More than likely the about:blank hijacker you have, if you are using Windows 2k, XP, or NT with NTFS, is using what is known as Alternate Data Streams.
Download registrar lite here:
Install it and then launch reglite
Navigate to:
HKey_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows
You should see a key called Appinit_DLLs there
Double Click on it and if you see a dll in the value this is more than likely your problem. Write down the name of that DLL
It is more than likely invisible in the system32 folder.
To get rid of it you need to boot to the recovery console
To do this insert your Windows XP CD and boot to it
After you get the 3 choices "Install" "Repair" "Exit"
Hit "R" for repair
Then when you are in the recovery console choose "1"
if you have an admin password put it in ... if not just hit enter.
Then you will want to go to system32 folder ... to do this type cd system32 if you see the prompt C:\windows or C:\winnt ... if you dont see either of the prompts type cd windows or winnt depending on what your system root directory is..
When you are in the system32 folder type dir ... the space bar will page down a full page ( this is faster )
If you see the DLL that was in the Appinit_DLLs value hit escape to bring the prompt back
now type "attrib -r nameofthedll.dll" (this being the name of the dll you saw in the value of Appinit_DLLs)
This will remove the read only attribute.
Now you want to delete it.
to do this type "del nameofthedll.dll"
Now reboot to safe mode. To get to safe mode hit F8 a couple times before you see the splash screen
Choose Safe Mode.
Open up reglite again and go to the appinit_DLLs key and double click it and delete the value inside it and hit apply. Now run adaware and spybot. Then run hijackthis and delete the R1 and R0 values if they do not look familiar to you or are not a link to the manufacturer of your computer. Then through the control panel go to internet options and change the home page to what ever you want. When you are finished with these steps reboot your computer to regular mode and the hijacker should be gone
I hope this helps
Art
