"about:blank" Hijack

Not to hijack this thread Note Admin: this should have been posted in a new thread, it had nothing to do with the thread you posted it in, but anyone heard of he "about:blank" Hijacker. I removed the part that made it a link to some asian dating site, but my home page is still locked as "www.prodigy.net ". I don't think prodigy is the the hijacker, but there the text box for changing the home page is greyed out and stuck to that? Does anyboby know do to "unlock" the home page box.
It is so irritating as on boot-up, the hijacker lauches IE with the website in the greyed out box. (first a shopping site, then a dating site and now i can't change the page).

 

There are quite a few that leave you with about:blank entried for R0 and R1.

If you have been bitten, get Hijackthis v1.99 (see quicklinks in my signature), unzip it to a folder of it's own like c:\hjt or c:\antispyware or something. Run a scan and create a log file then post that here.

If you don't already use any spyware removal apps, good idea to get, update, and run Ad-aware and Spybot first to cut down on the amount of junk you need to manually remove.

 

simple cure for "about blank" ?

I started to be plagued by this problem about 6 months ago when I allowed a spare computer in my house to be used by the Chinese students living with me to send emails, chat and read news on Chinese websites. I later learnt that this was a hijack by spyware and installed Adaware. After the spyware was removed I could reclaim my homepage again, but only until the next time the Chinese websites were accessed again (usually the next day). In desperation I installed Mozilla Firefox as the default web browser and forbade the use of IE. Since then I have had no problems whatsoever. Hope this is of use.

 

Copy and paste the lines in between the dotted lines into notepad. Save it as unlock.reg or whatever you want but make sure to give it a .reg extension. Then double click on the file you just saved. Say yes to the prompt and then see if you can change the page.
........................................................................................................
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage "=dword:00000000

........................................................................................................

You'll have to remove the space in the word internet as it wants to stay regardless of what I do.

 

.................

I also have dumped Internet Explorer after realizing it was just a spyware/toobar/hijack magnet. But instead of Firefox, I got Opera and most broswing is done on Opera, but Windows Update and some other sites need ActiveX that Opera can't see to support . I changed it back with a tool from someone but I can't change it normally. I like the felling of control of my computer like everyone else.

WAHOO!

I used hijackthis and found two "O6 "s (they lock the internet settings). I fixed that and it's back. Hijackthis and Spybot still think that "about:blank" is the home page . But i've deleted the link, the startup process, the registry entries, and now the option lock-up, but what else is there to delete?!?!?!?!?! But anyways, thanks for the help guys.

-Dave

Also, the registry fix didn't get reconized by windows. It said it was not a registry script. I fixed "explorer" and removed quotes and bars but it wouldn't work.

 

You need to include the quotes. Just don't include my dotted lines. Only whats between them. I tried it and it works fine for me. Otherwise, how familiar are you with regedit? You can change the key using regedit but I saw you had your experience listed as beginner. Not knowing just how comfortable you are with messing in the registry I thought the regfile would be the better way to go. If you do it manually have a look at that key in regedit. If you see HomePage value and if it's set to 1 change it to a 0 (that's a zero). If you don't know how to do this let us know.

If that HomePage value is set to one are you sure you don't have a program of some type that's locked it. I mean a legitimate program. If you have Spybot Search and Destroy, there's a setting in there somewhere that locks the homepage.

 

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Control Panel]

The space in the word Internet is an artifact introduced by the forum software and will have to be removed for the .reg file to run.

 

I can use regedit.exe resposibly . I found the homepage value =
1xfffffff. I have checked spybot, ad-aware and every other program. It is a hijack.

 

I'm not sure what the 1xfffffff is all about. It should look like 0X00000000 (0) or the same thing with a 1 in the parentheses. If it were me I'd try to change it. You'll have to decide for yourself. If you want to change it, backup the key and then right click on Homepage and choose modify. Enter just 0 in the box. No need to enter all the others. You can also try deleting the key if you want. If the key isn't there the home page thing in IE should be accessible. Take your pick. You sure you got rid of all the spyware?

 

Still There

After rebooting, the "lock" came back. Hijackthis can find it and delete it everytime, but it comes back every boot-up. I've viewed my whole hard drive with hidden files shown and I've used various spyware tools. I think it might be registry related, so does anyone know how to get rid of these annoying traces of the hijacker?