About:blank Override!

[Josh]

It seems that this internet explorer override is hitting people hard lately. I've searched the web and almost every link is associated with this problem. Everyone has a different cure for it, but exile and I spent one night 2 hours trying to get rid of this thing off of my pc and we figured out a way to get rid of it... temporarily (As in, maybe a day tops)

If you do not know if you are having this problem, then read this:

When you open your internet explorer....[list]
[*]My home page gets changed to about:blank and I can't change it back
[*]some search page is displayed on my internet explorer which isn't familiar to me
[*]A popup window pops up and displays the following message:
[/list][quote name=\'The Popup\']SPYWARE HAS BEEN DETECTED!!! Click Here to find out how to get rid of it[/quote][list]
[*]When I type an invalid link, this page overrides the 'This page cannot be displayed'
[/list]If you have ANY of these above 'symptoms' then I suggest you do the following:

1.) Get out your HijackThis! and scan. Usually this sucker is sneaky and renames itself to a couple different names. It is a dll that is placed in your System32 folder and would look something like this when you scan:

[quote name=\'HijackThis! Example\']* = Wildcard... Anything can be before it, or after.

* - *C:\WINDOWS\System32\*.dll/sp.html*[/quote]

Basically anything with the '/sp.html' in it. Now make sure you remember what the *.dll is because you will need it later on!! (WRITE IT DOWN!) So.. Check [b]ALL[/b] of those, then look for the following:

[quote name=\'HijackThis! Example\']* = Wildcard... Anything can be before it, or after.

* - BHO: (no name) - {*} *[/quote]

Check those also, then once you get those checked, look for anything that says "HomeOldSP" or "OldHomeSP" (I've seen it both ways before) and check those..

After completed you need to click 'Fix Checked'.. When a popup box comes up, just click 'yes' and thats it for this step. (Long step eh? /blum.gif\' class=\'bbc_emoticon\' alt=\':P\' /> )

--Part 2!

[color=\"RED\"][size=14]DO NOT OPEN YOUR INTERNET BROWSER AFTER THIS!!!![/size][/color]

It will reset everything and you will have to do the above agian /Doh1.gif\' class=\'bbc_emoticon\' alt=\'(doh)\' />

Okay, NOW -- Go to Start>Run> Type "regedit" (No quotes)

Once in the registry editor, look for ALL (Search (CTRL + F) Through 'My Computer' for 'about:blank' - when results come up, open up the registry and delete its value.

Keep doing this until it says it is done searching through the registry.

Now go back up to the tree (To the left) and click on 'My Computer' and search for the dll (Which is what was before '\sp.html' in HijackThis! (I told you to remember this!!!)

When results come up, just open the registry and delete the value.. after that your done! Close out of registry and open your internet explorer... It should be a blank page, go up to the menubar to 'Tools>Internet Options>Type: [url=\"http://www.graphixground.com'\"]http://www.graphixground.com'[/url] and then click the 'Home' button in internet explorer and once GraphixGround loads, close out of Internet Explorer, then reopen your internet explorer. If everything went GOOD and WELL you should have GraphixGround (YOUR FAVORITE PLACE!!! /biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> /biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> ) Show up in your internet browser.

This SHOULD last at the most for about 1-2 days.. then it will be back again. I have yet to find a cure to really REMOVE everything. I've done lots of research on it tonight and still learning more. Once I get more details I will post them here and everyone can get rid of this mass spreading 'override'

Hope this helps (I) /good.gif\' class=\'bbc_emoticon\' alt=\'(Y)\' />

~Josh

[to@ds]

I know this post has been here for a few days, but I used to have trouble with that about blank until I had to format my HDD. Its pretty annoying to say the least. At least if the bugger comes back I know I can do soemthing about it. Nice one Josh

[Josh]

Yea, I'm still researching on the whole thing... It's starting to annoy me now. I have found 2 programs that I need to use to get rid of it longer /bigwink.gif\' class=\'bbc_emoticon\' alt=\';)\' /> I'm getting closer to cracking this thing. All I know is that I think these people should be sued for creating this dll that is stored on your PC that you cannot delete. oh and an update on what different names the dll has will be posted here soon... I aint at my own PC so I don't have the list of it all /cry.gif\' class=\'bbc_emoticon\' alt=\':(\' />

[Josh]

Okay! List of DLL Names that have been seen on my PC:

[b]
bcclo.dll
famhklf.dll
focj.dll
gcn.dll
gjp.dll
ikfohbb.dll
jkbnbig.dll
knfhpc.dll
lamb.dll
ohjgmbi.dll
[/b]

And I can't figure out how to stop these dlls from coming back, but I will post 2 programs that get rid of it longer..

~Josh

[OzzyWizard]

The reason you cannot delete them is because your running xp and it is defaulted to auto restore system files incusive of dll's right ?

[Josh]

Okay, now that just opened up a new door /huh.gif\' class=\'bbc_emoticon\' alt=\':huh:\' />

*smacks himself*

[OzzyWizard]

lol Josh . .

[turtleman]

/blum.gif\' class=\'bbc_emoticon\' alt=\':P\' /> LMAO after reading all that I can just see Josh slaping his head LOL /blink.gif\' class=\'bbc_emoticon\' alt=\':blink:\' />

[Josh]

Why.. yes I did /smile.gif\' class=\'bbc_emoticon\' alt=\':)\' /> lol

[Josh]

Anyone know how to [b]UNDEFAULT[/b] it to restore system dlls? /dry.gif\' class=\'bbc_emoticon\' alt=\'<_<\' />

[turtleman]

I'm guessing here Josh,, I by no means have a real clue as to what I'm doing... But!,, wouldnt you turn off the restore function in XP?

heres one page I go to for information;
[url=\"http://www.theeldergeek.com/index.htm\"]http://www.theeldergeek.com/index.htm[/url]

and heres another;
[url=\"http://www.annoyances.org/\"]http://www.annoyances.org/[/url]

I hope they can help you ,,, I know they can do so alot better than me /huh.gif\' class=\'bbc_emoticon\' alt=\':huh:\' />