The about:blank homepage hijacker is a variation of a more advanced Cool Web Search hijacker. Till date aboutblank is amongst the most prevalent spyware program on the net, largely because it is nearly impossible to remove.
Behavior of About:Blank
Spyware about:blank hijacks your browser’s homepage and redirects you to its affiliate websites where it can make money off of you. Aboutblank process snoops on Your Online Activities and distributes the data back to CWS servers. This detailed user profiling is then used to 'tailor' a marketing plan or advertising campaigns (popup ads and junk email advertisements) to target the user with.
About:Blank displays the following characteristics:
1. Substitutes browser’s home page with a new one titled "about:blank". This page contains a pseudo-search engine with various subjects like "art", "cars", and "shopping".
2. Installs a Browser Helper Object into Internet Explorer by dropping a hidden dll file which shows up in the following registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \ CurrentVersion\ Windows\\AppInit_DLLs
This BHO consumes system resources and slows down your Internet connection.
3. Starts with the operating system and is difficult to remove from memory. If you remove it from the auto-start settings, it will restore itself there.
4. Aboutblank has the potential to restores itself if you try to delete it’s file directory or registry settings.
5. Later versions change their executable to avoid detection by the simple hash recognition algorithms that most anti-spyware products use.
How do I remove About:Blank and get rid of it for free?
Download Spy Sweeper tool to get rid of aboutblank and protect your computer from all such spyware hijackers and adware pests which infect your computer.
Remove about:blank – the aboutblank hijacker manual removal instructions
Unfortunately removing about:blank hijacker can be difficult. It’s a very persistent problem that can return quickly if it is not removed carefully.
CAUTION: We strongly urge that you back up the registry before making any changes to it as incorrect changes can result in permanent data loss or corrupted files. Please modify the specified keys only. We strongly recommend you to Download Spy Sweeper in order to safely remove aboutblank and other pests that might have infected your computer.
Credit: The thorough step-by-step and example was taken from Time2Early post in www.computercops.biz
To Remove "About:Blank" Hijacker AdWare in Windows XP Home edition Service Pack 1 with Internet Explorer 6.0 (probably works in NT and 2000 with some directory name changes only) follow this procedure:
Programs Needed to manually remove aboutblank:
You can find more info on hijackthis on spyware removers.com
AboutBlank Removal Procedure:
There are two application extensions (.dll) files that Need to be deleted. One is hidden while the other one is detected with "HiJackThis.exe"
1) remove about:blank step 1: With "Reglite.exe" find name of hidden file:
Double Click on "AppInit_DLLs" located in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\ The "value" window reveals the hidden file name.
In this example we'll call it "hidden.dll"
Browse to the file, right click it, select Properties. Under the General tab, uncheck Hidden and Read-Only. Select the Security tab and Check the 'Full control' check box to allow deleting it.
Try deleting the file (Shift + Del or right click and Delete) If it was impossible to delete the file, continue to step 2. Otherwise skip to step 3.
2) Rename the hidden file:
Close Windows and reboot using "Windows Recovery Console". Browse to the system32 directory located at: C:\Windows\system32\. Replace this path with your system32 directory. In order to know your system32 run cmd and type:
After finding your system32 directory do the following:
a) Change file from read only by typing attrib -r hidden.dll
b) Rename the file (For some reason this only works after rename) type: rename hidden.dll nasty.dll (and remember that "hidden.dll" is for this explanation only use the name you found earlier)
c) Type "exit" and reboot to Windows.
3) Edit registry to remove hidden file:
Run "reglite.exe" again.
Double Click on "AppInit_DLLs" located in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\. Delete the file in "value" window, the "size" window changes also. "Apply" changes and exit "reglite.exe"
4) Edit registry to remove the second file:
Run HiJackThis.exe and scan the registry.
Check the boxes to remove the following entries:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
(as you can see the second .dll in the example was called "jheckb.dll" yours may be different)
For this example let's call it "obvious.dll".
* Note: As there are MANY variations to this hijacker, the registry entries might differ from the ones listed above. If the entries are different, look for entries containing the name of the second DLL, in this example jheckb.dll.
5)Finally delete the two .dlls ("hidden.dll" and "obvious.dll").
That's it! You should be running again. You have successfully removed the about:blank homepage hijacker by following our remove aboutblank uninstalling and removal guide
In general we strongly recommend to use a anti spy software to remove and uninstall about blank and other spyware and adware as manually uninstalling and editing can seriously hurt your system.
Click Here Now! and download spy sweeper. Spy Sweeper wil scan your computer for about blank and other spyware, adware and browser hijackers. Use it to SAFELY remove about:blank and all of its components. Protect your privacy and home page from aboutblank NOW!
To know about other such spyware / adware / trojans and to find out how you can protect your system by safely uninstalling and removing them, please check out our other articles in the Getting Rid of Spyware and Adware article series. For easily protecting yourself against such threats and to easily get rid of them, please download free spyware adware removal tool - Spy Sweeper..
return from remove aboutblank to free spyware removal