About:Blank Removal

[Sage]

I found this on another forum and it has worked for me. *puppy*

THIS IS IT!!! Here is how you fix this damn problem. I scratched my heads for weeks trying to fix my friend's computer and I finally figured it out...GO ME.
Follow these instructions, then I'll explain how I dumbfoundedly stumbled into the solution.

1) Forget all of your spyware/adware detectors and registry programs.
2) Go here: hxxp://www.oz.msie.tv (link deactivated - LWM)
3) Click on the uninstall software link and save the uninstaller to your desktop
4) Run the uninstaller.
5) Go to your internet options and reset the home page to whatever you want.
6) Launch your internet explorer!!! You're done, it's as easy as that!!!

Here's how I stumbled onto the fix...I tried my 3 favorite internet fixer programs (ad-aware, spy sweeper, and hijackthis). I ran and updated them time after time and removed things manually and automatically from the registry and other locations on the hard drive to no avail. I then launched Internet Explorer and let it take me to the crappy search page which conveniently would show the URL as about:blank. I was looking for an uninstaller listed on the main page and did not see anything. I then wanted to try to figure out just what in the hell the URL for this search page was. Using some common sense and keeping my fingers crossed, I just went ahead and entered in a search for "legos" in the search bar. BOOM! Up came my results preceeded with ~snip~ (the link above) ~snip~. I then just deleted all of the search result info from the URL bar so that the URL simply read ~snip~ (the link above) ~snip~. I hit enter and BAM! There was the link to uninstall that piece of crap. I downloaded and scanned with antivirus program. It was good to go so I ran it. Rebootted, then changed my home page back in internet options and launched internet explorer.

PLEASE POST THIS EVERYWHERE YOU USE FORUMS!!!

I struggled and researched this a million times and every time, after every removal process, I would reboot and get this damn about:blank search site even after all my scanning showed no threats/hijackers and task manager did not indicate any suspicious processes running either.

I hope this helps EVERYONE with this stupid about:blank problem!

[Jooske]

Hi there Sage,
you might like to post your Hijackthis log in the HJT forum for expert help to see if there is anything malicious left on your system which might have been overlooked till now? 15913 for posting into that forum and get adequate help.

[Sage]

Actually it was on a friends machine and it has left his homepage alone
so far.

[IMM]

deleted to read - no comment

[Arnold]

-{ Quote: "I found this on another forum and it has worked for me. *puppy* " }-
Sage, hello
Before I click on the 'uninstaller', can you advise if it will NOT uninstall anything besides the 'hijacker of about blank'.
I'm a little leerie of 'uninstallers' perse without knowing more about them.

Also, the page it first brings you too, is the 'search' page from the hijacker.

Hope you have experience enough to advise.

Thanks
Arnold

[notlikely]

I have also come across said uninstaller.Not directly from the malware vendors site-it is being hosted on a reputable ftp site,now (More fool them-hope they don't suffer terrible consequences)

As an I.T.-savvy pal of mine phrased it:"Never use uninstallers from Criminals.It's like trusting burglars to lock your house after they've robbed you."

If indeed it *is* capable of removing about:blank,I see no reason why it can't be decompiled/reversed engineered/whatever and re-released sans any hidden malicious payload it will definately harbour.

[Zonnie]

This installer worked for me.

Like Sage I tried lots of removal tools with no success.

I wish we knew more about the source of the code and the potential effects of the uninstaller. If indeed it can be reverse engineered, let us know.

In the mean time, I think Sage earned an Spyware Wars Battlefield Promotion.

[LowWaterMark]

We'll take a look at this and the site referenced to see if we can determine if it is safe or not. While some installers from unknown sources do work, or at least partially, there could very well be other problems with the site or unforseen problems with the uninstaller.

At this point, it is not recommended by this forum to use that uninstaller or to go to that site. (We want to be very careful when such links are provided, because frankly you just never know!)

[Sage]

I opened it with note pad and didn't see anything that might be a problem,
but I'm far from being an expert. If you think it may cause problems please
delete this post.

[keellayer]

Just want to say thankyou. about:blank is gone, very easy
keellayer

[keellayer]

Thanks to Sage about:blank is gone I'm very happy!

keellayer

[Rita]

-{ Quote: "deleted to read - no comment" }-

hi imm
is about blank pop up ads or what exactly???

thanks
Rita

[Cathy1979]

I have been trying for months to remove about:blank. Nothing worked until today. Thanks SAGE!

[IMM]

-{ Quote: "hi imm
is about blank pop up ads or what exactly???

thanks
Rita" }-
It's more about I posted to the wrong thread - too many open at once :)

[polak]

LowWaterMark,

Has the site and the uninstaller been tested to be safe.

Thanks

[Ack!]

Yes...Please check into this!
Has it been tested?
Is it safe?
Where would it be safe to get it, & execute this pest?
Really, no offense intended to anyone, but...
I only want to hear from a mod, or trusted advisor on this.
Have bookmarked this page.
Thankyou. Keep up the great work all! :)

[snapdragin]

To the best of my knowledge, none of the Spyware Experts or Trusted Advisors are using or recommending that site in any of the logs they are working on.

The safest recommendation I can give is to go to one of the known Anti-spyware forums and follow the instructions given by trusted Experts.

You can find a list of anti-spyware forums here: http://a-sap.org/

Regards,

snap

[Blackspear]

-{ Quote: "is about blank pop up ads or what exactly?... thanks" }-

Hi Rita, it is a mongrel piece of software developed by a team of russians that hijacks your Internet home page and is extreamly hard to remove, it is like a virus, it comes down in 2 parts, when you try to remove it, it replicates itself...

In order to keep it off your system you should install and keep up dated:

Spyware Guard
Spyware Blaster
Spybot Search & Destroy
AdAware

As well;
Keep your Windows up-to-date
Keep MS Office up-to-date
Use an Anti-virus program
Use a Firewall
Use an alternative web-browser, such as Mozilla Firefox
Use something like System Safety Monitor

These should keep your system fairly safe and secure, just like a little fortress ;)

Hope this helps...

Cheers ;D

[snapdragin]

Hi Ritaann,

To add to Blackspear's post, about:blank is another variant of the CWS trojan (one of the more difficult variants to remove). You can read more about the many variants of CWS in Merijn's The CoolWebSearch Chronicles (http://www.spywareinfoforum.com/~merijn/cwschronicles.html).

Because it can be so difficult to remove, that is why we recommend you get the guided help from the Experts that have the best experience in manual removal of this type of malware.

Regards,

snap

[never been here b4]

Thanks Sage, like ive had some easy removal B4
But that was to easy
Thanks again dude u did well to find it

[El Dudereno]

I took a more drastic approach in getting rid of this pest. I went into the registry and edited the homepage to Google (MY choice!) in both Local Machine and Current User. Then I removed ALL permissions to that registry branch - including system. I just made sure that the Everyone group had read access.

That's it.

[Ageman20XX]

Hi, yeah, I sorta used that little uninstall program up at the top, and now, a day later, my homepage is back to about:blank. Is it possible that I seriously screwed up when using this little executable and now I'm screwed big time 'cause it's really a virus or something?

-Age

[tired of spyware]

it works!

[Rich1210]

I've had this problem for two months and tried all these suggestions and dloaded a ton of programs. In the end you know what worked? Rebooting in SAFE MODE and sweeping with ADAWARE. ADAWARE always removed it, but it keep coming back, only when I did it in SAFE MODE did it work. Two days now and no regeneration. Try it, much simpler.

[Rich1210]

Completely worked, give it a try.

[Fatboy]

Hope is on the way !!

I tried the "uninstall" program cited above but only found about:blank reloaded itself again after rebooting. CWshreader was no help since the *.dll was hidden. Anyhow, I tried manual procedures from this link

http://www.akadia.com/services/about_blank_virus.html

After going thru the procedures then run CWshedder again,the virus is now gone !!

Best of luck to all

[Ack!]

Managed to get rid of this pest, not by posting...
I followed someone elses post advice out of Computer Cops. It may not work for all.
From what I understand this problem has many variations. So, beware, & be careful.
I'm not an expert. Better to follow an experts advice, but, I wanted to add to this, in case it may help someone else. Goodluck, & gooday!
Here is what I did.
Registry hack on the AppInit_Dlls...Scroll through the whole thread, & read all first. Like I stated...
You may not have the same problem w/ your PC.
If posting this link is considered spamming, or is against forum rules, please accept my humble apologies. Only trying to help others.

http://computercops.biz/postx24263-0-60.html

[Strut]

Nice Fix. I had also tried all the Spyware Software etc with no luck. Cheers.

[pops2910]

thanks man i couldn't figure out how to get rid of it

[?zach8804]

god bless this site rite here just go to it click remove software and the damn thing is gone with a quick flash of the screen

[?zach8804]

oops forgot to mention the site: hxxp://www.oz.msie.tv/

[chew]

Call me paranoid but ...

Why are there so many Junior members & Guests advocating using this piece of software?

I would wait for the Senior Moderators or trusted source to recommend this software rather than Junior member or Guests.

I think it might be a good idea Not to install it this software until full clearance by experts...

I was just about to tell a friend to install this software on his pc to help him as his is very badly infected and he is very stressed now.

However, another friend of mine, a car mechanic with no computer knowledge whatsoever, learned all about Registry keys in one week and got rid of the Browser Hijack or whatever they are ... using a ... Dummy Registry Key and tricked the hidden code to attach itself to that Dummy Registry key and got rid of it. He had to try it one by one.

Again, please becareful. You might do more harm than good.

:-\

[Rich F]

All this is both encouraging, but inCREDibly frustrating.

Where ARE all the posts by experts and senior member explaining how to rid computers of the about:blank scourge?

I see a lot of (wise) cautionary notes on (apparently) effective but unverified methods -- but NO advice or methods posted by said experts.

What gives?

Thanks -- I'd be grateful for any substantive response.

[XXX]

Yes, please help us, experts.

[Bubba]

-{ Quote: "Where ARE all the posts by experts and senior member explaining how to rid computers of the about:blank scourge?" }-Since Wilders no longer offers system cleaning services....one thing you can do if you wish is to visit the below link. It's a search from our adware, spyware & hijack (http://www.wilderssecurity.com/forumdisplay.php?f=26) Forum when it was open for business....using blank as the search criteria and has many examples of ...."experts and senior member explaining how to rid computers of the about:blank scourge"

This link---> http://www.wilderssecurity.com/search.php?searchid=134214

If your wanting to see more examples....OR....if you have the about:blank scourge....you could visit two of the busiest Forums dealing in this crud.

http://computercops.biz/modules.php?name=Forums

http://www.spywareinfoforum.com/index.php

[snapdragin]

To add to Bubba's post, for a list of the many variants of the CoolWebSearch trojan (about:blank being one of them) you can read The CoolWebSearch Chronicles (http://cwshredder.net/cwshredder/cwschronicles.html).

As you can see, there are many variants of this hijacker/trojan and usually the person's computer would be infected with more than one variant. The automatic cleaning programs (anti-spyware programs, etc) do not always remove all pieces of this infection, so even though it may look like the system is clean, you could find yourself re-infected within days or even hour's later.

Most of the newer variants are quite difficult to remove if not sometimes impossible to remove, and will require manual removal involving posting a hijackthis log, having it reviewed by an experienced Hijackthis log Analyst, who would then post step-by-step instructions, which could also involve using specific removal tools and several postings of new logs before the person's computer would be clean of this type of infection.

As we no longer provide hijackthis log review at Wilders as per our Posting Policy stated in this Announcement (http://www.wilderssecurity.com/showthread.php?t=42148), you will be able to find a list of sites that still do perform this type of log analysis and system cleaning in this link: http://a-sap.org/

Hope the above helps to answer your questions.

Regards,

snap

[Joedanger]

That link at the top is gone ... but i REMOVED THE <snip> WITH THIS PROGRAM http://www.adwareaway.com/index.html download it and follow the instructions...............

can any1 email me and tell me how good i am ... if the program works for you!!!

~removed email address to prevent harvesting - Bubba~

[manOFpeace]

I had written a post on how, hopefully, I got rid of about:Blank. On second thoughts I deleted it, a lot of people read these forums. ;D

Looks like CWS gone for the present. Much as how I would like to tell my tale, I don't see any point in freely publishing it. ::)

[Paul2]

Thanks for the tip , it really worked ! What about this tool ? '' Remove about:blank Buddy '' Remove about:blank Buddy is freeware tool to remove unwanted Internet Explorer about:blank home page.

Remove about:blank Buddy lets you keep default home page from changing by removing home page hijackers and restoring original configuration.

http://www.scosoft.com/

Anyone tryed it ?

[Pieter_Arntz]

You will find a way that does no harm if you are on the wrong track here:
http://forums.techguy.org/showthread.php?p=2023378 (post #15)

-{ Quote: "I've developed a canned speech:

Prepare CWShredder:

Download CWShredder (http://www.intermute.com/spysubtract/cwshredder_download.html).
Save it to your desktop.
Do not run it yet. We will run it later.

Run Symantec's BackDoor Removal Tool:

Download the Backdoor.Agent.B Removal Tool (http://securityresponse.symantec.com/avcenter/venc/data/backdoor.agent.b.removal.tool.html) from Symantec.
Follow Symantec's instructions for how to run it.
Be sure to save the log file. I will need to see it later.
Restart your computer.

Run CWShredder. Be sure to click Fix as opposed to Scan Only. It should find some things and remove them.
Restart your computer once more.
Post a new HijackThis log and the log Symantec's tool gave you.
" }-

But make sure you are using the proper tool for your problem. Get guidance if you are not.

Would you first try 20 different medications before you went to the doctor for a diagnosis? ;)

Regards,

Pieter

[manOFpeace]

It's a vicious circle. I realise people need help, also it seems counter productive to inform the devils of the methods of removal. :lurking:

[mad_dawgz]

i dont get it? i use spyware gaurd..and if things chnage like homepage it lets me know?... also about blank is right there near hompeage a button??... y make that button ?..anyhow i tried to go to that website tv thingo? looks like a search engine? i couldnt see any uninstall tool to save to desktop?..maddawgz

[Frustrated Texan]

-{ Quote: "Thanks for the tip , it really worked ! What about this tool ? '' Remove about:blank Buddy '' Remove about:blank Buddy is freeware tool to remove unwanted Internet Explorer about:blank home page.

Remove about:blank Buddy lets you keep default home page from changing by removing home page hijackers and restoring original configuration.

http://www.scosoft.com/

Anyone tryed it ?" }-


The tool from SCOSOFT is not free (they make you register as the next to last step.) It cost me $19 -- and it didn't work.

What a pain.

[myluvnttl]

Is this about:blank a homepage where you can setup as your MAIN START-UP Homepage so it will show a blanks screen start-up homepage so IE can load up faster, or something else?

[snowbound]

-{ Quote: "Is this about:blank a homepage where you can setup as your MAIN START-UP Homepage so it will show a blanks screen start-up homepage so IE can load up faster, or something else?" }-

Take a look here,

http://www.softwarepatch.com/tips/about-blank-adware.html

for details on about:blank.



snowbound

[synapse]

whats wrong with about:blank, isnt that an option in explorer to let that be your homepage

[verat]

If you want to remove anoying about:blank Search page just go to Add Remove programs and remove program called Search Assistant. It worked for me, maybe it works for somebody else. Have a nice day folks.

[anony]

Greetings. I tried using the search bar, then deleting the search results, and found the exact same webpage (hxxp://www.oz.msie.tv/)

However, the "uninstaller" is gone now.

I don't suppose anyone saved it, eh?

[anony]

Oops, didn't even try verat's suggestion, the uninstaller is indeed there.

[Bzo]

-{ Quote: "If you want to remove anoying about:blank Search page just go to Add Remove programs and remove program called Search Assistant. It worked for me, maybe it works for somebody else. Have a nice day folks." }-


This worked for me...Thanks!!!!

[Stevo60]

Thanks Verat...I removed the Search Assistant and the about:blank problem is GONE!!!!!!!!!!!....Thanks

[Mele20]

About:blank is my home page and I don't have CWS or any spyware. Large numbers of computer users have about:blank as the home page. It has nothing to do with spyware.

I had a Dell field tech over here Monday installing a new modem and he saw that on IE and thought I had spyware!!!:D

I don't see how a legitimate setting for IE (or any browser) is spyware. I assume the about:blank you all are talking about is something entirely different from the legitimate setting for a browser? If so, I would suggest using some other wording so that the two are not confused. ;)

[LowWaterMark]

-{ Quote: "About:blank is my home page and I don't have CWS or any spyware. Large numbers of computer users have about:blank as the home page. It has nothing to do with spyware.

I had a Dell field tech over here Monday installing a new modem and he saw that on IE and thought I had spyware!!!:D

I don't see how a legitimate setting for IE (or any browser) is spyware." }-The normal blank page setting in IE (when set via IE's Tools menu > Internet Options... > General tab > Home page section > "Use Blank") is not spyware, of course. The problem is that the infection they're talking about uses the name about:blank to fool people into thinking it's just the normal blank page, when in truth it's a nasty spyware infection.

It's really not much different then a virus being named very similar to a legitimate Windows file (for example, calling itself scvhost.exe instead of svchost.exe).

-{ Quote: "I assume the about:blank you all are talking about is something entirely different from the legitimate setting for a browser? If so, I would suggest using some other wording so that the two are not confused. ;)" }-We didn't name the infection, the infectors did. Unfortunately, the name has stuck and after almost a year of being called about:blank, it isn't going to change now. And yes, many people have mistakenly thought the legitimate about:blank setting in IE is the infection because of all this.

This reference will tell you something about the first appearance of about:blank, I believe:

http://www.spywareinfoforum.com/~merijn/cwschronicles.html#aboutblank

If you search that page for the word "blank" you'll find more then just the one reference, but many variants.

[livig]

-{ Quote: "If you want to remove anoying about:blank Search page just go to Add Remove programs and remove program called Search Assistant. It worked for me, maybe it works for somebody else. Have a nice day folks." }-

After dealing with this problem for weeks with no luck, this was the simple solution. If you are reading this, save yourself the time by following these instructions.

[I hate about:blank]

i tried going in safe mode and using adaware. didnt work. this is ****ed. ive tried alot of the solutions posted and nothing is working

[TopperID]

Yes, but have you tried this:- http://www.pchell.com/support/aboutblank.shtml

and this:- http://www.adwareaway.com/

If it works please let us know.

[bbbb]

the pchell site will get rid of some of the variants, there are plenty of spyware programs that will remove "about:blank" and they will even scan for free and tell you if you have it. But its just the fact if you want to shell out the money to get the program or would you rather keep searching online for a supposed "free" scan that will remove it.(nothing worthwhile is free)

[john doe]

when i click the "link" (hxxp://www.oz.msie.tv) it brings me to this search thing. I barely know how to turn on my computer so i kinda need more help.

I HATE THIS DAMN HOMPAGE!!

[sonicseven]

me omg comon guys i need help i want to get rid of this stupid about:blank

[sonicseven]

me2* that site you guys gave takes me to a search engine

[nobodyelse]

I used this.......



To remove about:blank open your browser then go to view source. Look for a string that looks like: res:%43%3a%5c (etc).

Make a copy of the complete string then go to http://www.simplelogic.com/devel oper/urldecode.asp

Paste the string in here and press "clean data" you should get some ***.dll file.
Write it down then shut down your computer and restart it but DO NOT go online yet.

Go into "Find files or folders" type in the ***.dll

when it appears move it to your desktop then delete it (or if you cant then rename it)

and finally scan your computer with any malware scaner e.g adaware
to delete any remaining parts of the program.

Now all you need to do is right click on your browser go into properties delete about:blank and type in what ever your homepage address was and click apply.

[f*&cko]

I'm reviving this post ---- I don't know if anyone cares, but the steps don't go anywhere. Perhaps they've removed the uninstall? If I do exactly what Sage has said, no joy.

Some of the comments in here mention how difficult this thing is to remove.

Here is a fire and forget way.

Run Hijack This, and Fix the about.blank entries, and remove unknown BHOs and filters.

From another profile (log off affected user profile) as admin - navigate to documents and settings\USERID\Local Settings\Temporary Internet Files

This needs to be done from a command prompt (Start, Run, CMD)
Once there, do a cd content.IE5

Then, type del index.dat

Reboot it.

Run HijackThis again, and remove the about:blank entries and unknown BHOs and filters.

Reboot it.

You should be clean.

[Dawnstealer]

Realize I'm resurrecting this thread, but it's near the top on Google searches, so I'll post the reply here. Realize I'm not exactly a "frequent" poster, so I'll plop down a simple fix that (so far) has worked for me. The real problem is that there's so many versions of this virus/hijacker, that the standard fix suggested on all of these forums no longer works (search for various .dlls, delete them, etc). Not sure why, but I guess the Russians that hacked that piece of crap together read these forums, too.

Here's what I did (for XP):

1) Install Firefox (or Opera8, or Mozilla).
2) Go to Start > Control Panel > Add/Remove Programs
3) To the left of this screen is an option to "Add/Remove Windows Components". Click it.
4) Scroll down to Internet Explorer.
5) Uncheck it.

Worked for me...so far.

[zorro zorrito]

Hi all, recently, a friend of mine had this problem, 5 days ago, I made many thing to eliminate it and I couldn´t until I did this:
1.-disable restore
2.-run in this order: spysweeper(found some), hijackthis(all things that terminated with aboutblank),spybot search and destroy(found some), and CWShredder(it found an invisible dll.).
3.-restart the computer(CWShredder asks for it, that´s why I run it the last one.
4.-I did it once more from 1 to 3 (so that I did it twice).
5.-went to internet and there was no problem.(I saw that with one program it is not posible to eliminate it, because it restores itself if a little part of it stays in you PC, so that it is better to use many of them to eliminate all of it´s components, and no program does that in my experience. (I say this because before I run this programs separetly and it didn´t go, for example, I used CWShredder, eliminate the invisible dll, restarted and the problem once more, same for spysweeper and the others, so that I recomend to run all of them and the last one has to be CWShredder, and very important do it two or three times).
Then inable restore.
I hope this works for you.
(My friend didn´t have the uninstaller at add delete, that would be an easyer solution).

[bobsearle]

I have tried another angle.

1. Use the source code from the home page, identify the dll file the hijacker uses.

2. Locate the dll file on your machine, then in either safe mode or floppy boot, edit this file by selecting all then deleting and saving the file. Also do the same with the se.dll.

So far, this has worked for me, as the added programs find their associated dll, and leave the machine alone.

[Spoonfed]

Hi. I had this version of CWS that was really tough to get rid of. I believe I got it from one of two different websites, ww*.isohunt.com or ww*.torrentspy.com (I know, I'm basically asking for it if I'm going to sites like that, but, I still think this might help further the cause for fighting adware). My computer has a program called SpySweeper by Webroot on it, and after hitting the sites, 3 notices came up saying 1. that a file "se.dll" in my c:\documents and settings\generic user\local settings\ directory was trying to install itself, and gave me the option to deny it. 2. The IE homepage was trying to change 3. The search pages were trying to change. So, I'd hit deny/remove on all 3 of those, and I would be OK for like 15 seconds, then it would try it again. Using Ad-Aware would pick up a CWS problem, but, it would come right back again. CWShredder found something, and removed it, and never found it again, but I still had the about:blank problem. AboutBuster didn't find anything. And the SpySweeper would find something (but not as much as AdAware) and remove it, but it came right back.

So, I ran all 4 programs, then restarted into Safe Mode. I found that se.dll file that SpySweeper detected, and deleted it. Then, I ran all 4 programs twice in Safe Mode. That found a whole bunch of nasty stuff, and removed it all. Then I restarted normally, ran each program once more, and they didn't find anything. (yeah, it took a while to do this) Now, I appear to have no problems so far, (fingers crossed).

I hope this helps somebody, Peace!

[dhull]

I dont see an uninstall software link anywhere on that site? Please help!

[snapdragin]

Hi dhull,

Please see Pieter's post here (http://www.wilderssecurity.com/showpost.php?p=283443&postcount=40). Follow those instructions, then followup with posting a HijackThis log at one of spyware removal forums for a more indepth analysis by an experienced spyware Expert, to ensure all traces of the CWS infection is completely removed from your system.

As we no longer provide hijackthis log review at Wilders, you can find a list of sites that still do perform this type of log analysis and system cleaning in this link: ASAP (http://asap.maddoktor2.com/)

Two of the larger forums for HijackThis log processing, (meaning they process more log threads each day than many others) are: SpywareInfo.com (http://www.spywareinfoforum.com/index.php) and CastleCops.com (http://castlecops.com/forums.html).

Good luck,

snap

[dhull]

thank you, I will try that. I bought noadware, claimed to remove all variants of about blank. even sent them a diagnostic log, getting no help from them.
ty again for your reply.

[BoBo]

Yes! safe mode worked for me too, very simple! Thanks for a hint!

[my pc is infected]

Can someone tell me how to get rid of about blank I run microsoft antispyware it finds about blank but does nothin. I cant get rid of it someone tell me how to get rid of it please?

[snowbound]

-{ Quote: "Can someone tell me how to get rid of about blank I run microsoft antispyware it finds about blank but does nothin. I cant get rid of it someone tell me how to get rid of it please?" }-

The best way is to follow the instructions in snapdragin's #68 reply.



snowbound

[queenkatt91]

ty you everyone for posting, i had this problem once before had gotten rid of it and now its back. for those of you who have this problem also, all i have to say is watch where you surf. my husband isn't very web savvy so i am now battling this problem again. i have run almost everyone of the programs listed through out these postings, and i think those of you have run them all one after another in safe mode are onto something. my question is how to find the hidden file. i know that about:blank creates two files one you can find and delete and one you can't. and i remember the first time i did this having to go simplelogic and "cleaning" the string. how do i find the string?

thanks for all the help already listed and hope someone can help with what isn't?

ps microsoft antispyware is a beta program for those who didn't know that and so far i like it. it catches what its supposed to but this hijacker is evil in its self replication

[queenkatt91]

please help, this is going to drive me crazy. i have followed every set of instructions given. nothing is working. i can't get home search assistant off of my computer or about:blank. evil evil evil.

[TopperID]

Yes you can get this off your machine. But you should submit a HijackThis log to a suitable Forum. You can D/L HJT from here:- http://www.spywareinfoforum.com/~merijn/downloads.html

Then have a look at these tutorials:-

http://www.tomcoyote.com/hjt/

http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Then post a log here (but do please read the 'stickies' first):- http://castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html

[queenkatt91]

how do i know that the info in my registries won't be used against me later? if i post that log?

and what exactly am i supposed to scan with hjt?

[TopperID]

If you read the tutorials and make a log as explained in them, you will soon see that it does not reveal any confidential info that you would be afraid of sharing. But if you don't post the log you may just as well reformat.

You don't scan anything by way of selection, HJT scans the things it needs to scan.

[queenkatt91]

ok thank you very much. sorry i am so skeptical

[Roffa]

I'm not able to get into the site.
Are you sure it's hxxp://www.oz.msie.tv?
All I get is a search page

[G-Force]

Welcome Roffa!

Are you referring to this (http://www.wilderssecurity.com/showpost.php?p=391883&postcount=58)? The x's were substituted to avoid "live-linking" to a known hijack site.
If your suffering these symptoms, top advice here (http://www.wilderssecurity.com/showpost.php?p=432847&postcount=68) as Wilder's presently does not offer HJT log reading's.


GF

[ajwassoc]

I have seen a variety of dofferent solutions spoken about here and was curious as to see if anyone has tried this software for about:blank removal
(since I found this via Google):
pcwash.com ??????

AJ

[snowbound]

-{ Quote: "I have seen a variety of dofferent solutions spoken about here and was curious as to see if anyone has tried this software for about:blank removal
(since I found this via Google):
pcwash.com ??????

AJ" }-
Well, SpywareNuker has had a very dubious past but according to this link,

http://www.spywarewarrior.com/rogue_anti-spyware.htm#swn_note

as of last year, they have cleaned up their act. Personally, i wouldn't touch it but that's just me. ;)


snowbound

[HD rider UK]

-{ Quote: "I have seen a variety of dofferent solutions spoken about here and was curious as to see if anyone has tried this software for about:blank removal
(since I found this via Google):
pcwash.com ??????

AJ" }-

The phrase "Not to be touched with a bargepole" springs to mind.

There are so many variants of CWS and About:blank around now, that the only way to be sure of getting rid is through HJT log analysis. I have not seen an application which ON ITS OWN, gets rid of everything, it usually requires the application of a number of different tools, Deletions through HJT, and when you have one of the variants that changes its own file names.... oh boy.

HDRiderUK

[Joel Monkarsh]

Many thanks. This is worth a try. I stupidly clicked on an item on Craig's List and found I had an embarrassing web site (spyware, quasi-porno) in my address bar on the upper right portion. Out of frustration, I used a cyber scrubber. The embarrassing web site is gone, but "about blank" remains. If your solution works, I won't have to buy yet another version of anti-spyware software.

[Joel Monkarsh]

7/24/05

From: Joel

To: Sage

I'm confused "about blank". I showed your solution to a colleague, so before I try to remove "about blank", I want to be doubly sure your solution won't screw up my machine more than it already is. I have run Norton's, and my computer does not appear to be a virus. Is "about blank" just an annoying piece of spyware?

[Joel Monkarsh]

7/24/05

From: Joel

I've been reading the threads "about blank" very carefully, because I primarily don't want to do any hard to my computer. There appear to be quite a few solutions, and I am trying to double check to see how many have tried them before I test them out.

Looking at Dawnstealer's March 2005 post, do I later recheck the Add/Remove Component?

It appears that "about blank" seems to replacing some desktop home pages, unless I misunderstand the postings. "About blank" seems to be living in my browser. I get that annoying item after clicking Internet Explorer, so that's what I initially see in the Address Bar.

I don't believe this is a virus, at least according to Norton's. Unless I am mistaken, it is a result of either spyware or cyber scrubber that did not entirely work.

[Trekk]

/shrug....I just used Hijackthis and it got rid of it after Spybot and Adaware couldnt.

[ajwassoc]

Yeah, they (Spyware Nuker) cleaned up their act. The software worked for me and I still have it installed. It is working better than MS's anti-spyware at the moment. I did use this pcwash.com again since my original post for the same about:blank problem. It worked.

AJ

[Mrkvonic]

Hi,
In the spirit of recent days, are you sure you did not install a rootkit that now hides the infection? Just joking, but think about it guys...
Do not use anything before advising with a significant number of people, both in real life and online, in different forums. This tool could indeed be a jewel, but using it on the whim is not the best way to do...
Cheers all, good luck,
Mrk

[rogues]

pcwash.com does not hold the best of reputations:
http://www.spywarewarrior.com/rogue_anti-spyware.htm#swn_note

[MisterEd]

Sage; What is "(link deactivated - LWM)" And can I drag & drop the uninstall to my desk top? I tried to download it with DAP and it told me it was an html and wanted to open the browser!! Plus the drag & drop was just a .gif !