About:Blank is one of the most frustrating Browser Hijackers to stay around as long as it has and continue to do damage to systems. If you are hit you will totally be frustrated until you realize you have to do something.  What you see that tells you your system has been hijacked by the About:Blank Hijacker is that each time you open a new browser window, you receive a blank window with “About:Blank” on the address bar.  What causes this is that this Hijacker has corrupted Lucky users, after repeatedly entering URLs can occasionally obtain access to web sites but most often, all users see is a blank white, empty page. Trying and retrying to get a working page is typical for most techies and geeks and so this Browser Hijacker can linger before you do something about it. The intermittent good browsers that behaves normally is good enough to let us not worry about it for a while, until it responds poorly again – which, in this case will be shortly, usually in one or two window openings.

This Hijacker has been around for 5 or 6 years and infects computers by displaying a false directory webpage whenever the browser is opened and shows About: Blank in the title and address window.  One of the most frustrating things about this Hijacker is that is will not let you change your browser’s default homepage and if you do figure out a way to change it, it will change it back.  This Hijacker may also add new websites to your IE favorites, install an adware toolbar to your settings, and of course, hit you with tons and tons of pop-up ads, over-riding all of your settings.

Here is the real killer to all of this; the developers of this Hijacker earn incomes from the advertisements that are displayed on all of the infected machines. Each time you click the links on the directory or search result pages, you are earning money for the Hijacker developers. 

Then, we also have to wonder if the fixes to these aren’t also part of the whole Hijacking mess.  And, here is why: there are ways posted on the web to try to help you fix this but guess what, you cannot totally remove this problem without going out and purchasing a tool.  You can use free tools to scan and identify the infected and damaged files but in order to completely fix the problem and have a clean machine you end up forking out some bucks. I have had this particular Hijacker hit one of my machines that was protected with Norton, Avg, Avast, and a couple more.  Ended up having to add another to my protection suite.

Avg and Avast have proved to be good tools for me.  Both are free.  Both work well.  I have just added XoftSpySE and so far so good. It was the only app that cleaned up and removed the files that were infected.  The others only identified and quarantined.  Not sure why. PC Tools, SpyWare Doctor, Regcure are just a few that you may want to try.   But, don’t purchase before you run a scan and see how many infected files that tool locates. 

Here is the download link for the XoftSpySE tool:

http://www.paretologic.com/download/xoftspyse/revenuewire/?uid=pnh24

Now, there are always those sophisticated users that want to try to clean their systems without the help of a tool.  If you are one of those, you can use the REGISTRY EDITOR to attempt and I do mean attempt to remove about: blank.  First step, backup all of your files. 

If you do not have a backup program, then you can use the Windows Backup Tool:

Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup to start the wizard.  Choose which files you want to backup and where.  I would recommend making a copy that you can store “off-site” away from your machine just in case of emergency. 

Before we go over the steps to try to manually remove the About:Blank components, let me preface with a general word of advice:  manual removal of malware, adware, spyware, or viruses can damage important components of your computer. As a result of an improper removal, the computer may not function properly or it may not function at all. Consider the acquisition of an effective and safe anti-spyware program for the safety and security of your computer.

Moving on, the following steps outline the process that you can follow to attempt a removal of About:Blank from your computer:

Click Start, Click Run, Type ‘regedit’

Click ok to open the registry editor

Remove the following registry values:

06abaa2d-34ab-4902-a326-409bd9b9a7a5

b664647f-efd5-4837-a810-a807139107e5

HKEY_LOCAL_MACHINE\software\microsoft\windows\ currentversion\runnetworkservice

ce6a1268-9cc9-4ba3-8657-fe1132906cc4

HKEY_CURRENT_USER\software\microsoft\windows\ currentversion\runnetworkservice

In addition, the following About:Blank processes also need to be removed:

phafxfa.exe

svhost.exe

smbdins.exe

sethcd.exe

tsmsetup.exe

You will also need to delete or remove any and all of the following directories and their files if they are present on your computer:

phafxfa.exe

svhost.exe

smbdins.exe

sethcd.exe

tsmsetup.exe

wdm.dll

achpjba.dll

cbme.dll

se.dll

iesp1.dll

The following DLL files will need to be unregistered:

wdm.dll

achpjba.dll

cbme.dll

se.dll

iesp1.dll

The above lists are representative of the directories, files, and folders that may be found on your computer if About:Blank has been installed. Variations can exist due to the fact that these programs are constantly making new versions in to outwit savvy computer users. About:Blank has also been known as About Blank Hijack, About Blank Trojan, About Blank Homepage Hijacker, About:Blank Search Hijacker, CWS.Aboutblank, About Blank Spyware, and About Blank Virus.

Very often About:Blank is actually seen on the Add/Remove Programs.  So, you should check and make sure that it has been completely removed from your computer. Open the Add/Remove Programs in the control panel to see if About:Blank is listed.  If it is there, you most likely have not removed it all and will need to continue your manual search for other infected files.  Or, realize that you need to use a Scan Tool from a 3^rd party vendor to locate the infected files.

Nothing like taking a 13 MacBook or 15 /17 inch MacBook Pro and connecting to a 50” or 60” flat screen!!!  From experience, let me tell you how awesome it is!!!!

Are you one of those that has been trying to piece together cables so that your MacBook or MacBook Pro would work with your HDTV or other HDMI compatible device and doing so without much luck, only to find out, after lots of research that others are struggling too and there really isn’t a sound solution available?  Well, I’ve got some good news for you but first, lets me remind you that there are solutions available.  You can put together a solution that does work and that does allow you to use your laptop (MacBooks) on your flat screen TV’s.  Some may ask why – but, think about this……..sitting in your  favorite couch potato chair, in front of your Panasonic 50”  or 60” flat screen TV and deciding that you want to do some research on-line so you plug in your Mini-Display port to DVI cable that is connected to a mini-dvi to dvi adapter.  Then you have a DVI to HDMI cable connected to your flat screen TV and walla; there you have it – the Internet as big as life!  Check that configuration out if you have a flat screen in your bedroom – it is awesome to work or research while hanging out in bed or in your other favorite chair. 

So, where do you get the cables and which cables do you get?  Well, of course you can get them from Apple on-line and they are actually cheaper there than most places I’ve found – plus, the quality is pretty good:  www.store.apple.com/us

Now, let me explain something that may help.  There are three kinds of DVI cables. “DVI-I” stands for “DVI-Integrated” and supports both digital and analog transfers, so it works with both digital and analog Visual Display Units. “DVI-D” stands for “DVI-Digital” and supports digital transfers only. “DVI-A” stands for “DVI-Analog and supports analog transfers only.  One tidbit that may be useful is that DVI does NOT transfer audio, only video. 

One of the hardest problems users have is recognizing the DVI cables.  Here is a quick help as well as a reproduction from datapro on how to differentiate between the cables:

There are two variables in every DVI connector, and each represents one characteristic.

The flat pin on one side denotes whether the cable is digital or analog:

                  A flat pin with four surrounding pins is either DVI-I or DVI-A

                  A flat pin alone denotes DVI-D

The pinsets vary depending on whether the cable is single-link, dual-link, or analog:

                  Two separated 9-pin sets (rows of 6) for a single-link cable

                  A solid 24-pin set (rows of 8) for a dual-link cable

A separated 8-pin and 4-pin set is for DVI-A.

If you head to www.datapro.com they offer pictures of the cables that can help you determine what you need. 

The DVI stated signal distance is 16 feet but you can find places that carry 25 foot cables and then if you have extra cash, you may want to pick  up a a signal booster.  But, I haven’t talked with anyone that has ever needed a signal booster for their DVI cable system. But, on the other hand, I’ve never tried going over 12 feet and my research has shown that users going over 16 feet and using the 25 foot cables are not experiencing degradation.  So most likely you wouldn’t need a booster.

What we all need to do is get them to develop the wireless DVI to HDMI.  Imagine a Mini-display port wireless card about and inch long and a quarter of an inch wide coming from the side of your Mac and then a small HDMI wireless connector on your TV.  Now, that is what I want.  There is good news on the development front, not on the wireless front but on the HDMI topic,  Monoprice has developed Mini-DisplayPort to HDMI adapter and was to have it to market in January 2009.  Unfortunately, they are having problems finding vendors that can produce the product for them. Stay tuned for an update, as this is a pretty, darn hot topic and lots of users are waiting for this solution.

http://www.macyourself.com/2008/12/11/macbook-owners-rejoice-mini-displayport-to-hdmi-adapter-soon/

So, bottom line, what you need is a mini-display port to dvi cable that you can get for $29.99 from Apple (http://store.apple.com/us/product/MB570Z/A).  Then,  you grab a dvi to HDMI cable / adapter from datapro that is anywhere from $16.95 to $45.oo depending on the length (http://www.datapro.net/products/dvi-to-hdmi-digital-video-cable.html).  At that point, you have a HDMI ready cable and you are set!  And, it is a beautiful thing when you get it all put together, which only takes about 5 minutes.

I have a Dell Inspiron 518 running Windows Vista. My kids have managed to get it infected with the virus that poses like a virus scanner – XP Antivirus 2008 (runs as XPAntivirusUpdate.exe and xpa2008.exe). I can’t manage to get this damned thing removed, so I’m just going to have Windows reinstalled. 

Yeah, the Vundo trojan and all of its variants (AntiVirus 2009, AntiVirus XP 2008, WinFixer, AntiSpywareMaster, Storage Protector, Sysprotect) can be a huge pain in the butt to remove. My parents got infected by it a few months back and it was one of the more difficult viruses to remove that I’ve run into.

Symantec has a removal tool, but it doesn’t work with all of the variants. Assuming that doesn’t work for you, then you can try to remove it by booting with a Barts PE disk and scanning your machine with McAfee’s SuperDAT.

You may want to give that a try, but in the event that it doesn’t work for you then you can access your Dell’s recovery partition by pressing Ctrl+F11 when the machine is first turned on. The appropriate time to do this is almost immediately after the power button is pressed. A small message is usually displayed that offers to let you enter the BIOS (usually F2 on newer Dells) or go to the boot menu (F8 or F10, I think; it displays the appropriate key to press).

So, assuming that the partition that the recovery image is saved to hasn’t been deleted for some reason, or that the master boot record hasn’t been altered from the factory settings then the Dell System Recovery software will load and you will be given the option to reimage your drive. Their software is basically just a rebranded version of Norton’s Ghost or some other similar imaging software.

Do keep in mind that if you decide to reimage your machine that all of the data that was on your hard drive will be lost. The machine will be exactly as it was when you first purchased it – meaning that any saved documents, movies, music, settings, programs installed by yourself, etc will be gone.

Because of this I would highly recommend that you save anything that needs to be kept to a flash drive or a DVD before you go forward. After the reinstallation of Vista then you can copy the files back to your hard drive (be sure to virus scan them first, it’d be rather foolish to immediately reinfect yourself with the same malware)

If for some reason you’re unable to get to Dell’s recovery software then you can always order a DVD from them that does the same thing.

Good luck.

Back up your data! You wouldn’t believe the number of requests that I get constantly that go something like this: ” My computer was running fine until last night when an electrical storm hit, now when you try to turn the machine on all it says is ‘Operating System Not Found’! Can you help? ”

The answer, almost universally, is no. There are tools out there like GetDataBack for Fat32 and NTFS that I’ve had good luck with recovering data from a crashed hard disk. Even that, however, only works about 40% of the time (if that). Depending on the circumstances in which the drive failed it is entirely possible that nothing is recoverable. Say goodbye to your music collection and all of the photos of your latest trip to Fiji and then cry yourself to sleep.

Alright, now that I’m done berating you, here’s what you can do to prevent the scenario above from happening to you:

1. Crack open a package of burnable media and get to copying your files to them:

   Using products like Nero 8 or Roxio’s Easy Media Creator 10 you can very easily back up all of those files to some CDs, DVDs, or with the latest software revisions (and assuming you have the necessary drive) Blu-Ray disks or HD-DVD disks. Seriously, this process takes only a few minutes for most people and is an absolute heaven-sent in the event that your computer initiates its self-destruct sequence. It’s better to have to redo 2 months worth of work than to have to start again from scratch. I have seen someone lose their PhD thesis because someone dropped their laptop and the drive crashed. Don’t let this happen to you.

2. Buy a removable hard drive and copy your files to that:

   I currently own a 60GB Samsung laptop hard drive that I have in a nifty USB 2.0 enclosure. If you’re running Windows XP or above the installation of a drive like this is as simple as plugging in the device and waiting about 30 seconds while Windows configures it. The advantage of the removable drive is twofold: First, it’s much faster than burnable media as well as the fact that the data on it can be altered easily, which even with a DVD-RW isn’t the case.Second, the storage capacity is much higher. A 120 GB Western Digital Passport WDXMS1200TN is only $75.00. Even Blu-Ray and HD-DVDs don’t have that much storage capacity and they are not as easy to write to.

3. Make an image of your hard drive as it currently is:

   Norton Ghost is one of my favorite applications of all time. Admittedly, I’ve not used any of the current versions because I am fond of the old command-line one, but I digress.Ghost, or a data backup utility similar to it will take a ’snapshot’ of your hard drive exactly as it is right then, bit-for-bit. All of the data on the drive is read, and then written to an image. In the event that your hard drive fails, you can simply purchase a new one and then write that image to the new drive. When you restart the computer it will be exactly as you had it as of the time of the images creation.This is also notably faster than a Windows reinstall. I recently redid my parent’s computer and using the image I had made them after I got their system running the way that I liked it the first time took about 5 minutes. I started the machine, got the image writing to the disk, and about 7 minutes later had the computer back up and running. Had I done it the old-fashioned Windows reinstall way the same process would have taken me at least four hours.

4. Back up your data to an online source:

   If Google would ever get around to releasing their GDrive, then I’d probably recommend that. Personally, I like the idea of having my data available to me anywhere I go, regardless of the computer that I am on. If you’re a privacy freak, then I wouldn’t suggest this as whatever vendor you choose would have access to everything that you upload.I’ve tried X-Drive before and wasn’t a huge fan of them. The main pitfall to online storage is speed. Your connection just isn’t going to be as fast as it would be if you had used an external drive or a DVD-R.There’s also the cost issue. Currently I don’t know of any free online storage companies, so there would either be a monthly or annual fee to keep your data with them, and you had better believe that they won’t let you access your information that you have stored with them if you’re not current on your bill.

OK, that’s great, grand, and wonderful, but how do I prevent the data loss from happening in the first place?

Electrical surges are an incredibly common reason that a hard disk will fail. The absolute best way for you to prevent these is to get a good UPS. (Uninterruptable Power Supply) I have used Opti-UPS and APC in the past, and like them both. You’ll want to spend the extra bit of money and get an intelligent UPS as it’ll adjust the voltage/amperage automatically and will use the batteries less. This will make the batteries last much longer.

Vibrations, or abrupt shocks are another common reason for failure. Drop your laptop while it’s running and see just how long it lasts. (That was sarcasm, please don’t actually do that) There’s really not a whole lot you can do about this one. Nobody that I know of drops their laptop or knocks their computer over on purpose. You could always get a solid state drive (SSD), but if you’ve got that kind of money then you can probably afford to have the drive sent to a professional data recovery service; and buy golden handkerchiefs.

Viruses, Malware, Spyware, etc also can cause data loss. Files can be corrupted, deleted, or even encrypted and held for ransom if your computer gets infected. Clean up is usually a straight-forward event, but not always so. This is the one instance where you actually stand an OK chance at getting some of your data back, assuming that you’ve not used the computer very much after the files get deleted. GetDataBack has worked pretty well for me in a few instances here, although the files themselves are sometimes very hard to find. (and they are not always recoverable even if you do find them)

So please, if you haven’t backed up your data in a while, do so. I promise it’ll save you an ulcer later.

Almost exclusively, I use McAfee’s SuperDAT scanner to clean up systems that I suspect are infected. This handy little package is updated extremely frequently and as such is really useful on a computer where there’s no updated security package running.

First you will obviously need to download the SuperDAT package. Click the link above, agree to their terms of service, and then download the SuperDAT package. It’ll be called something like sdat5195.exe (that’s what it is as of the time of this writing). Save the file to somewhere that you’ll be able to locate it. I would suggest c:\temp as we need to expand the file you just downloaded; it’s an auto-extractor.

Once the file is downloaded click Start->Run and browse for the file. Before you click OK to run the file, you need to put -e on the end of the command line. This instructs the package to extract itself into the directory the file is currently in, as opposed to trying to update some installed McAfee software suite.

The command line should look like this:

Now it’s time to scan your computer. First, to ensure that we have minimal interference, boot into Safe Mode. Once fully booted there, click Start->Run once again and type CMD. This will open the command prompt and is where all of the action will take place. You didn’t expect it to be easy since it’s free, did you? :)

Assuming that you saved it to C:\Temp as I suggested, here is exactly what you’ll need to type to run this:

CD\

CD Temp

Scan /adl /unzip /clean /rpterr /report c:\temp\error.txt

Here is an example of what it’ll look like running from the command line:

Here’s a breakdown of what all the switches mean:

/ADL = All Drives Local: The scanner will go through all of your physical drives, skipping the removable ones (CD-ROMS, Floppies, Flash drives, etc)

/UNZIP = Extract all archives: If a file is in a compressable format that the scanner recognizes, then it will scan within that archive. This way viruses that may be hiding in a compressed file are found.

/RPTERR = Report all errors: Any errors that are encountered will be included in the file you designate under the /REPORT flag.

/REPORT = Generate a report that will list all viruses found and save it to the path specified. In this case it was C:\Temp\Error.txt.

If you want to look through the other flags that you can use, then type Scan /? . It’ll bring up a list of the other possible options that you can use.

If you run into a few files that don’t allow themselves to be cleaned even while booted to Safe Mode then you may want to try using Barts PE to scan your machine. It boots independently of your computer’s OS and as such no files on your hard drive are in use, which will allow you to clean up pretty much anything. You can use McAfee’s SuperDAT in conjunction with Barts.

If you’re thinking about trying Vista. Then here’s a link to the tool that will tell you if you meet the minimum system requirements.

It will also pop up a dialog that says “This copy of Windows is not Genuine”
“This copy of Windows is not genuine and you have not yet resolved this issue. This computer is no longer eligible to recieve select security upgrades from Microsoft.

To protect your copy of Windows, you must click Get Genuine now.”

Every so often a little balloon will pop up that says “You may be a victim of software counterfeiting.” Below that it will say “This copy of Windows is not genuine. Click this balloon to resolve now.” If you’re working on a system that has this running it gets annoying in a hurry. What the time interval between pop-ups is, I don’t know, but I imagine it’ll drive most people to buy a legit key after a while just to get the thing to shut up.

Fixing the popup is easy enough.

Reboot to safe mode. Open up HijackThis and scroll down to the selection that says “020 – Winlogon Nofity: Wgalogon – …” select that, and click fix checked.

You can also go and delete the actual executable that nags you. The full path to it should be (for most installs) C:\Windows\System32\wgatray.exe.

Reboot after this. No longer should you get the popups and that nagger as you log in should not show up either.

Note: I am NOT condoning software piracy! If you have jacked your copy of Windows then it’s time to buy one!

The first step is to get the Emergency Boot CD. Download it, and then burn it to an actual CD.

Once it’s burnt, then stick it into the drive of the computer you want to reset the administrator password on, and reboot.

The first menu when the PC boots from the EBCD give a few options. Select option 5 (obviously) and press enter.

The next dialog will ask you about SCSI drives. Just press enter again. Following that it will ask you if you want to probe for SCSI-drivers; hit enter once more because it defaults to no.

Now you should see a list of partitions formatted like:

Device Boot   Start   End    Blocks    Id    System
/dev/hda1   *         1     7295 58597056  7     HPFS/NTFS

The specific numbers don’t matter. The CD will default to the drive and partition that it thinks is correct. Unless you have multiple hard drives and more than one install of Windows XP/2000 then the one it suggests is more than likely right. Press enter.

Now it will ask you what the full path to the registry directory is. A standard Windows install will put it at \Windows\System32\config. Once again, the EBCD wisely suggests that. Hit enter.

The next question is “Which hives (files) do you want to edit”. EBCD will select [sam system security] which since we’re editing the password is correct. You guessed it, press enter.

Now we’re to the interesting part. You will be shown a menu with a few options. Choose 1 to edit the user data and passwords.

Next a list of usernames is shown. You can choose from any of the names shown, but I would suggest just choosing Administrator. Once you have access to that account, you can change all of the subordinates accounts passwords right from Windows so there’s no real reason to do it from here.

Select Administrator and press enter.

On the next dialog type * and hit enter. This will erase the admin pass and just leave it blank. There may be issues with using the CD to write an actual password, and once again, we can always set the password once back in our OS anyway.

Select y to confirm the change.

The password is now changed… Almost. So far we’ve only edited a temporary copy of the hive files. Type ! and hit enter to exit the password editor.

Now we’re back to the main menu. Input q to quit.

At this point it will list the hive files that were altered during the password reset and will ask you if you want to write them. By default the selection is no. You must enter y and press enter to finalize the process.

Once the files are written you can reboot into Windows. The Admin account now has no password so log into that and change all the other passwords you need to from there.