Web hijacker about:blank


My broser has been hijacked.  It keeps coming up about:blank.  I have tried several spyware solutions and none have worked.  I have tried, ad-aware, spybot seach and destroy, CWS shredder.  I cannot find a solution.

If anyone has advice, I would appreciate it.  I am not a computer expert, so please give step by step instructions if I need to remove manually.

Thanks!!
BScottMacAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SheharyaarSaahilCommented:
Hello BScottMac =)

Read our EE Official Link on How to Troubleshoot Spywares\Adwares and Browser Hijacking Issues,
http://www.experts-exchange.com/Q_20975384.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SheharyaarSaahilCommented:
Dont forget to Disable ur system restore if u are running WinME\XP !!
and always run the removal tools in Safemode except Hijackthis !!
Delete the Temp and History Files of IE also !!
Run Disk Cleanup to delete all the extra and temp files from ur hard drive !!
Check if u can get rid of it or not ?? :)

!! GOOD LUCK !!
0
sunray_2003Commented:
Hi BScottMac,

about:blank is a very tricky web hijacker..

You may want to try this about:buster
http://www.bleepingcomputer.com/files/aboutbuster.php  ( I donot think this one is given in the link that has been given in the previous suggestion, i just did a page search )

I would also do this


a) Start --> run --> Type in "msconfig" and press "Enter"
goto Startup tab
Disable all the applications there except anti-virus.Reboot the machine and check if the webpage is still hijacked.
If not, then enable one at a time in the same startup tab and find the application or process that might cause this
at startup

b) lock the homepage using Spybot

First go to IE --> tools --> Internet options and setup a homepage of your choice

Then what you can do is this.. Install spybot 1.3 : www.softpedia.com/public/cat/10/17/10-17-21.shtml 
open it and update it
go to mode --> advanced mode
now on the bottom left navigation pane , you should see tools
click on it and go to "IE tweaks"
and check " lock IE startup page setting against user changes"
Close spybot

SR..
0
Introducing the "443 Security Simplified" Podcast

This new podcast puts you inside the minds of leading white-hat hackers and security researchers. Hosts Marc Laliberte and Corey Nachreiner turn complex security concepts into easily understood and actionable insights on the latest cyber security headlines and trends.

amirinamdarCommented:
0
visualcoatCommented:
I used avast home edition to remove the about:blank hijack
http://www.avast.com/eng/down_home.html
0
DJ_PaubesCommented:
I have been using Firefox for awhile now, every now and then I have to use IE and its dogie even with SP2.
FireFox has never been  hijacked in the 6months Ive had it, its quality software and
is far more secure than IE.
0
winkingtigerCommented:
I switched to the Fox because of problems like this, but you can get rid of this hijack.  You would need the software HijackThis and a registry analyzer like Registrar Lite(both free).
Update your windows operating system with all microsoft updates.  If you want a shortcut to windows update,go to control panel and look in upper left hand corner, you will see it there.  Select and download all of the critical updates for XP.

Disable the System Restore feature in Windows XP (you can re-enable it again once your system is clean). Here  is a link on how to disable it.
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

Next, make sure all browser and all Windows Explorer windows are closed, then run "Hijack This!" and have it fix these entries:
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [AutoLoader2sre1POVNYXP] "C:\WINNT\System32\mlluery.exe"
O4 - HKLM\..\Run: [2F8U35T] mlluery.exe
O4 - Global Startup: APC UPS Status.lnk = ?

You want to make sure that the items that contain 'start page' or 'main' in it have your correct Home Page
When done, reboot your system and bring it up in "Safe Mode" (F5 or F8 when starting Windows). At this point make sure Windows is configured to see hidden files and folders.

While in "Safe Mode", find this file and delete it from your system:

C:\WINNT\System32\mlluery.exe     It may be a different file name, but something close to it.  (if not sure skip over and we will get back to it later)

When finished, reboot your system again and bring it back up in normal mode. Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG, click on Start -> Run -> type in MSCONFIG -> click OK.


From here use the reg tool and go to this key in the program ---> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main    Go to 'start page' in the folder and double-click on it.  If the value is different from your home page, delete it and then save.  After all of that reboot you system just to make sure and change your start page to whichever one you'd like.  That should be it, let me know if you have any trouble.
0
amirinamdarCommented:
AUTHOR, UPDATE PLEASE!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.