About blank, searchklick browser hijack
About blank, searchklick browser hijack
Author
Discussion

rolex

Original Poster:

3,120 posts

288 months

Saturday 17th September 2005
quotequote all
Absolute nightmare this one. You need to download several different programmes, spybot adaware cw shredder ect and then go and delete and add stuff in the registry in safe mode. Too much for me, so I have consigned IE to a locked drawer and started to use mozilla which incidently is faster. Ad-aware spybot and others recognise the problem but after deleting, replicates itself on reboot. Anyone else had this prob?

aldi

9,288 posts

267 months

Sunday 18th September 2005
quotequote all
Yes, had to deal with a nasty case of about:blank a few weeks ago. If I remember correctly, there was one randomly named executable that kept coming back apparently from nowhere and kept re-infecting the system. Got pissed off with it after an hour and just set 'deny all' permissions on a fake executable with the same name, it didnt come back after that

__Lee__

7,520 posts

273 months

Sunday 18th September 2005
quotequote all
As you are not comfortable with removing the problem yourself, I would recommend these products.

Spysweeper which is easily the best anti-spyware product on the market.

McAfee's Stinger is a excellent little application that doesn't need to be installed and once you have downloaded it, it simply runs a scan on your machine.

And if all else fails Norton can sometimes save the day!.

I would recommend you download the trial version on Spysweeper though. If you are not running it, you will be surprised what it manages to find and kill.

My record is 1,900 traces and 247 spyware applications!.

Hilts

4,684 posts

312 months

Sunday 18th September 2005
quotequote all
rolex said:
Absolute nightmare this one. You need to download several different programmes, spybot adaware cw shredder ect and then go and delete and add stuff in the registry in safe mode. Too much for me, so I have consigned IE to a locked drawer and started to use mozilla which incidently is faster. Ad-aware spybot and others recognise the problem but after deleting, replicates itself on reboot. Anyone else had this prob?



Yes, here's how to get rid. Not too hard to follow.


1) About:Buster - Download it and extract it to C:/aboutbuster.
2) CleanUp! - Download it and install it.
3) CWShredder 2.11 - Download it and save it to your desktop.
4) Ad-ware - Download, install, and update.

Enable hidden files and folders:

During the fix do NOT connect to the internet. Unless you can memorize these instructions, it would be a good idea to print them out.

Boot into safe mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Run AboutBuster
-Click Start to begin the process
-Click OK on the Buster Report dialogue box to start the scan
AboutBuster scans the computer for malicious files and deletes them.

Run CWShredder
-Next, click on the: ‘Fix’ button
-Follow the prompts, and press OK

Run CleanUp
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Run Ad-Aware
-Configure Ad-Aware for a full system scan
-Run it

Clean Up the left overs

Run regedit from the command line and search for these files and delete them if they are still there.
Just click find and search for 'blank'.

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:blank
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page = blank.htm


Jobs a goodun

>> Edited by Hilts on Sunday 18th September 12:27

Bodo

12,603 posts

296 months

Sunday 18th September 2005
quotequote all
Who said using Linux is difficult?
scnr

rolex

Original Poster:

3,120 posts

288 months

Sunday 18th September 2005
quotequote all
Thanks for replies Fraid spy sweeper does not work. Hilts, im going to give it a go. Im going in now I may be some time.

rolex

Original Poster:

3,120 posts

288 months

Sunday 18th September 2005
quotequote all
Well I downloaded all the programmes ran them in safe mode went into regedit deleted one reference to "about blank" but the prob is still here Ran the procedure twice to make sure. Heres what spybot says I still have

Backweb lite
coolwwwsearch.aff.winshow
coolwwwsearch.homesearch
coolwwwsearch.searchklick
trek blue error nuker
windows security center. antivirusdisable notify
Thanx Hilts anyway, learned about some of the inner workings of the computer today