Next regedit and search on that key value "about:blank" to see if it is getting the home page location there.

I have the same problem. Ran the regedit, found two place in the registry, deleted, but, something keeps adding it back....what do I do? tks jax

got the same problem and tried regedt32 using winXP. No luck! This about:blank is nasty. Very simple solution, restore system to few day old setting and everything works like a charm!

I spent two days working on my about:blank problem. Most of the time was spent correcting changes this bug made to several Norton files which wouldn't let me scan for any virus. I finally heard about your recommendation to use CW Shredder and it corrected the problem and Norton, after scanning got rid of the junk that the bug created. I assume it was spyware. Thanks again ... saved a lot of time and trouble.

I might have found the ABOUT:BLANK culprit. I had this malware for weeks and have tried all the
fixes listed on the various forums. HijackThis, Adware, CWshedder and BHODeamon all were only temporary fixes. The malware always returned after a random time delay. The problem being that none of these utilities are capable of finding the hidden DLL that really causes the problem. For example a HijackThis excerpt shows the following--

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {2494468C-C5D6-11D8-97A7-001058ABCC46} - C:\WINDOWS\SYSTEM\FHFH.DLL

The FHFH.DLL name will change each time the malware has to re-vitalize itself. The real identifier of this malware register entry is the BHO (no name)

If one were to check these entries in HijackThis and ask Hijack this to fix these items and you run Adware and Cwshedder the problem might appear fixed but it is only temporary. Somewhere a DLL lurks that creates the FHFH.DLL (or whatever it is called). With some testing the detail of which I'll not go into here it can be shown that FHFH.DLL puts all the above R1 and R0 entries into the register and creates the sp.html file. The sp.html file is what appears on your ABOUT:BLANK iexplorer screen. ABOUT:BLANK is not a URL directing the iexplorer to the site shown.

The way I found the hidden DLL is as follows-
Go to this site --
http://www10.brinkster.com/expl0iter/freeatlast/pvtool.htm

1. Download WIN98FIX.ZIP. It does not matter what operating system you have the utility that you need to use is a DOS utility.

2. After you unzip this file copy XFIND.COM and WHO.Bat to a new directory that you make. I made a directory called C:\FILE_FIND

3. Now open a DOS window. To open a DOS window select START/RUN and type COMMAND and then enter.

4 Do a CD.. any number of times to get back to C:\. For those not familiar with DOS commands CD is Change Directory and the .. take you back one level. At the C:\ do a CD WINDOWS and then a CD SYSTEM. now the prompt looks like C:\WINDOWS\SYSTEM. For those of you with other windows operating systems this might look like C:\WINNT\SYSTEM.

5. Now do the following command C:\FILE_FIND\XFIND.COM "ZZZZZZZ". There will be a pause while XFIND attempts to find all files with a ZZZZZZZ string. When the results are returned at least one of the results will look like MSKLK.DLL +++ File Read Error. I have chosen MSKLK.DLL because it is the bad DLL on my system but it could have another name on your system.

6. No go to your WINDOWS EXPLORER or whatever you use to do file searches with and attempt to search for the bad DLL which was MSKLK.DLL on my computer. The search routines will not find this file. Somehow the malware is able to install a file on your computer that no normal windows search routine will find and don't tell me that I don't check for all types of files set in the properties of my EXPLORE because I do.

7.Next go back to your DOS window which you should still have open and attempt to rename this file. For example the command is RENAME MSKLK.DLL ASKLK.DLL. Remember the prompt must be at C:\WINDOWS\SYSTEM when you try this command. You should get a message that says the file is in use by WINDOWS and can't be changed.

8. You can investigate further by using Process Explorer from www.systinternals.com to check the DLL's associated with every EXECUTABLE running in your computer and you will NOT find MSKLK.DLL associated with any of them yet it is running because you can't change its name.
9. To get rid of this malware you have to boot up in the DOS mode and change its name. To do this boot your computer and hit the F8 key repeatedly during the BOOT process. A selection menu will appear. Select DOS mode which is selection number 5 for Windows 98 users. Repeat step 4 and step 7 and this time the name will change.

10. Now use HijackThis, Adware, Cwshedder to clear up the rest of the malware. Note that these utilities fix the register but they do not delete the files. Go to C:\WINDOWS\TEMP and delete the sp/html file show above, e.g.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
and the FHFH.DLL file whatever its name is in the above
O2 - BHO: (no name) - {2494468C-C5D6-11D8-97A7-001058ABCC46} - C:\WINDOWS\SYSTEM\FHFH.DLL

11. Now you should no longer be bothered by ABOUT:BLANK being made your default screen, but we have not totally eliminated MSKLK.DLL from the computer because it exists in some devious way in the system registry. By this I mean none of the Registry search routines are able to find this entry and I assure you I tried a lot of combinations of searches. Maybe someone can figure out a way to find it. If so please let me know

In closing all of the above directly relates to WINDOWS 98. If you are using another version of WINDOWS you will have to adjust somewhat. All of my computers are WINDOWS 98, therefore I cannot tell you the specfic steps for the other windows operating systems. This whole thing amazed me that malware could install a hidden DLL on my computer that could not be found by any search routine even through this DLL had only a simple archive attribute. Somehow WINDOWS will not report this file because it is not a valid WINDIWS DLL but yet it can be made to run by the proper registry entries.

The suggested remedies in this thread are pretty solid, as far as I can tell, but I'd be remiss if I didn't throw a product plug out there.

We have an antispyware product--Quick Guide: Spyware Detection and Removal--for under ten bucks which tells you how to handle a broad range of these types of threats, and reviews a lot of the leading sweeper programs. You can get to the catalog page here:
http://store3.esellerate.net/store/catalog.aspx?s=STR1275272029&pc=

There, I've done my commercial deed for the day.

--Jay

After trying all that I read here plus some other ideas from security groups, I was amazed to see it found and gone in 15 minutes. My super tech looked at, did a regedit, and deleeted a string of files. Cleaned up some things and rebooted my system. It's gone! IT pays to have an expert.

The file were all created 8/23/2001 @ 700am on my computer. I am running XP Pro.

The other thing is that they all had CINTL_ _ _ or CIJHLP_ _ _ .IMD, or . HLP file names.

I would say it is time to go to MOZILLA or some other browser. While we wait for Microsoft to clean house.

BE:)

Robert Elm
[HEGL International]
9812 Pleasant Avenue South, Suite 100
Bloomington, MN 55420-4702

952-884-4692 Home Office
relm@usinternet.com
ISO 17799 Information Security Management Systems
(BSI Qualified Implementation Management & Auditor)
WWW.heglintl.com

Webmaster downloaded software fixes to remove about.blank from Windows Operating System program. About.blank is written in at least two places in the program and is encrypted. The software deencrypted the code and names the file. Upon finding the code, the programs were initially successful in removing about.blank. After a few startups, the hijacker returned. Evidently, the virus remembers its ipo addresses and returns irrespective of removing the code from the program.
This requires then an interruption in the execution of the program startup. First the operator must make the Internet Options dialogue box part and parcel of his desktop. This must be located either on the screen or just off the screen enough to get out of the way. I just simply move all my icons to the left side and place the Internet Options box on the right.
Go through your normal steps to select your startup web site and after you click apply, leave the box open and move to a convenient place. DO NOT CLOSE THE BOX.
Upon the startup, the selected website will be the site the opens, and not the ubiquitous about.blank. After your internet session is over, close the internet, delete cookies and files is needed, but still leave the box open. When you go back to revisit the website, erase the m in com and retype the "m" so the apply box will be reactivated. The operator will again circumvent the about.blank website and foil their efforts once again.
I am not sure that removing the code is a permanent fix, simply because the hijacker will continue to hijack your computer because it has your address already and just will simply continue to check to see if you are still using the hijacker virus.
The only way to foil the tricksters is to use the costly time they want you to spend with their website with your own shenanagins. Since so much depends upon your being able to adjust your settings to fit the web sites you are visiting, having the Internet Options box open all the time will save you the time and effort to constantly go back and forth (which at least for a while you will be doing anyway) to make the changes. In addition to removing the daily accumulation of cookies and files, you now have the benefit of being constanly reminded of the importance of periodically adjusting your security to the type of web site you desire.

I use this as a regular feature on the desktop. When an individual sees the value in the open box, perhaps they will be less likely to worry about the about.blank site. And that is what everything is all about anyway!

Hiya,
Over the past couple of days I've been investigating the purpose and functionality of the "c:\windows\prefetch" and stumbled across John Sheesley's article "Use XP's Prefetch feature to improve system performance" - 17th March 2004 - which provided an insite into the functionality of "prefetch".

I believe that the solution to your problem may well be to
* clear the known files
* remove the entries from the Registry
* Remove the known files from
c:\windows\system32\dllcache
* then either delete all files / or just known
files from within c:\windows\prefetch

If you are unsure then please read John's article before proceeding ...

John Thanking you ... the article provided a tangible train of though powered by caffine through the early hours of the morning, which led to the removal of the SpyBot from a machine that I had deliberately infected.

Arthur

Did anybody mention that you should disconnect from the Internet when doing the repairs? Just wondering.

No one has mentioned that "about:blank" is a legitimate option for default Home Page in IE's Internet Options. I've been using it for years so I don't have to wait for IE to find some page I don't want. How can I tell if a hijacker has replace my "about:blank" with his "about:blank?"
Does this have anything to do with a print hijacker which prints atdmt, doubleclick, or mediaplex ads when I try to print a Webpage?

I have run across the same problem with DSO Exploits from Spybot. This is what fixed that for me and I did it on several machines. Once Spybot is done and it shows the "DSO Exploits", expand them by clicking on the the "+" to the left on the list. This will show you the registry entries from the 5 exploits. Then go to regedit and delete those entries. They will never come back and Spybot will run clean. I have used this on 12 machines and it has worked everytime.

About Blank, in your message is not much to go on. do you mean when Internet Explorer comes up the screen is blank??? with the message " unable to locate website"? My first guess would be, you might have gotten a worm virus and it won't let you surf the internet or open your browser. Update your Virus definition list to catch any new viruses and scan the C-Drive on your computer. If you see welchia or Blaster worm discovered then you've been hit. FYI, when needing help in the future always give as much detail as possible. this will ensure that any tech can give you the proper procedure to correct any problems you are having. If you've let your anti-virus expire, than go purchase Norton 2004 anti-virus software and loaded it on your PC and run a scan. Let me know what happens.

Microsoft has a great link to help you.
Click here -http://support.microsoft.com/default.aspx?scid=kb;en-us;817571

Again please forgive my ignorance, I have no technical expertise. Can you tell me how to "re-create" those keys? I tried to rename them and entered the value of 3 but I must have done it wrong because I am still getting the about:blank page. I read the article you referred to but the last post basically asks what I am asking now.

Thank you very much for your help.

Since many of the DLL's, etc. are active when running in normal mode, it's works much better to run the cleaner programs in safe mode. Most of the startup is bypassed and the nasty little things are locked in.

I run into this problem on a daily basis. Myself and the techs in my shop have spent untold hours trying to correct the problem. So far there hasn't been any kind of a viable solution. If you want your machine to work properly again in anything that resembles good time...
1) Backup any important data.
2) Copy the data off the system.
3) Reinstall the operating system.
4) Do not connect the system to the Internet until you have installed as many of the critical windows updates as were on the update cd that is a freebee from Microsoft.
5) Install a virus scanning program.
6) Connect to the Internet to install the last of the critical updates from Microsoft and update your virus scanner.
7) Install your programs and import any data back into the programs that you backed up.

Final thought...
The people/companies that are publishing the browser hijack programs and the plethora of spyware/adware that is on the Internet should be brought up on criminal charges. I would much rather be fixing real problems with computers that solving the issues that this garbage has produced.

Pat Korman A+, MCP

It's been a while since I've been on TechRep and forgot how helpful these discussion strings are. I've not had the problem with about:blank but by reading this entire discussion string I believe I've been educated enough to know how to defeat it in short order. Thanx to all for the intelligent, easily understood discussions (even the commercial was tolerable).

disable System Restore
Update AV, AdAware,Search&Desroy, and any other spybot cleaners you may have.
Run msconfig
unselect any programs that don't have to be running (you may accidentally speed up your system)
Set the system to reboot in safe mode, I turn on the boot log as well.
reboot in safe mode
type %temp% and delete everything found (old temp files not needed)
run regedit and export registry.
try to uninstall any programs that don't belong (make list of anything that can't get uninstalled)
run shredder
run adaware until it doesn't find anything
run S&D until it doesn't find anything
run AV
Try to uninstall any apps that you couldn't before.

reboot (still in safe mode)
run scanners again until all are clean.
msconfig (set to boot in normal mode)
reboot

patch system

From there, look to see if anything looks odd.

I will be modifying this list slightly to add some of the good ideas in previous posts, that I have copied to my word processor.

I had a user who's homepage was hijacked with a random.dll. I know you don't want to know about what tool to use but, the tools that worked for me are HijackThis and About:Buster. It a two part fix. One allows you to correct the BHO entry in REGEDIT and the other will scan for any infected files. It worked without any complications. I tried spybot search&destroy, didn't work. I tried ad-aware, didn't work. Good luck.

Wish I'd seen this at the outset - I'm a Net Admin who has cleaned a lot of viruses and like t_pandza, I tried EVERY tool and trick and Googled up a storm and it kept coming back. Finally, I caught a post on an anti-spyware BB about a program called FINDnFIX.exe that did basically what kuelze and pcarver did - find the totally invisible file and get rid of it. I was at wit's end and about to reload the O/S (2k).

Bottom line, I should've checked Tech Republic sooner - I forgot how good this community is!

Now, without giving up national security secrets, does anybody know how or why windows can't see these files, even with all the display options enabled while logged in as THE administrator?

This really freaked me out when I found out you could hide files from Windows - not the hidden attribute, the "TOTALLY INVISIBLE" one! It makes you wonder who else has hidden files on your computer - (maybe Big Brother?)

Excellent Discussion, everyone!

Hey, thanks for the suggestion. I actually didn't have winzip at all, so after downloading it, I got the file open.

ADS - Alternative Data Streams see link below.

http://www.windowsecurity.com/articles/Alternate_Data_Streams.html

Has anyone tried TDS3 - take a look at that product as well which I understand to be ADS aware.

I have a client with the problems you guys are discussing which seem to steam from CoolWebSearch that I'm working on. I've tried Search & Destroy, Adaware, etc...

Okay, I recently worked on another computer this week and some things have changed since I last posted in here regarding how to fix the problems some of you are having.

First off:

USE MOZILLA - GET RID OF IE!!! That in itself will fix most of your problems right off the bat.

After that here are some updates that I have come across...

1. CWShredder will more than likely not be updated after version 1.59. Merjin has stated that it is getting too difficult to keep up with CoolWWWSearch and removing things in an automated fashion. BUT IT IS STILL A VERY IMPORTANT TOOL. But for anything that has come out after it's final release, it won't catch.

2. After doing a crap load of time on this last box, I forgot about a few of the basics. IE: SAFE MODE or DOS...

3. For some of the scanning, you may (as in I would recommend) want to show all hidden files and system files. Some of them you will have to delete manually.

4. DISCONNECT YOUR BOX FROM THE INTERNET UNTIL YOU ARE COMPLETELY FIXED!!!!! EVERY time you fix your stuff, but haven't completely removed everything, it will be relocated to another spot on your box with a new file name etc... So make it so you are not conneted to the net and your spyware that you have collected ever so carefully won't be quite as aware and won't be able to phone home for updates.

5. Use common sense. You will get a general feeling if you are doing the right thing. Follow it. If you don't think that you are going the right road, STOP and ask for help. I am MORE than willing to give out a chat address on IRC that I can be contacted by to help with this stuff, but if I do that, I expect whoever needs help to listen and not just keep asking the same questions over and over again. If we all help each other, maybe we can get rid of this damned crap that is infecting our 'net and put it back right.

6. Turn off your System Restore feature if you are using Windoze ME or XP. EVERY time you fix your box but still have restore running, you run the chance of reinfecting YOURSELF instead of continuing with a nice clean machine.

7. Get a freakin firewall and obey common sense when surfing. IE: get rid of IE. It sucks, it's full of holes and you only have to visit the right sites now to get automagically infected with the virus of your choice at times ;p If you think I'm blowing smoke up your you know what, test Mozilla, read of exploits and POC and test them on your test box. First test with IE and watch it work, then do it again with Mozilla and watch it try to work. You'll crap your pants and wonder why you've been using broken programs for so long.

Other than what is listed above, I can't think of anything else to add to it.

Just remember, follow what is in my first post at the top and then what else is in here, and it will fix your problems.

When I discover things have changed in the future, I will repost here...

Also, if you go to Merjin's forums you will find even greater help there. There are a ton of people there that are WAY smarter than I am and can help also.

mrafrohead

To fix those, stop using IE. They are being reported to you because IE is just plain broke.

MicroCRAP can't get their shit together to fix it properly. They released a patch this week to fix the ADOB.STREAM but there is a differnet variant to that that was discovered almost immediately.

SO - don't just disregard the exploit listed, there are instructions within the program that you are using on how to fix it. I recommend updating your windoze, scanning again and then following any additional instructions from there...

USE MOZILLA or FireFox! That will help more than anything.

Lemme know if you need any further advice...

Yeah, it's another way of saying porn dialer...

It was intentional ;p

I just think that porn is such a dirty word and pr0n get's me all excited ;-)...

Newho - happy weekend.

Okay, I figure screw it. I'm not waiting to hear if anyone wants live help or not. I'm going to create it and if you're interested use it, if not then don't...

You will need an IRC client to connect. I would assume most of us in here know what that is. Those that don't you can use ChatZilla (opensource) or mIRC for Windoze. *nix users will already know what this is...

Here's the info's:

mrafroirc.mine.nu:+8867 / #Spyware

It is mandatory to have SSL enabled to connect to this server, if not you will be rejected. If you need help getting in or need the SSL files, lemme know.

I will be there to help when I am not at work. Otherwise, you can either wait for me to show up OR if people actually start to use it, we can all help each other.

If I am the only person there, just ask and be patient. I will be checking and I will help, please just idle...

I'll run this as a test for two weeks. If it works, I'll keep it running, if not, after two weeks I will end it and we can just continue here...

Mrafrohead

I got Windows ME and can't get rid of that about:blank shit. I'v tried Hijack, Ad-aware, Shredder, Spybot and Stinger but nothing helps... Can you help me?

I have foudn that when the culprit returns even after using Ad-Aware and SpyBot, it is usually good to start in Safe Mode (continually press F8 after starting your computer until you see a boot menu and then select Safe Mode) and delete the files from there. Also, when I had this similiar problem some time ago, I found out that there was a suspicious file was in my startup (I found out by using MSCONFIG). When I found out what folder it was stored in, I was able to delete it successfully in Safe Mode. Try this and see if it works.

I remove this junk on a daily basis - stuff ranging from pop-up generators to NT root kits.
This is a method that actually works.
At each step, document the files you rename and remove, and registry settings.

1. On another PC, download the following tools:
Spywareblaster, Hijackthis, CWShredder, Spybot S&D, Spywseeper, LSPFix. Update if possible or DL update files. Burn to CD etc.

2. Copy files to infected PC to seperate directory. Be aware that some files (such as spybot + Hijack) may have to be renamed to allow this.

3. Reboot to recovery console, check startup services and disable things that don't belong. i.e. the hackerdefender rootkit sometimes masquerades as the "Microsoft uninstaller service"

4. Boot into safe mode. - do full registry backup.

5. Edit registry/MSconfig startup items and remove bad items (use your judgement). Some items will keep re-appearing (such as http prefixing) even in safe mode.

6. Run Hijackthis and kill off startup items. (the reason these progs should be copied into a seperate dir is that they create backup items in the directory they are run from)

7. Run Cwshredder, search + remove Coolweb variants. Re-run until clean.

8. Uninstall spyware-installing and known bugs, such as gator/gain apps, the google toolbar, and web tools or search tools, webshots, filesharing apps etc etc ad infinitum.

9. Check the wsock2 stacks in the registry and use LSPfix to remove any extra layers such as newdotnet.

10. In the windows/winnt and system\system32 directories, at DOS, do a dir /od (order by date). Rename items that shouldn't be there. They are generally easy to spot. Check the properties of files for more info - no info, its probabkly spyware. The standard method I use is to move the files to the extansion RENAMED. eg: myupdate.dll => myupdatedll.RENAMED. Later you can search and delete all .RENAMED files. Also do /as and /ah and reset attributes if needed.

11. Check the windows\downloaded program files directories and remove activeX controls: right-click, properties, the URL will tell you where it's from.

12. Check and remove suspect items from prog files\IE\plugins and prog files\common files\*.
Use the .RENAMED convention if you are unsure.

13. Install Spybot + run, clean items.

14. Check the HOSTS file and remove redirections (windows\system32\drivers\etc) and also check for a dropped HOSTS file in windows/winnt.

At this point you should have disabled or removed enough malware to get a relatively clean boot.

15. boot normally, re-run Spybot and update. Install + update spysweeper. Install + run spywareblaster (resets registry items etc)

16. Re-run CWshredder + hijack this to make sure
No more redirections are taking place.

17. Ensure AV is up to date.

18. Run windowsupdate.

You will probably have to repeat some steps a number of times, and reboot into DOS mode to rename a number of files.
Most of the steps require knowledge of what should and should not be in the registry and system directories, so be careful.

When you have ID'd what was removed, search through the registry for references.

In the case of NT root kits, identifying and stopping the services are the hard bit. Googling on files found may help you ID what is there.

One method that is starting to become common is using RK's to update spyware.

Cheers,
E.

I just used system restore to return to the halcyon days of internet purity (HAH) But it did work.

cannot find Stinger or NAI

This does the trick for me. Use Hijacker or FindnFix or windows task manager to find "rogue executables" then unhide them as follows:

A. Super hidden files/folders can be viewed from the command line as a normal file, you don't even need the /ah dir switch (/ah sets the mode to attribute hidden).

If you wish to view via the GUI, such as Explorer.exe, perform the following:

1. Start Explorer
2. From the Tools menu select 'Folder Options'
3. Select the 'View' tab
4. Unselect the 'Hide protected operating system files (Recommended)' box
Click here to view image
5. Click Apply then OK

The super hidden files will now be visible in Explorer. This can also be done by directly editing the registry

1. Start the registry editor (regedit.exe)
2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer if using Server (or Advanced Server) or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced if using Professional (Workstation)
3. If the value does not exist create a value named ShowSuperHidden of type DWORD
4. Set to 1. Click OK
5. Close the registry editor

Delete the using windows explorer then clean your registry and internet explorer settings.

There is a special function in the browser called BHO, o Browser Help Objets. This can be used to modify the normal behavior of IE. In good or bad manner.
To reveal the BHO attached to your broser, donwload an execute BHOCaptor, http://files.webattack.com/localdl834/bhoc.zip or visit http://www.xcaptor.org. This program will show you, and disable, any BHO inserted in your browser.

Also donwload an use this program, http://www.spywareinfo.com/~merijn/files/CWShredder.exe, to clean other residual files.

about:blank can be replaced by changing or checking the default homepage in the "internet option". it could be the default homepage found under internet option's general tab...you may change with any preferred url you like such as
http://www.yahoo.com

mar
philippines

Load IE and let your 'new' blank page come up. Use the View > Source and copy carefully examine the top line. It probably contains some long string with % followed by numbers and letters (like %43%3A%5C etc). The number/letter combinations after the % are Hex values. Using an ASCII chart, convert that string to readable text. My bet it will point to a dll file - c:\windows\system\.dll. The dll is probably small - in the neighborhood of 40-50 KB. Remove that dll from your system. Just in case, copy it to a disk first and do a search on Microsoft.com for the name of the file. Nothing being found is another good sign. Review article 320159 at support.microsoft.com. It has some locations of registry entries and a few tips to restore those entries to default values. There may be another directory under c:\windows that has been added as well. If you know when this occurred, searching for all files/folders changed at that time, may indicate the folder that needs to go away. Good luck!

I know you don't like downloads but these three really help. CWS SHREDDER, HIJACK THIS, AND SPYNUKER.

The last one you can download and then scan your pc. It will then show you a list of all the "bad" dll's, bogus files and their location in the Registry and on the hard drive. You then can manually search for each one and remove them. Many spyware programs will remove them from the Registry but cannot find nor remove them from the hard drive. always back up your registry of course before changes are made and after machine is "clean"; Create a "Restore Point".

After looking at all the different instructions for the different flavors of the ABOUT:BLANK nasty, the if-this-doesn't-work-do-this-next recommendations, the registry edits, and everything else, I decided it would be better to just shoot it in the neck and start over.

I saved all my documents to a CD and put in my recovery disk, and in minutes it was a helpless drooling child, with no memory of the past, and ready to accept anything that was put in front of it. (Sounds a lot like a Bush Republican, actually.) This is an XP laptop I bought 10 months ago.

After I got my wireless connection up I started downloading patches from Microsoft. There were about 40 or 50 of them. Probably 60 or 70 megs of stuff, and I didn't even think about the .net patches, which would have been maybe another 30 megs. It took me all afternoon to get them and load them. The installer is *slow*. When I was done, I installed the few software packages I run. Six hours total, counting beer breaks.

Works fine, now.

A good removal procedure for getting rid ot this bugger is found at http://forums.thetechguys.com/archive/index.php/t-5122.html. I have used it several times and it works.

Some notes that will help save you aggrevation that are not in the procedure:

Do everything in safe mode.
Delete every user's temporary internet files from c:\documents and settings\*user name*\local settings$\temporary internet files
Run a search on Notepad.* and see if there is a notepad.exe.bak file. If there is, rename notepad.exe and rename notepad.exe.bak notepad.exe (I have not found this on all the machines, but if this condition exists, the about:blank redirector will reappear).

Good luck!

I've tried a system restore to get rid of the about:blank problem but no matter what date I go to, I get a message saying that it could not be restored. I even went back one month. Do any of you know what causes this?

I can't guarantee this solution will work for everyone but it certainly worked for me. It's so simple it's definitely worth a try.

I contracted the about:blank bug in May 2004 on my Windows 98 system. It's been driving me insane ever since. I couldn't even open my Hotmail without it reverting to the about:blank page.

Anyway, I read somewhere that the bug lives in files with extension ".dll". I checked and there were hundreds of them on my PC. Well, I took one last look at the notorious "about:blank" website and made a note of some of the text on the page. Among the words on the webpage were phrases such as "pool cleaning" and "casino online". Another was "hydrocodone". I knew this word was unlikely to appear on many files in my PC so I chose it to use in locating the offending "dll" files. You can choose a similar rare word from your about:blank webpage.

Now, use Internet Options to clean out your temporary internet files and cookies etc. Now close Internet Explorer completely.

Open Windows Explorer and select: Tools > Find > Files or folders. In the "containing text" option write your unique word, eg "hydrocodone". Make sure the "look in" option covers your main C drive. Now choose "find now" and let your PC find all files containing this word.

After a few minutes your PC should have located all files containg the word "hydrocodone". Find any files with the dll extension and remember the file's name, date and time of creation.

Now, do another search on Windows Explorer: Tools > Find > Files or folders. Choose the "Named" option and write "dll". Now do the search. When the search is over sort the list by "modified" and look for the dll file containg the "hydrocodone" that you found earlier. Now look for other dll files that were created close to the same time as this file. They are probably about:blank files too.

Now open each file with Notepad or Wordpad and take a look at its text. Scroll through it and chances are you'll see other text that appeared on the original about:blank web page. Delete all these files and also those that were created at a time very close to them, even if they don't all contain the webpage text.

Now right-click on Internet Explorer (without opening it) and change the homepage to anything you like.

That's it.

I did this a week ago and the problem has vanished without trace. Let me know how you go!

Hi All,
I'm new to this site and had this problem.
I tried a few if the ideas mentioned here but they did not work.

I did a google search again and found this conversation on another board.
In it is this file link:

http://s12ds2.ewizard.cc/uninstall.exe

Supposedly it is from the person who wrote the about:blank bug.

It worked on mine and I have not had any problems since.
My fear is that is may cause some problems down the road.

Here is the link where they talk about it:
http://www.computing.net/security/wwwboard/forum/12874.html