about:blank hijack

[moshquerade]

hey, i did do a search and came up with this http://forums.anandtech.com/messageview.cfm?catid=33&threadid=1258310&enterthread=y

the about:blank site has hijacked my homepage, and i cannot rid myself of it. i am not at the top of the geekdom list so i have a hard time with things more complicated such as this.

first, has anyone had their IE homepage taken over by the about:blank search page?
i have ran a virus scan, Spybot, Adaware, and deleted my TIF to no avail.
is there an easy way for me to eliminate this malicious crap?

secondly, i appreciate any help here or PMed. so this isn't my area of expertise, but ask me anything about teeth and i am full of knowledge.

--thanks

 

[Czar]

about:blank is just a default blank page in ie, best home page there is

just make something else your homepage
if that doesnt work then its very likely that some of that anti spyware programs are setting it to about:blank to prevent spyware from taking over your homepage, very popular act

 

[nanaki333]

go to tools > internet options and set your default page.

 

[moshquerade]

well i guess i should have said "i'm not THAT dumb"

i know how to set my homepage, and i have re-set it only to have it go back to the about:blank search page after i reboot.

i don't want that as my homepage.

 

[nanaki333]

run spybot and adaware then and see if you have any of that shat on there that plays with your browser.

 

[moshquerade]

Originally posted by: nanaki333
run spybot and adaware then and see if you have any of that shat on there that plays with your browser.

damn Skippy, read my original post
i ran all that stuff.

 

[nanaki333]

oh, perhaps i should have read it fully.. my bad. don't know if this helps but yeah, here.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;320159

 

[KB]

When you change your homepage, does it stay changed until you next reboot? If so, then either your profile is not being updated (look at the time stamp of %USERPROFILE%/ntuser.dat, it should be the last time you logged out) or something is running at login to overwrite your homepage. In the case of the latter use msconfig to identfy programs running at startup and investigate them. Something like a .vbs or .reg may be running at startup and you can disable it.

If you change the homepage and it never stays even for a second, then you should try re-installing IE.

 

[moshquerade]

yes, if i re-set the homepage it will stay there until i re-boot.
so reinstalling IE is my only remedy?

 

[OZEE]

No, it's a tough problem but one that can be solved.

Actually, instead of trying to tackle it here, I recommend you head over to Spywareinfo forums and let the experts over there help you through this. They're the absolute best at dealing with this particular hijacker. I'm registered as a helper over there, but have never personally worked through one of these about:blank hijacks - and it's a fairly involved fix (primarily because it's actually a different hijacker covering up yet a different problem...)

Then, when you've got it all cleaned up, download/install/keep updated spywareblaster. It'll prevent it from happening again.

 

[moshquerade]

thanks OZEE
i will inquire on that site tonight.

 

[tennesota]

Originally posted by: OZEE
No, it's a tough problem but one that can be solved.

Actually, instead of trying to tackle it here, I recommend you head over to Spywareinfo forums and let the experts over there help you through this. They're the absolute best at dealing with this particular hijacker. I'm registered as a helper over there, but have never personally worked through one of these about:blank hijacks - and it's a fairly involved fix (primarily because it's actually a different hijacker covering up yet a different problem...)

Then, when you've got it all cleaned up, download/install/keep updated spywareblaster. It'll prevent it from happening again.

Good advice and thanks for posting the helpful link to spywareinfo!

 

[Stojakapimp]

I think I'm having the same problem. I have about:blank set as my homepage, but then I run Ad Aware and it comes up with 2 things, both of them being "possible browser hijack" and they have to do with setting the homepage. So I'm wondering if there is some virus that I have that none of the virus things can catch.

And I don't know if this is related or not, but my internet doesn't work after I load the first webpage. Like I'll type in a url and that page will load fine, but then after that no other webpages will load unless I close and reopen IE. Were you have this problem too, or is this something totally different than the about:blank error?

 

[huesmann]

Well, gee, looks like someone did you a favor and permanently set your homepage as about:blank.

 

[OZEE]

That's no favor, huesmann -- it's a hijack! And, IMO, that's way worse than any virus!

 

[Zortag]

This is going to sound like a really lame fix, but it's worked before. when you go set your homepage, instead of typing in an address in the setting menu, go the actual page and click on the use current button. It seems to apply the changes better or something.

 

[OZEE]

Not when it's the about:blank hijack... If you want to study up on it some more, go to the spywareinfo.com link I provided the OP above.

 

[amdskip]

$10 cwshredder will fix the problem. I'm surprised no one has mentioned it yet.

 

[OZEE]

Not usually by itself with about:blank hijack...

 

[moshquerade]

Originally posted by: amdskip
$10 cwshredder will fix the problem. I'm surprised no one has mentioned it yet.

didn't cost 10 bucks, it was free
http://www.zerosrealm.com/downloads/CWShredder.zip

the Cool Web Shredder killed the about:blank hijack. it was that simple.

and i gotta say OZEE, i went to your forums and they were not at all helpful. i think they are understaffed or somethin. i got one complicated response to my thread there asking for help with this when all i needed was this Shredder to take care of it.

oh wells, best thing is --- it is gone.

 

[OZEE]

Glad that worked mosh...

Sorry they weren't as helpful as they should've been -- right now they are "understaffed" -- there's a brand new hijacker out that nobody can figure out how to kill and I think they're all working on it.

Hopefully that killed all of it - usually an about:blank is only partially a cws, which is really hiding another problem. I've found your post over there and it does look like you've got that new hijacker. I'd really like to see a current HJT log. If you've indeed got it entirely cleaned with only cwsshredder, you're the first!

Now, to keep your computer clean, download and install SpywareBlaster then keep it updated, just like you would a virus scanner.

 

[moshquerade]

thanks, may i PM you here a current HJL?

 

[OZEE]

yup

 

[Sundog]

Originally posted by: OZEE
there's a brand new hijacker out that nobody can figure out how to kill and I think they're all working on it.

I hear that. After hours of reading through the Spywareinfo and trying various things multiple times I backed up critical files and just did a reformat/load OS.

 

[wnied]

Kudos to OZEE for pointing me the way of CWS Shredder! Thanx guy, my parents had this hack riding on theyre IE and always got the search page associated with it. Used the shredder program and away it went!

Thanks again!
~wnied~