Windows Forum

Ask something
Discussion Locked

about:blank

0 helpful
26 replies

by oz_media

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Yeah I know, a common one isn't it?

Constant about:blank windows popping up in Explorer. Customer has win2K, has run CW shredder, AVG, Norton, spybot, adaware etc. nothing cleaned up yet.

I have found one virus in his files but it is not accessible in Windows. Dyfica, that resides apprently in the Administrator>local settings>Temporary Internet Files in a folder that doesn't appear in Windows, not was I able to find the directory from the command prompt.

I have read a few removal instructions from various sites and they all point to registry entires or supposedly infected files that don't show up on his computer.

Anyone else have ideas??

Cheers,
OM

26 replies

by oz_media

"not was I able to find the directory from the command prompt." Yoda speak!

...actually a typo.

"NOR was I able to find/access the directory from the command prompt."

by wcp

I had several occasions on about:blank problem and was able to eradicate it each time.

1. Ran Ad-Aware SE Personal and Spybot S&D.
2. Removed unnecessary programs.
3. Did Disk cleanup.
4. Set the Amount of Disk space to use to 1MB in Temporary Internet Files setting.
5. Ran HijackThis and removed any line that contained about:blank.
6. Made sure the IE startup page was set to other than about:blank.
7. Ran Kaspersky antivirus program (30-day trial version).
8. Scanned Registry to make sure no Keys, Values, and Data contained about:blank.
9. Installed SpywareBlaster that prevented a lot of spyware.

Of course, the key point is to use the latest programs and definitions.

by wcp

For
4. You may need to set it for each user account.
5. I also removed any lines that were not needed.

by wcp

When I scan Windows for virus, I always run

1. Stinger,
2. Whatever antivirus program that is in the system,
3. Hauri after I uninstalled the one in 2,
4. Kaspersky after I uninstalled Hauri.

by oz_media

Thanks mate but I have done all of that with him already by phone, including some more specific about:blank suggestions for registry entries but still no go.
I just called him again and got him to do an online scan in safe mode with networking but no go. hmmmmmm.

by bfilmfan

Is that a FAT32 or NTFS partition on the drive?

And this will sound really stupid, but did the user login as Administrator on the local box?

If he goes to folder options and checks the box for "Show hidden folders and files," he should be able to see what is hiding in there.

Did HiJackThis see anything in the log? And I am wonderinf if it is a virus hiding in the System Restore folder.

I've read where some systems with SP2 and other pop-up blockers are causing blank windows in IE.

by oz_media

Hey there, and thank you!

Well I spoke with him last night and ended up going by this morning. Yes he is logging in as Administrator, as well as two other user accounts, all obviously have the same issue.

Hijack this appeared clean.

There WAS a virus found 'Dyfica' ut manual removal seems to have worked to some extent as it is no longer found, mind you traces can still ne in there I suppose.

I hate to keep rejecting such good responses but they really are things that have all been done or checked so far.

I usually hav eno problems with the About:blank issues on other machines, this one's just a bitch though.

ONE thing I have noticed, his HOMEPAGE is Yahoo. If I switch his homepage to ANY other page, it will be find UNTIL visiting his home page at Yahoo. Even then all is fine until you click a Yahoo link. ANY link you click on still works, but a minimized about:blank shows up as well, for EVERY LINK in his homepage. Unfortunately he insists on Yahoo as a home page and relies on it for his online email account.

But if you set TR as the home page, everything works fine until visiting Yahoo. Even if his user account is logged out of Yahoo and the generic page is viewed it wil still start the about:blanks. I saw this exact same issue with Excite once, but it mysteriously went away after a few weeks.

I thought maybe explaining how it is being activated may help?

Thanks again!

by glyall

How you check task manager's processes?
Check for unknown processes
check Google to see which the processes are good or bad.

check the following web site for spyware and it show which files to delete and remove from the registry
http://www.actualresearch.com/spyware_db.php?type=all

I check Google for about:blank and got 560,000 hits. the one I check state that you how spyware.

the following site states how to Removing about:blank Homepage Hijacker
http://www.securiteam.com/securityreviews/5RP0L0UD5U.html

good luck

by oz_media

Thanks for your inputm this doesn't appear to be the same old about:blank hijack though, no traces of it found by anything.

I have a few more ideas and then it's time to just drag it to the beack and drown it.

by willcomp

Oz,

Did you try CWShredder and VX2 Finder?

Here's a cut and paste from a discussion thread regarding difficult spyware. It ain't plagarism, I wrote this stuff.

Another major pain is VX2. A finder and removal assist program is available at link below. I have found it highly effective and only way to really eliminate VX2. It is for Win 2000 and Win XP only.

http://subratam.org/?page=removal

VX2Finder can be a difficult program to find if you don't alrady know about it.

CWShredder was taken over by Intermute and incorporated into their SpySubtract Pro software. It is being updated to address latest variations of CoolWebSearch.

However, CWShredder is still available as a free stand-alone program. Link is:

http://www.intermute.com/spysubtract/cwshredder_download.html

Discussion URL is:

https://www.techrepublic.com.com/5208-6230-0.html?forumID=5&threadID=165555&messageID=1693368

Incidentally, Dyfica and Dyfuca are apparently the same critter called by different names depending on detection software. As best I recall it is a porn dialer and not associated with about:blank hijackers.

Happy hunting.

Dalton

by oz_media

Hi, yeah I tried both CW shredder and VX2, no go came up clean. Dyfica/Dyfuca no longer show up, scans come clean. Yet the files listed for manual removal aren't there, registry has no entires listed as related to it either, even the symptoms are different than listed for those two.

But hey you have all been a great help anyway and should I not get this sometime today I will just fork out some points for all of our suggestions,
Thanks

OM

by oz_media

Well rewrite you offered some stuff I hadn't tried, have tried most online scans but not house call, nothing found there either.

The other link had some new suggestions also, but no files listed were found on his system.

I think I will be adding an anchor to my kayak soon !

by sgt_shultz

its ok, we speak tyko, i mean, typo...
well, that point stuck out that somehow you found this virus but can't get at the file/folder to delete it. could we hear more about that and you don't think that is causing this? something is active/running dont you think. you used Windows Search with wild cards and looking at h r s files, yes? and could not find to del from that window, yes? what properties/security on that folder if you did find it that way? how did virus program find it. do you have exact path/foldername in virus log. at command prompt you did attrib -r -h -s , yes? wonder if recent dos shell of pcanywhere could see this folder. wonder if deltree would hurt. bet temp internet folder would recreate on boot but i would try it first somewhere. anything in event log (lame) or what processes don't look right. does this happen in fresh user profile. (lame).
do you ever get anything to affect this? does it work ok for a little while until you go on network or internet? (reinfection from hidden files still residing on your pc or infected network shares or from internet)
i'd be backing up the email and data on this computer and maybe at least thinking about any advantages to a reinstall or a dual install. but you will be stubborn and fix it. will you please let us know what it was...

by oz_media

Thanks for the tips, I was there yesterday and found that Yahoo was creating a set of four temp files. Deleting them and rebooting is fine, as soon as you hit that page they are back (just images and such from he page that he has always been pokay with, nothing that I can see would have problems. There are afew basic Javascript files associated with the page but I have read through the scripts and it appears nothing abnormal is running off of them.

EVERy online and offline Virus check has come up clean, I have tried a zillion differet adware and spyware programs, CW shredder, VX2 and others reccommended but nothing shows up in the scans.

The once infected file found was finally removed and has not reappeared, scans are clean. I see very few of the symptoms related to the Dyfica/dyfuca trojan and any tell tale files/registry entries listed on various sites don't appear in his system.

I will be tryig a few cleanup tips I picked up last night ad will see where it ends up. This guy is not on a big network, home based business. He also just about fell out of his chair when I suggested a fresh install, his setup files are on a partition and the disk he has is for recovery only. I have rn a SFC form the prompt and it found no missing or damaged files.

He is just a really nice guy that I would really like to help with this without ruining his day and reformatting, of course he has no RECENT backups (14 days old and he thinks he MAY have had it back then too) and would lose some data that he deems important.

Yes it took some digging but I found and removed the files found as infected, no regustry entries showed up anywhere or anything else that I can see really. No unknown processes running, nothing found in any scans!! Pull hair out and scream! NAH, it isn't MY PC! LOL :D

by douglasb

I have found AdwareAway to be a very useful program to get rid of hijackers. It also handles keyloggers, adware, spyware and trojans. Download it here: http://www.adwareaway.com It has worked for me every time.

by oz_media

Thank you for your reply Douglas, but as you can probably see in my replies, I have tried a LOT of different cleaners and ad removal software already. This is always my first step and first recommendation for similar issues.

I did try it as per your suggestion but it didn't find anything related to this issue. It uses VERY similar algorhythms to all the others.

Thanks anyway,

by mike (from canada)

Open your registry and search for c:\

As soon as you find a DLL (DLL, EXE, DRV, VXD, or COM) file in your registry, go to the folder the DLL file actually resides in (usually c:\windows\system). Check out the properties of that DLL. If you believe it doesn't belong in your system, remove it.

Also if winstart.bat exists in your c:\windows or c:\windows\system folder, examine it. this file is loaded when windows is 3/4 loaded, and before the GUI appears.

Check autoexec.bat and config.sys. Drivers are loaded here. Remove any lines that represent virus-based files.

by oz_media

THank you VERY much for the ideas. I actually managed to walk the guy through most of the registry before getting tired and scheduling to go over. When I got there I drummed up and down through and through and can't see anything abnormal at all.
Again, it is only opening minimized A:B windows on EVERY link he clicks on the home page and any related Yahoo mail links etc. , everything else works just fine.

I will be reposting a call back for points when I have pretty much tried everything. Watch this forum to get some points, your help is appreciated as is everyone who has responded.

Cheers,
OM

by jdmercha

One thing to check. If you go to his homepage from another computer do you still get about:Blank? If it doesn't then:

I have seen this before when the spyware tools fail to completely remove the spyware. The spyware is actually gone, so it can no longer be detected. But pieces of it remain.

I have also come accross a virus that was undetectable by normal scans. But when I booted to a BART's PE CD I was able to find it and clean it.

by kuryous1

Hello there. I don't know if this will help. I'm running Tenebril's Spycatcher 3.5 and one of the features is to protect the blank page. It has a pretty good database and scans pretty well. I've had no problems to date. They offer a free trial download for 15 days. Good luck!!

http://www.tenebril.com/downloads/

by oz_media

I did try it as per your suggetsion, no go still. I have even tried on ethat boasts finding AL versions of about:blank that other removers fail at, still didn't help.

Oh well, he'll learn one day!

This discussion is closed to new replies.