Re: Internet Explorer has been hijacked by "About:Blank"

george_at_barringtonsoftware.com
Date: 08/24/04 

Date: Tue, 24 Aug 2004 15:29:04 -0700

Hello John, anyone else,

I have had a full blown case of about:blank. I read someplace else that the
programmer who wrote it should have his (sorry about gender discrimination
here, but no woman would do such a thing) privates encased in a vice whilst
it is being closed. I'll second that.

Two things just to get it to stop. Keep your modem off when you startup
your computer. Kill Iexplore.exe sessions that come up in the process list
of Task Manager (Windows NT, 2K, XP). This is what is resetting your home
page. Either keep the modem off or wait a minute or two. It gives up after
a retry or two.

Next your browser -> Tools ->Internet Options -> Security. Click Custom
Level. Disable Java and disable download. You can disable the Activex as
well. Reset them to enabled after you think you are not going to be
reinfected every time your computer starts up.

Until I followed these steps, the whole thing would come back every time I
re-started my computer.

To get rid of it I ran CWshredder.exe, which seemed to get rid of it, but as
I mentioned, it kept coming back. I also downloaded NoAdware, which actually
identified files that should be removed and was able to remove them pretty
well. It also keeps identifying svchost.exe in my Windows System32 directory
as being infected with a dll which it is claiming is causing my problems. It
is not able to remove this file, which is a good thing because it is vital to
communications. I replaced it with an identical file from Windows XP Service
Pack 1a on another computer and it diagnosed the new one the same way. So
I'm not sure. I don't know any of the other adware programs so can't comment
on whether they are better or NoAdware is better or whether any of them
really completeley work.

At any rate, now I can work on the computer O.K., I am able to set my
homepage O.K., but my computer continues to crank up a session of
Iexplore.exe every time at startup as well as occaisonal extra IE sessions
that begin at about:blank and morph into advertisements, many of them from a
bannerfarm site. This is manageable, but I sure would like to get rid of the
IE startup at computer startup and the extra sessions.

I also have an empty value in the place described where the reglite program
is used.

I have Norton 2003. I think Norton 2004 or greater is required to manage
adware. They do document it and claim that it is easy to get rid of, but I
followed their procedure and I still have the symptoms described. Perhaps,
because I have Norton 2003. They identified this as "1stbar" adware.

I should also mention that when I uninstalled or got rid of "1stbar", the
uninstallation took me to a web page that said something like they were sorry
to see the uninstallation and hoped it had been useful and also advertised
anti-adware software. "1stbar" is anything but useful. I would call it more
like a plague.

Any information anyone has would be welcomed.

George Kotcher
Barrington Software Incorporated

"john chapman" wrote:

> I have used reglite and it shows nothing in the Value field.
> Presumably, the "hidden" file has been removed. Nevertheless,
> about:blank still comes up when I say Use Blank for my homepage. I
> get few if any popups, but my Norton Professional Security is set to
> block all popups. Can I presume that the non hidden file still exists
> on my machine. I have not been able to identify that file. Any
> suggestions???
>

Relevant Pages

  • Re: Internet Explorer has been hijacked by "About:Blank"
    ... > programmer who wrote it should have his (sorry about gender discrimination ... Keep your modem off when you startup ... Kill Iexplore.exe sessions that come up in the process ... > To get rid of it I ran CWshredder.exe, which seemed to get rid of it, but ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: SW wont delete; msconfig;
    ... I did NOT download this SW, do not visit porn sites, ... > Norton AV already on it. ... > delete all references to PowerScan and ClockSync SW, ... rid of it. ...
    (microsoft.public.windowsxp.general)
  • virus
    ... >I have the trojan-startpage virus in my msconfd.dll ... Can I get rid of it? ... Symantec AntiVirus and Norton AntiVirus product lines. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: backdoor.afcore.bb HELL
    ... - uninstalled the offending DLL ... got rid of the existing anti-virus program AVG and had her install Norton ... Tried uninstalling the dll, ftdpwmk.dll, but I get access denied. ...
    (microsoft.public.security)
  • Re: MS-DOS mode
    ... > repairinstall, the disk will not boot from PC, BF claims ... > repair install myself and ... > As for Norton, I haven't had a problem as of yet. ... > know I don't get rid of it. ...
    (microsoft.public.windowsxp.general)