ABOUT:BLANK

About:Blank is one of the most frustrating Browser Hijackers to stay around as long as it has and continue to do damage to systems. If you are hit you will totally be frustrated until you realize you have to do something.  What you see that tells you your system has been hijacked by the About:Blank Hijacker is that each time you open a new browser window, you receive a blank window with “About:Blank” on the address bar.  What causes this is that this Hijacker has corrupted Lucky users, after repeatedly entering URLs can occasionally obtain access to web sites but most often, all users see is a blank white, empty page. Trying and retrying to get a working page is typical for most techies and geeks and so this Browser Hijacker can linger before you do something about it. The intermittent good browsers that behaves normally is good enough to let us not worry about it for a while, until it responds poorly again – which, in this case will be shortly, usually in one or two window openings.

This Hijacker has been around for 5 or 6 years and infects computers by displaying a false directory webpage whenever the browser is opened and shows About: Blank in the title and address window.  One of the most frustrating things about this Hijacker is that is will not let you change your browser’s default homepage and if you do figure out a way to change it, it will change it back.  This Hijacker may also add new websites to your IE favorites, install an adware toolbar to your settings, and of course, hit you with tons and tons of pop-up ads, over-riding all of your settings.

Here is the real killer to all of this; the developers of this Hijacker earn incomes from the advertisements that are displayed on all of the infected machines. Each time you click the links on the directory or search result pages, you are earning money for the Hijacker developers.

Then, we also have to wonder if the fixes to these aren’t also part of the whole Hijacking mess.  And, here is why: there are ways posted on the web to try to help you fix this but guess what, you cannot totally remove this problem without going out and purchasing a tool.  You can use free tools to scan and identify the infected and damaged files but in order to completely fix the problem and have a clean machine you end up forking out some bucks. I have had this particular Hijacker hit one of my machines that was protected with Norton, Avg, Avast, and a couple more.  Ended up having to add another to my protection suite.

Avg and Avast have proved to be good tools for me.  Both are free.  Both work well.  I have just added XoftSpySE and so far so good. It was the only app that cleaned up and removed the files that were infected.  The others only identified and quarantined.  Not sure why. PC Tools, SpyWare Doctor, Regcure are just a few that you may want to try.   But, don’t purchase before you run a scan and see how many infected files that tool locates.

Here is the download link for the XoftSpySE tool:

http://www.paretologic.com/download/xoftspyse/revenuewire/?uid=pnh24

Now, there are always those sophisticated users that want to try to clean their systems without the help of a tool.  If you are one of those, you can use the REGISTRY EDITOR to attempt and I do mean attempt to remove about: blank.  First step, backup all of your files.

If you do not have a backup program, then you can use the Windows Backup Tool:

Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup to start the wizard.  Choose which files you want to backup and where.  I would recommend making a copy that you can store “off-site” away from your machine just in case of emergency.

Before we go over the steps to try to manually remove the About:Blank components, let me preface with a general word of advice:  manual removal of malware, adware, spyware, or viruses can damage important components of your computer. As a result of an improper removal, the computer may not function properly or it may not function at all. Consider the acquisition of an effective and safe anti-spyware program for the safety and security of your computer.

Moving on, the following steps outline the process that you can follow to attempt a removal of About:Blank from your computer:

Click Start, Click Run, Type ‘regedit’

Click ok to open the registry editor

Remove the following registry values:

06abaa2d-34ab-4902-a326-409bd9b9a7a5

b664647f-efd5-4837-a810-a807139107e5

HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows currentversionrunnetworkservice

ce6a1268-9cc9-4ba3-8657-fe1132906cc4

HKEY_CURRENT_USERsoftwaremicrosoftwindows currentversionrunnetworkservice

In addition, the following About:Blank processes also need to be removed:

phafxfa.exe

svhost.exe

smbdins.exe

sethcd.exe

tsmsetup.exe

You will also need to delete or remove any and all of the following directories and their files if they are present on your computer:

phafxfa.exe

svhost.exe

smbdins.exe

sethcd.exe

tsmsetup.exe

wdm.dll

achpjba.dll

cbme.dll

se.dll

iesp1.dll

The following DLL files will need to be unregistered:

wdm.dll

achpjba.dll

cbme.dll

se.dll

iesp1.dll

The above lists are representative of the directories, files, and folders that may be found on your computer if About:Blank has been installed. Variations can exist due to the fact that these programs are constantly making new versions in to outwit savvy computer users. About:Blank has also been known as About Blank Hijack, About Blank Trojan, About Blank Homepage Hijacker, About:Blank Search Hijacker, CWS.Aboutblank, About Blank Spyware, and About Blank Virus.

Very often About:Blank is actually seen on the Add/Remove Programs.  So, you should check and make sure that ithas been completely removed from your computer. Open the Add/Remove Programs in the control panel to see if About:Blank is listed.  If it is there, you most likely have not removed it all and will need to continue your manual search for other infected files.  Or, realize that you need to use a Scan Tool from a 3^rd party vendor to locate the infected files.