How to Remove "About: Blank" Spyware

By Dan Stone

Spyware is a specific type of malware that can force unwanted advertising, collect personal information and change an infected system's configuration; by design, spyware can be very difficult to remove. The "About:Blank" hijacker spyware can be a particular pain to excise from your computer once it's infected. "About:Blank" takes over a Web browser so it can manipulate search results and the homepage by redirecting traffic and adding advertisements. "About:Blank" is difficult to remove because it alters startup entries every time the computer restarts to evade removal attempts.

Remove With Anti-Malware and Anti-Virus Programs

Step 1

Select and install a single anti-virus program and one or more anti-malware programs. Computer Hope recommends Ad-Aware as an anti-virus program and Malwarebytes, Windows Defender, SpyBot and HijackThis as anti-malware for general hijacking spyware removal. SecuriTeam recommends AVG's free anti-virus for removing the infection (links in Resources).

Step 2

Update your anti-virus software to the latest version and run a complete system scan. Updated libraries have a better chance of successful removal.

Step 3

Update your anti-malware software to the latest version and run complete system scans one at a time with each program. Running simultaneous scans can make the process take longer.

Remove Manually

Step 1

Press "Windows-R," type "regedit" and press "Enter" to launch the Registry Editor. The Registry Editor is used to make adjustments to behind-the-scenes Windows operations.

Step 2

Open the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ directory and click "AppInit_DLLs." The "About:Blank" spyware file name will appear here; record this file name.

Step 3

Restart the computer in Advanced Startup and load the Command Prompt. To enter Advanced Startup, go to the WIndows sign-in screen and hold "Shift" while clicking "Restart." Choose "Troubleshoot," open "Advanced options" and select "Command Prompt" in the Advanced Startup menu.

Step 4

Enter "cd \windows\system32" (omitting quotes here and throughout) in the console and press "Enter." Type "RENAME [SpywareName.dll] badfile.dll" (where SpywareName.dll is the DLL file identified in Step 2 ) and press "Enter." Renaming the infection should disable it. Type "Exit" and press "Enter" to return to Windows.

Tips & Warnings

  • You may be able to bypass an "About:Blank" infection by returning your computer to a system restore point before the infection. Running System Restore won't remove personal files, but it will revert programs and Windows settings to a previous state.
  • Booting into Safe Mode before running virus and malware scans may help improve removal chances.
  • There are several versions of the "About:Blank" hijacker, so different anti-malware programs may have better luck removing the infection. "About:Blank" is actually a more advanced version of the "Cool Web Search" hijacker. Some versions of "About:Blank" may appear in the Add/Remove Programs menu and can be removed through a standard uninstall. However, hijacker spyware like "About:Blank" may be able to reinstall itself on boot. Additionally, some versions may only affect Internet Explorer, so you can work around the problem by using another browser.
  • The "About:Blank" hijacker shows several symptoms when infecting a computer, including setting "About:Blank" to the homepage and generating excessive pop-up windows.
  • You can disable or severely damage the Windows installation if you change certain settings in the Registry Editor. Follow the instructions carefully and do not edit registry files that you are unfamiliar with.