Internet Explorer has been hijacked by "About:Blank"

  • Thread starter Thread starter Lloyd Wolf
  • Start date Start date
L

Lloyd Wolf

Hello. Looking for a little help....

I have a customer running Internet Explorer v6, on a computer running
Windows 2000 Professional.

Internet Explorer has been hijacked by "About:Blank"

We have run the Ad-aware 6 and also Spybot Search & Destroy software.
Neither one seems to be able to get rid of "About:Blank" permanently.

Doing a Google search, I have seen lots of people having lots of problems
with this one.

Does anyone have a solid solution for getting rid of the "About:Blank"
hijacker ?

Thanks in advance.

Lloyd Wolf
Wolf Consulting, Inc.
 
Get the new Plugin from Adaware it may help. Or try the CoolWebSearch
removal tool.
http://www.spywareinfo.com/~merijn/files/CWShredder.exe

Lavasoft Knowledge Base Article 04051801
about:blank Presented By Ad-aware

http://www.lavahelp.com/articles/v6/04/05/1801.html

Quoted from the article.

During an Ad-aware scan, about:blank is presented in the results list, and
is shown in the logfile. An example entry from the logfile is shown:</P?
Possible browser hijack attempt : Software\Microsoft\Internet
Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "about:blank"
Selecting the about:blank listings in the results list causes the homepage
and search pages to change from about:blank to the default settings of the
Microsoft Internet Explorer web browser, which are currently to The
Microsoft Network (MSN) main page.
CAUSE
Several variants of CoolWebSearch are using about:blank to hijack web
broswers to their sites. Therefore, about:blank is now presented in the
results list for review. Its listing is "Possible browser hijack attempt" in
reflection that the listing of this item in the results list may be or may
not be entries made by a browser hijacker.
RESOLUTION
Users that knowingly have about:blank set as their homepage, and have no
issues with a homepage hijack, can prevent this item from being presented on
future scans by checking the box next to listings indicating about:blank,
then right-clicking one of the checked items, and then choosing "Add
selection to ignorelist."

Users that have a CoolWebSearch variant present on their system that wish to
remove it completely can select the CoolWebSearch items, along with the
about:blank listings, to fully remove the variant, and its changes, from
their systems.
 
H Leboeuf said:
Get the new Plugin from Adaware it may help. Or try the CoolWebSearch
removal tool.
http://www.spywareinfo.com/~merijn/files/CWShredder.exe

Lavasoft Knowledge Base Article 04051801
about:blank Presented By Ad-aware

http://www.lavahelp.com/articles/v6/04/05/1801.html

Quoted from the article.

During an Ad-aware scan, about:blank is presented in the results list, and
is shown in the logfile. An example entry from the logfile is shown:</P?
Possible browser hijack attempt : Software\Microsoft\Internet
Explorer\MainStart Pageabout:blank

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "about:blank"
Selecting the about:blank listings in the results list causes the homepage
and search pages to change from about:blank to the default settings of the
Microsoft Internet Explorer web browser, which are currently to The
Microsoft Network (MSN) main page.
CAUSE
Several variants of CoolWebSearch are using about:blank to hijack web
broswers to their sites. Therefore, about:blank is now presented in the
results list for review. Its listing is "Possible browser hijack attempt" in
reflection that the listing of this item in the results list may be or may
not be entries made by a browser hijacker.
RESOLUTION
Users that knowingly have about:blank set as their homepage, and have no
issues with a homepage hijack, can prevent this item from being presented on
future scans by checking the box next to listings indicating about:blank,
then right-clicking one of the checked items, and then choosing "Add
selection to ignorelist."

Users that have a CoolWebSearch variant present on their system that wish to
remove it completely can select the CoolWebSearch items, along with the
about:blank listings, to fully remove the variant, and its changes, from
their systems.
--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===
Click to expand...

Hi Lloyd:
Go to this link. I removed using these instructions.

http://www.securiteam.com/securityreviews/5RP0L0UD5U.html

Juan
 
I added "about:blank" to the restricted list - don't know if it worked. I found the following in my trusted sites.
http://*.63.219.181.7
I didn't put it there, I don't know what it is and when I remove it, it comes back. Think it's related to about:blank?
Thanks for any help...KMB
 
I have the same problem. I cannot get rid of the hijack but I've stopped the annoying popups for spyware.
Go to tools, internet options, security and add the word 'blank' to the list of sites you do not want accessed. This stopped the adds for me. I'm still working on the hijack.
 
You have some parasites in your computer. The new version of AdAware may be
the only tool you will need. If not then get them all and clean your
computer.

Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

If you use a HOSTS file, beware of this new issue.
Ad-Aware has decided to include a new detection when scanning the HOSTS
file. This now creates a "Bad hosts file entry" in the log file generated at
the end of a scan. The best thing to do is to place a check in each entry,
right-click and select: "Add selection to ignorelist". Otherwise if you let
AWW "fix" these items it will trash the HOSTS file! Even if you have it
"locked" by [example] SpywareBlaster or Winpatrol. It does not return the
attributes and renames the HOSTS file incorrectly to hosts.

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

More: This may be caused by a third-party program (adware, spyware,
parasite).
Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Additional link:
http://aumha.org/a/quickfix.htm

You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

CWShredder - Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)


Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051

--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===
KMB said:
I added "about:blank" to the restricted list - don't know if it worked. I
Click to expand...
found the following in my trusted sites.
http://*.63.219.181.7
I didn't put it there, I don't know what it is and when I remove it, it
Click to expand...
comes back. Think it's related to about:blank?
 
Lloyd Wolf said:
Hello. Looking for a little help....

I have a customer running Internet Explorer v6, on a computer running
Windows 2000 Professional.

Internet Explorer has been hijacked by "About:Blank"

We have run the Ad-aware 6 and also Spybot Search & Destroy software.
Neither one seems to be able to get rid of "About:Blank" permanently.

Doing a Google search, I have seen lots of people having lots of problems
with this one.

Does anyone have a solid solution for getting rid of the "About:Blank"
hijacker ?

Thanks in advance.

Lloyd Wolf
Wolf Consulting, Inc.
Click to expand...
 
I had the same problem untill I tried AVG Anti Virus and it solved my problem.
As far as I'am concerned this program its 100% better than Norton.
Norton did nothing for me and as soon as it expires I will buy AVG.

Win98
 
It would seem that the solution is obvious. Why not simply switch to a less vulnerable, less bug-riddled browser and abandon IE to the hackers it hosts so readily and well?

Steve
 
Steve said:
It would seem that the solution is obvious. Why not simply switch to
a less vulnerable, less bug-riddled browser and abandon IE to the
hackers it hosts so readily and well?
Click to expand...

Because you cannot abandon it completely and although there are "less
vulnerable" browsers out there, they have their issues as well. I have not
found one browser that blocks all popups or all spyware/adware/malware yet -
nor have I found one that can display as many pages as Internet Explorer (as
(unfortunately) many people design around it), nor have any been lacking in
vulnerabilities. As soon as everyone decides on one - that will be the one
getting attacked and showing its true vulnerabilities.

In any case - you suggest it, but you suggested no concrete alternative...
In your ranting would it have been so hard to add:

Try Mozilla Firefox.
 
I have used reglite and it shows nothing in the Value field.
Presumably, the "hidden" file has been removed. Nevertheless,
about:blank still comes up when I say Use Blank for my homepage. I
get few if any popups, but my Norton Professional Security is set to
block all popups. Can I presume that the non hidden file still exists
on my machine. I have not been able to identify that file. Any
suggestions???
 
Another victim and some additional information on symptoms:

- I'm running Windows 98
- After resetting home page it is set back to About:Blank, on any of the
following: close of browser, restart, after some indeterminate period of time.
- Pest Patrol failed to solve problem
- Norton Anti-virus failed to solve problem

Anyone manage to disable or remove this?

Thanks,

Dan
 
Download the latest version of AdAware
http://www.lavasoftusa.com

Read this.
Lavasoft Knowledge Base Article 04051801
about:blank Presented By Ad-aware

http://www.lavahelp.com/articles/v6/04/05/1801.html
--

If all fails then get help it's a nasty one.

Go to http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Download "Hijack This!" [freeware] Latest version is 1.98.

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT install in your Desktop folder.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://forums.spywareinfo.com/

Sign in, then copy/paste your HijackThis .log file in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===
 
It should occure to even the most dim witted, that the reason IE is so hacked
is because it is the "Most popular", "Widest used" Browser on the network.
IE is far superior to all other "wanna be" and "try to catchups".
If Netscape became the defacto browser tommorow.... the internet would grind
to a halt in less than 3 days. Any newbie idiot can hack netscape and all its
variants with less than an ameba of brain power. butt who wants to bother
with just a few self centered idiots anyway!
 
Please tell me you have solved this problem....how did you do it? I am going
crazy here...kinda afraid to try anything.
 
Lloyd Wolf said:
Hello. Looking for a little help....

I have a customer running Internet Explorer v6, on a computer running
Windows 2000 Professional.

Internet Explorer has been hijacked by "About:Blank"

We have run the Ad-aware 6 and also Spybot Search & Destroy software.
Neither one seems to be able to get rid of "About:Blank" permanently.

Doing a Google search, I have seen lots of people having lots of problems
with this one.

Does anyone have a solid solution for getting rid of the "About:Blank"
hijacker ?

Thanks in advance.

Lloyd Wolf
Wolf Consulting, Inc.
Click to expand...
 
Back
Top