This self-help guide will allow you to remove the About:Blank Hijacker in Windows 95/98/ME
(Also known as Hidden_DLL, Appinit_DLLs, About:NavigationFailure, \temp\sp.html, se.dll)
The below instructions should no longer be used. Instead use the instructions found in this topic What this program does: When you open Internet Explorer your browser will be redirected to a page called About:Blank or About:NavigationFailure.
Tools Needed for this fix: Related Tutorials:
- How
to use HijackThis to remove Browser Hijackers & Spyware
- How to remove CoolWebSearch with CWShredder
- Using
Ad-Aware SE to remove Spyware & Hijackers from Your Computer
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\Windows\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [sp] rundll32 c:\windows\temp\se.dll,DllInstall
If you have any of the types of symptoms then you most likely have this type of infection and should continue reading.
- Please make sure that you can view all hidden files. Instructions on how
to do this can be found here:
How
to see hidden files in Windows
- Download StartDreck from the link provided above.
- Once it is downloaded, extract the file into c:\startdreck.
- Navigate to c:\startdreck and double-click on Startdreck.exe
- When the program opens click on the Config button.
- Then click on the unmark all button.
- Then put checkmarks in the following checkboxes:
Under Registry put a checkmark in the Run Keys checkbox.
Under System/Drivers put a check in the Running
Proccess checkbox.
- Press the OK button.
- You will now see a lot of text appear on your screen. Scroll through this
text until you see the RunServicesOnce section. Under that we are looking for
an entry that contains a DLL in the \system directory followed by a ,StreamingDeviceSetup.
An example of a entry like that is below:
»RunServicesOnce
**t=rundll32 C:\WINDOWS\SYSTEM\MSC.DLL,StreamingDeviceSetup
OR »RunServicesOnce **boxh=rundll32 C:\WINDOWS\WIN3C6.SWP,DllGetClassObject
If this file does not exist skip to step 15.
- Write down the file name from that entry. In the above example the filename
is c:\windows\system\msc.dll or for the second type c:\windows\win3c6.swp
- Now download Win98Fix.zip from http://www10.brinkster.com/expl0iter/freeatlast/Win98Fix.zip and
extract it to c:\win98fix.
- Navigate to the c:\win98fix folder and double-click on the RunFix.reg.
If it prompts whether or not you want to merge the information, click the
Yes button.
- When that is done reboot your computer.
- Now find the file found in step 9, which should now be visible, and delete
it.
- Now download Cwshredder from the link above.
- After you download the program, unzip it into the directory c:\cwshredder.
Make sure all browser windows are closed and double-click on the cwshredder.exe
to start the program.
- Next click on the FIX button, not the Scan Only button,
and let it scan your computer. When it is done, exit the program.
- Next, using Internet Explorer, run both of these two online virus scans:
http://housecall.antivirus.com/
http://www.pandasoftware.com/activescan
- Please download and install the latest version of Ad-Aware from the link
above.
- When you run the program make sure you update it and then scan with it
and fix any problems it finds.
- Exit the program when you have fixed it everything it finds.
This is a self-help guide. Use at your own risk.
BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can post a HijackThis log in our HijackThis Logs and Analysis forum.
If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.