Browser Hijack, about:blank Search, sp.html, and friends
Posted by Rizon

Ok, that seemed too easy?

I ran the BHO Demon, and it found two ... Norton and Acrobat Reader helper. I disabled both just to be safe (Don't use Norton anymore, and don't use AR anywhere but work).

Anyways, I started up IE and the page was no longer hijacked, instead replaced by Google.com. I changed it back to about :Blank and it looks like it's staying there.

I think the offending BHO was PHKNA.dll. I didn't get any hits in Google for it, and after deleting it, it just re-adds itself later.

Is this all that needs to be done for now?

PS: How do these about :blank hijacks come through, by clicking on a website or manually downloading something infected?

PSS: Thanks for your help, Alec.


Printed from NT Compatible