NOTE! : Before following ANY anti-virus advice, you should realize that your problem should ALWAYS considered as unique, because your computer is NOT the same as others.

This is an extremely hard virus to remove but it's doable. It is a CWS variant and not removed easily.

Find a tech website such as PCHelpForum or BleepingComputer to assist you with malware removal to start with.

Here is how to remove about:blank in Windows 98:

This technique uses a scalpel, not a machete. No essential system files will be accidentally deleted. The task is to find the hidden file that regenerates the CWS infection after CWS Shredder, Adaware, Spybot, This removes the visible symptoms.

1. Make sure that Windows Explorer is set to display all hidden and system files: go to Tools > Folder Options > View and click the button for Show All Files.

2. Run Ad aware. Make sure you instruct it to scan your \Windows, \Program Files, and \My Documents folders. Then run Shredder. Remove every suspicious thing they find.

3. Next take your computer off line - unplug your modem, whatever. No Web connection.

4. Run the Windows utility "System Information." It's on your Start Menu under System Tools, or just click Start>Run and on the command line type msinfo32.

5. Expand the Software Environment section, and select System Hooks.

6. If you are infected with CWSearchx, you will see a suspicious file there. Hook type "Windows Procedure." File name will be a nonsense string of characters, ending in .dll. The dll Path will be \Windows\System. WRITE THE NAME OF THIS FILE DOWN.

7. Close MS Info. Open Windows Explorer, go to \Windows\System and look for this file. IF YOU CAN SEE IT, IT'S THE WRONG FILE. But if you can't see it, this is the one.

8. Shutdown, and reboot into Command Prompt Safe Mode. On the C:\ command line, type CD\Windows\System.

9. Once inside \Windows\System, type dir, a space, and the name of the file you wrote down. (like this: dir ghyth.dll). When the file shows up, take a look at its size. It will probably be 57,344 bytes.

10. Type ren, a space, and the name of the file you wrote down, and then a new name for the file. (like this: ren ghyth.dll ghyth.bob). Make sure you change the extension of the file from .dll to something else. Do not delete the file.

11. Restart your computer in Windows Safe Mode. Windows may complain that it can't find the .dll, but click OK and keep going.

12. Once in Safe Mode, run Adaware again. This time it will find the renamed file in your System folder and will identify it as CWS. If it does, have Adaware delete it.

13. Run Shredder, Spybot, and Hijack This for good measure. Clean house.

14. Reconnect your Internet connection and restart Windows normally. Reset your IE home page to whatever you want. You're done.

Solution to about: blank -- For Win98 user

Restart you computer and don't open the internet explorer.

1) I go to registry and search for sp.HTML. (Start>Run>type "Regedit")

2) Try to look for the .dll just before the sp.HTML (ctrl+f)

eg: c:\windows\system\tllib.dll\sp.HTML#28965

Don't delete it as it is no use to do it as each time you open IE, this key will be restored.

3) Go to Start>Find/Files or Folder, type in the filename.

4) Open it using Notepad. Save it as a tllib.Bob.txt (for safety purpose).

5) If you can see the Java script, delete all the Java script ONLY. If not mistaken it will be after the . Save it as tllib.dll . Then the Home Search startup page gone.

6) Download DllCompare.exe (search it from internet), Run it. Click Run Locate.com . Then click Compare. You will see the .dll files not belongs to Windows will be listed at below window. My scan is apiyt32.dll and tllib.dll.

7) Open the other file using step (3) and step (4). (Remember to save as different name for safety purpose)

8) I think your computer will prompt you that it is too large to open with Notepad and recommended you to open it with Wordpad. Click yes.

9) You will see code that you will not able to read. Type anything (eg: dsagdsgdfgfdsg) at the begining and add in each singer line with "sagftsvsafd" (or anything) to mess up the code. Save it as apiyt32.dll.

10) Goto registry again and search the other file (apiyt32.dll). Press F3 to find next until you see it stop at "Doc Find Spec MRU" folder under "Explorer" folder. I am suspecting this is what the spyware reinstall itself each time you deleted the their .dll files and deleted or renamed it key in registry.

11) Try to search every single name at Data column using Start>Fine>File and Folder. When you see the search result appear to be in Temporary Internet File folder, delete the whole file. (You will not able to see this folder using normal explorer.

12) Modify all Data by add in something in front (eg: oxmzo9an to BOBoxmzo9an). Just right click the Name (eg: a) and select modify.

13) Empty the recycle bin and restart you computer.

Hope my way works for some of you who unable to use Rick's method (because unable to see the res://%43%3a%5c....)

Solution to about: blank

Having spent the last 10 hours trying to rid my system of the about.blank problem, I wanted to make a posting for two reasons:

01. The latest version of the tactic seems to have overcome some of the methods that were used to find/fix the problem as it manifested itself last summer. In particular there is no longer a section of text in the source of the HTML page that is of the form "res://", so the technique previously used to unencode that information is no longer operable.

If you look at the registry entries that HijackThis identifies, you can find a URL for each of the three bogus entries, and that does yield three downloadable files with names that suggest that they can be used to uninstall the problem. All three files, are really the same, and, of course, they do not, in fact, uninstall anything. Finding the bogus dlls and registry entries is a necessary step to successful eradication.

02. The various 'sponsored' adware/spyware removal tools that you get from a Google may help you find problems related to this one, but removal triggers the need to go from 'free' to 'paid'. Avast seems to have a wonderful business practice in segmenting the marketplace between 'home' and 'business'. Unfortunately, I have W2K Server installed and their installation program refuses to deal with my variant of the OS. Perhaps they make the reasonable assumption that W2K is not usually found in a home -- even a home used as an office by a contractor. With all the layoff activity in silicon valley, however, one of the things that frequently happens is that a company going through a layoff or a shutdown sells off its computer assets. That is why there are quite a few 'homes' with W2K Server installed. Perhaps Avast will reconsider the implementation of its policy.

So, the point of this item is simply to relay the fact that even if you are not running XP, it is possible to finally remove all the erroneous 'stuff' with a combination of 'regedit', command line searching in 'safe mode' and the helpful knowledge posted at this site. As one hint, once you find the 'ID' of the offending software -- one of those imposing strings of random digits that identify 'stuff' in the registry, you can select the string [including the curly brackets] and do a search for it throughout the registry. I think one of the keys to the way that the offending software has managed to become so difficult to eradicate is that it attaches as a 'Search Assistant', but you don't find any helpful 'plain text' showing that -- you will get a 'hit' by searching on the 'ID', so you will know to delete that key-value entry.

Solution to about: blank

I'm a professional technician who disinfects this virus about 4-5 times a week. Forget about the normal scanners. Spybot, Adaware, Spy Sweeper, any commercial Antivirus program. They are powerless against this insidious beast. There are many variants of this so there is no one size fits all:

Log in as Administrator in Safe Mode. Make it show all hidden files and folders and delete the contents of the temp and temporary internet files directories for every user that has a profile.

Run Hijackthis and delete anything that looks suspicious (if you don't know what that means, skip hijack this and call a pro).

Run a Winsock fix tool for the appropriate OS (WinsockXPfix for XP, WinsockFix for 2000, or w2fix for 9x)

Reboot into normal mode and don't open IE to see if you are clean. From a CD (don't touch IE to download them) install:

Spysweeper (if the computer is old, I don't use it. It's a resource hog.

Adaware

Spybot

Spyware Blaster

Install them and update them, but DON'T RUN THEM.

Go back to safe mode and run all but Spywareblaster and delete what they find. Go back to normal and run Spyware Blaster and immunize Spybot.

Install Firefox and only use IE for sites that require it. I recommend emailing the webmaster of such sites and telling them to fix their sites. These are powerless against about:blank coming back. Prevention means careful web browsing.

Solution to about: blank After searching the answers in this forum, I decided to try things that would not be difficult or mess up my computer since I'm not a computer expert. I only wanted to try recommended programs from legitimate companies or sources, so I looked at what was recommended here in this forum and cross-checked for recommendations from computer sites such as CNET and others. This is what did and didn't work:

I downloaded CWS Shredder from Merijn, then the updated version from the company that bought it, Trend Micro Incorporated. Neither version caught it at first, but did subsequently. I kept it and still use it.

I also downloaded SpyDoctor, but could only do a scan. It said I had over 1900 infections but I would have to register and pay to clean. A waste of time. I uninstalled that program.

I installed Spybot Search and Destroy, a free program, and that found and cleaned many bad things off my computer. It also found CWS infections but could not fix, but at least I knew about them and where they were found in my files and printed them out. I think this is a great program to use with the others. I kept it and still run it.

I then tried Avast! First trying the virus cleaner which didn't find anything, then I downloaded Avast! version 4.6 Home Edition (also free) and tried it. It found and fixed several more infections. However about blank still there. This program runs in realtime and has since stopped several attacks on my computer. Again, highly recommended, and it's FREE. I kept it and continue to use it.

What finally FIXED the problem was the Microsoft Antispyware (Beta) program. I was able to change my home page back and have not had about:blank since. Between running these programs, I still ran CWS Shredder (current version) and it did find one CWS infection and fixed it.

I also ran Spybot again and it found only one CWS it couldn't fix. I noted the location and went there. It was a text file and I deleted it.

I have been free of about blank, but I still get popups although less than I was getting before. To help get rid of those, I downloaded the Google Toolbar with popup blocker and the Yahoo toolbar with a popup blocker and an antispyware program. I ran that antispyware program for good measure and it found nothing. Still getting a few popups, (mostly from illegitimate "antispyware" companies that want to put spyware onto my computer) but now I've been clean from CWS and about blank for several days and have been running these programs regularly. Next I'll try using Firefox instead of Internet Explorer.

I recommend at least downloading Microsoft AntiSpyware (Beta), Avast! 4.6 Home Edition, and Spybot Search and Destroy. They're all FREE and they worked for me.

More input on about:blank

You can find the programs that cause this by clicking Start > Search > All files and folders, and then typing in ngqanbpc. There are two programs buried in Windows. One runs continuously and replicates the other when you try and delete it. If you have a Windows version that allows you to do a system restore to an earlier date before infection, that will work. Click Start > All programs > Accessories > System tools > System restore, and follow the instructions.

The solution for this problem is quite simple and quite difficult at the same time. If you know exactly when the about:blank problem first arose then you should look for any file created in that time frame and remove them. I had this problem between Friday, May 7, 2004 and Saturday, May 8, 2004, so I searched for any file created during this period and removed them. I am able to get rid of the problem! To do this, go to Find, and do an advanced search and specify the dates and search for all files and folders during that date. If you are sure that you did not install in vital programs or updated your operating system during that period, then delete all these files, otherwise, your problem will be very complex because you might delete vital system files and corrupt your operating system.

To get rid of the about:blank and ie virus, run these for real "freeware." Run cwschredder, adaware 6.0, spybot, and hijacker.

To remove about: blank: Go to Google, type Avast Antivirus software. It is free software for home users. Much better than Norton or McAfee as well. Please give them an honest email, and info and feedback great company. Open Avast Antivirus. Then Right click on mouse and go to Schedule Boot scan. Restart your computer. Delete everything. Eventually the scan will delete everything and once you start your computer you will not see anymore pop ups or about: blank. It worked for me. Make sure you backup important things first before you do it. You should not have a problem this is just in case. Once you do it, give Avast a good name and spread it to friends so they don't waste money on Norton.

I did as follows (on a XP Pro with about:blank): run spybot S&D and then your antivirus software on the boot disk where IE is installed (I use the freeware AntiVir SW). Then find the about:blank entry in the registry and remove the entry (under MS IE somewhere). Then reboot into safe mode and run the antivirus SW again. This steps fixed my problem anyway.

Start spywareblaster. Click tools. About:blank appears. Replace about:blank with the path of your preferred start page you have before. Make the same thing (if they are other entries) with your prefered start page.

If you have suffered with this infection even for a short time, you've discovered CWShredder and Hijack This by now. I find these essential to detect and remove files associated with About Blank. Neither or both offer a permanent solution. You must also do something about the hidden registry key.

The DLL is under windows/system32 and has always different names. BUT it is always 31KB, at least it was the case for me. McAfee ViruScan was able to remove it, but it renewed itself and I suffered from it for a long time until the new version (updated) of ViruScan removed it again. The FIRST time it was able to remove it, it also removed something named load.exe (or a similar obvious name) from windows directory, and ALSO an HTML page that contains java code from "downloaded program files". So this thing has like three different files going on. There is also some file called wpa.dbl which almost always has the same date as the dll in system32 directory. I don't know if it's related.

CWShredder 1.59 helped after having tried several other downloads in vain.

The hidden file name for me was "hdpd.dll" (Windows 2000). I renamed it, and it seems to be working (but I am skeptical). Spysweep (which I bought!) couldn't fix it, Norton (which I bought) didn't have a fix except to reset my homepage or change the reg (gone down that path before), and spybot never detected it. Like Rick said, the date of the file was about the same time I started having the problem (for me 6/28/04). I think there is only one problem with this solution. I think(?) my home page is a bit slower on the load, since the files are still there, but not being used (?). I could be wrong though.

I got about:blank a couple of weeks ago and managed to delete it myself with use of regedit and AdAware. I got it again yesterday and could not delete it at all using any of the fixes posted (that talk about two files to delete, one of which is not there in the latest incarnation of about:blank)until I found Rick's which works great, although I would also use regedit to remove any references to about: blank and the files "sp.HTML" in both Main and Search sections of all three user sections.

I tried the following in Win95 Second Edition and got rid of this crap: - Download Ad-Aware 6.0 - Download the last update of Reference File 01R330 07.07.2004 - Scan the computer - Clean all Temp, Temporary Internet Files, History etc. - The annoying homepage never showed up again!

I've tried many fixes posted on Forums and none of them seem to have worked. What finally did it for me was doing a search in the registry for "about:blank" (excluding quotes). I deleted all string values that it found which had "about:blank". Most of them were added by Search toolbars. (if you compare from the registry from another computer, you'll know what's not a standard entry). Once you've deleted all the strings, then reboot. Problem should be resolved.

Adaware/Spybot would not work to disable the about:blank problem but were useful after using Rick's fix to cleanup the sp.HTML files left in various tmp folders.

I'm using Win98SE. I booted to safe mode, with a command prompt, and was then able to delete the actual file. Mine was called bapbija.dll, though obviously this doesn't matter.

"About:blank" pop-ups: I got lucky tonight! 1. Restart Computer under MS DOS. 2. Delete the windows\cookies\index.dat file. 3. Hope windows restores an older (pre-virus) version. 4. Or copy the windows\cookies\index.dat file from someone else's non-infected computer and overwrite your infected windows\cookies\index.dat file.

I got "about:blank" on my PC about a week ago and it took me almost an hour to remove it. The process was easy once I worked it out. Step 1: In Windows Explorer, Click "Tools", "Folder Options" and the "View" tab. Step 2: Click "Show hidden files and folders", "Apply" and "OK". Step 3: Go to "C:\WINNT\SYSTEM32" and sort the files by "Modified". Look for new .DLL files and delete the funny ones that appeared at the time the PC was infected. One file will not delete. Step 4: From a command prompt, enter the following, "regsvr32 /s /u C:\WINNT\system32\filename.dll" where "filename" is the name of the spurious .DLL file. Step 5: In internet explorer, reset your homepage to whatever you like. It worked for me. I only found this page of fixes when I decided if this problem was bugging anyone else.

Adwareaway got rid of the "about:blank" problem. I contacted my local retailer, he suggested buying "SpySweeper" from Webroot. 1 year for $29.95, Which I did. It discovered additional spyware problems. In one day it also additionally discovered 4 more and 12 traces?. [About:Blank came back] In yesterday's mail Consumers Report(Sept 2004) had a report on various programs. A free one is lavasoftusa.com. BUT I guess it is pretty obvious you need a subscription to whatever program you have, just like a virus one.

Found this on another forum when I had about blank spyware and it worked for me. Ok. I've been frustrated with this for some time but this is all I've found that worked. Download Winpatrol and under IE Helpers you should find a little .dll file. On mine it was called dapg.dll. Search for this file in windows. When the file appears it thinks the file is an important system file. To change this right click on the file and select open with. From your selections choose word-pad and press ok. When the file opens select all the text and delete it and then press save. (Note: It will not allow you to save if you still have search box open.) Then go back and search for the file again. This time you should be able to right click on it and delete it. Remove it from your recycle bin and you're good to go.

Here's what worked for me: I downloaded a different browser -- Mozilla Firefox (free) -- and removed Internet Explorer from my computer. The new browser works every bit as good as Explorer and I haven't had the about:blank problem since.

I tried many solutions explained here. But none of them worked. I finally managed to get rid of this "about:blank" with a tool from Neuber called "Security task Manager". You can try it free during 30 days. This tool showed me all running tasks with a "spy risk rate". I found 1 or 2 unknown processes in the top of the list. I put them in quarantine (a function of the Security task manager) which means that they are stopped and remove from from the auto-start apps (registry key) and deleted from the original directory (c:/windows in my case). After that I scanned my computer with SpyBot S&D that found some spyware and cleaned them. I then reboot and I re-specify my original start page in IE. At last, no more pop-up and the start-page stays! No more problems.

It is possible that this virus will overwrite your spoolsrv32.exe or multimedia system files. You may have to overwrite them with known clean versions. This worm/Trojan is mean and regenerates itself if you don't find all the files it creates, the longer you wait the harder it is.

Sounds like you have the horrible about:blank virus that I finally "killed" after a week of torture. The home page continuously changes to an "about:blank" even if you manually set your home page via the internet options. I ran (many, many times) the Avast, McAfee, shredder, etc to no avail. However, I noticed the McAfee virus scan consistently indicated that all but one virus had been deleted. At wits end, I jotted the file's name and searched for it. Once the file was located, I renamed the file and then deleted it. It worked! If that's what's happening to you, try the following: 1) Run a virus scan to locate the file(s) that were not deleted during the scan 2) Write the file name as shown in the scan; it may end with .dll 3) Go to start, search file or folder, and search for the file name indicated from the scan. 4) Once located, right click and rename it to something like "virus". 5) Right click the new name and delete the file. If more than one file is shown as undeletable, you must go through this procedure for each file.

Do not download free virus scans (unless you can be sure it is reputable). I downloaded NoAdware (and a whole host of others) and they in fact gave me the about:blank virus and many others. They are just scams. You do not get anything for free (what do they have to gain). They make their money through Adware. This virus, while it has many forms, is most destructive as the "CoolWebSearch" version. Norton antivirus can detect this and give instructions on how to remove it. The top answer is halfway there (if you do have the worst version of about:blank), you still need to clean up the registry, which is very tricky. I found the solution at Symantec.com (search for coolwebsearch). I had a slightly different version of this (SearchAssistant) and I went to the registry and removed anything that was related to the virus. PS: I had to laugh when I saw people promoting downloading the uninstaller from the culprit website (is this the "they completely ruined my browser the first time, surely they wouldn't do it again" argument).

You may go to HouseCall and run the free online virus scan.

After 4 days working, downloading several free and paid programs, i finally end up to purchase Adware Away, and the about:blank is completely gone.

Answer:

Download and run firefox to protect your computer from future spyware attacks and pop ups which are coming in through internet explorer (Trojan downloaders, win32 ).Browser attacks aren't easy to spot because they piggyback on legitimate traffic that doesn't exhibit many obvious warning signs

1. Run Deckard's System Scanner (DSS)

2. Run the vundo and combo fix

3. Run Malwarebytes Anti-Malware

4. Run the anti spyware removal programs spybot

5 Run Superantispyware

6. Run a complete scan with free curing utility Dr.Web CureIt!

If you are in the united states of Canada and you are have a genuine version of Microsoft.

This is the free Microsoft antivirus line. This is a totally free service that will walk you through the virus removal steps: For support within the United States and Canada, call toll-free (866) PCSAFETY (727-2338).

Answer:

Go to run, enter regedit and press enter. then go to find form options and write the virus name after locating it delete the reg. item or change its name. Removing About:Blank Virus Here is one recommended solution:

Open your browser so you'll will see (automatically) the startpage "about:blank"

Now go UP TOP to the "view source" option of your browser. It will be right on top. Look for a string that looks like this: res://%44%3a%5c%57%49%4e%44%4f%(etc,), highlight and right click and copy, save in word, or wordpad.

Make a copy of this complete string (control c) and go to a URL decoder site.

Paste the string in here and press on "clean data".

Now a ***.dll file appears... above, now you see what it is named and what file it is in.

Go to the directory where it's in (windows/system32) and activate "show hidden files" in this directory.

Close all applications. Removing the dll file is not possible, but you can rename it, so do that!

Alternate solution to about: blank I attempted many solutions that turned out to be temporary. But now, I'm free at last.

The hidden culprit (using Windows XP Pro) that keeps re-infecting the machine is the registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

You need to remove it. Some folks say to change the registry key value to random characters using the free reglite utility (which may work as well) but I removed the key. The value of the key is hidden and causes Windows to load the Trojan DLL every time any application is run.

The way to remove the registry key is not obvious. If you just delete it from regedit, the Trojan DLL will undo your handy work. Here's what worked for me:

1. Rename the HLM\Software\Microsoft\Windows NT\CurrentVersion\Windows folder to Windows2.

2. delete the AppInit_DLLs key under the Windows2 folder.

3. Rename the Windows2 folder back to Windows.

Now that AppInit_DLLs is gone, run your favorite spyware/adware utilities such as Adaware 6, CWShredder, and Hijack This. I also run Norton Utilities, which helps if you don't trust your instincts for repairing registry files. Remember, I'm not a geek and just want to use computers & software rather than reinvent them from the ground up.

4. Reboot your machine. Your computer should be free at last.

NOTE: Do not edit the registry or delete DLL files, If you do not know what your are doing. Only do it if you are experienced in this area.

Answer:

The following antivirus programs have been voted the top 5 by the Lifehacker community; Lifehacker is probably the hub of all computer enthusiasts, so this information is extraordinarily reliable.

Avira AntiVir
Kaspersky Anti-Virus
Avast Antivirus
AVG Anti-Virus
NOD32

In addition to this, most major Antivirus company websites have a section on how to manually remove specific viruses, although you must have the name of the virus, and most viruses exact names are fairly long and include special characters.

You need to run these 3 essential programs to remove all the spyware on your computer.

If you do not have an internet security suit and only an anti virus

1. Run Malwarebytes Anti-Malware

2. Run a complete scan with free curing utility Dr.Web CureIt!

3. Run the anti spyware removal programs spybot or Superantispyware

Browsers

Use Mozilla firefox or the Google chrome browser for browsing unsafe websites

Install ThreatFire

ThreatFire, features innovative real-time behavioral protection technology that provides powerful standalone protection or the perfect complement to traditional signature-based antivirus programs offers unsurpassed protection against both known and unknown zero-day viruses, worms, trojans, rootkits, buffer overflows, spyware, adware and other malware.

Install a good antivirus in your computer.

Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them. Keep your permanent antivirus protection enabled at all times.

The MSConfig Method

Click start>click run type in msconfig and then press enter. Goto the startup tab and uncheck everything except your anti virus.click ok and reboot. When you come back to the desktop check the box 'do not show this message again" and click ok .

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal program Spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Comodo Antivirus Features

Detects, blocks, and destroys viruses
Immediate feedback on suspicious files
Prevents malware from being installed
Auto Sandbox Technology™
Cloud based Antivirus scanning
Protects with On Access scanning
Schedule your scans

Resources

Top Categories

Product

Company