Member Avatar for Tripp

I have been plagued by this same "about:blank" hijack that keeps reinstalling itself and things like HJT, CWShreeding, Spybot and Adware Away do not do any good to resolve the problem. Every thim I have rebooted the settings have been restored and each new browser version has opened to the "Search For..." page.

Finally one thing I did has now removed this hijack for two days, with no sign of it returning.

I removed the Google search toolbar from my browser.

I believe this hijack reinstalls itself from software added to the Google toolbar that is re-initiated each time you start your browser after a reboot.

Simply first remove the Google toolbar and then follow other steps through HJT, etc to remove the other entries,etc. You may need to run these in Safe Mode.

Does ANYONE who has this browser hijack NOT have the Google search toolbar? I would be interested to see replies to this.

  • 2 Contributors
  • 3 Replies
  • 193 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

A few clarifying points that add context to ’s observation (removing the Google toolbar helped in that case) and to ’s reply (this symptom appears even when the Google toolbar isn’t present). The classic “about:blank → ‘Search for…’” reinstalling homepage is frequently implemented by small in‑process add‑ons (BHOs), replaced protocol handlers or by changes to IE’s search/home registry values — not always the toolbar itself. Historical adware (eg. CoolWebSearch variants) used exactly these mechanisms to persist. (softpanorama.org)

How the hijack usually works: a payload installs a BHO or DLL, writes one or more autostart entries (Run/RunOnce, Scheduled Tasks, AppInit_DLLs, URLSearchHook), and rewrites IE search/home keys such as SearchAssistant, CustomizeSearch, SearchURL and Start Page. These show up as R0/R1/O2/O18 lines in HijackThis logs and explain why removing a visible toolbar sometimes only gives a temporary fix. (superuser.com)

Practical cleanup sequence (ordered, with backups):

  • Boot Safe Mode.
  • Use Autoruns (Sysinternals) to disable non‑Microsoft autostarts, uncheck suspicious BHOs, AppInit and Winlogon DLLs, Run/RunOnce and scheduled tasks.
  • Save a HijackThis log for reference before changing entries.
  • Inspect and, if malicious, restore or remove the IE search/home values and any replaced about: protocol handler; delete the backing DLLs found in System32 (note: some variants re‑drop files, so remove all persistence points).

Check these registry locations and handlers during analysis:

HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKCR\PROTOCOLS\Handler\about  (CLSID should be {3050F406-98B5-11CF-BB82-00AA00BDCE0B})

Autoruns is especially useful for correlating running files with registry autostarts; some of these hijacks require manual registry cleanup plus file removal. For safety: create a restore point / export affected registry keys before edits and run updated AV/anti‑malware scans; if persistence continues, an offline rescue scan or rebuild may be safer. (learn.microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for DMR

Does ANYONE who has this browser hijack NOT have the Google search toolbar?

Yes- we've seen more than a few instances of the about:blank issue where the Google toolbar played no part.

Member Avatar for Tripp

Yes- we've seen more than a few instances of the about:blank issue where the Google toolbar played no part.

Specifically in the cases involving about:blank and the search page "Search for..." coming up with each new browser version there have been cases where the Google toolbar played no part?

How are you certain of this? Have you asked about the presence of the Google search bar on the IE browser in each and every case?

Member Avatar for DMR

You can see fingerprints of the Google bar's existence (or lack thereof) in the logs generated by HJT and other diagnostic tools that people post. As for the "Search for" part of the symptom. I'm not sure if you'll see that if you aren't using the Google bar, but the about:blank hijack itself certainly isn't limited to those using the Google bar.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.