Removing blocked event

[John]

On Startup, I get an MS Antispy notice (bottom right hand
corner of screen) that I have blocked "about:blank".
However, when I go to any of the Tools/View Blocked
Events screens, there is no sigh of "about:blank".
Naturally, I want to remove it.
On the Blocked Event notice, the hyperlink leads to a box
which shows "about:blank" but the button at the bottom,
marked "remove", does not indicate whether that is to
remove the event or remove the block. Obviously, I don't
want to do the latter.
Thanks in advance!

 

[Alan]

The remove button should remove the block. The
about:Blank is an IE setting, not a file on your system.

You might not want to remove this blocked event though.
It is a known spyware trick to hijack your web browser.

Alan

 

[John]

Alan

Thanks for the response. You're right: I don't want to
remove the block on about:blank. I do want to remove
about:blank (which, like everyone, I don't want hijacking
my browser).
Do you know whether MS Antispy will remove (delete) the
would-be hijacker and, if so, how? I'd like to be
totally rid of the thing!

Thanks again.

John

 

[Alan]

Try going to Tools > Advanced Tools > Browser Hijack
Settings Restore and change the setting that has
about:blank stored as the URL.

You might want to first run a full system scan in Safe
Mode (press F8 before the initial Windows screen during
boot/reboot, press F8 again if need to get to Advanced
Options screen, and select the Safe Mode option that only
states Safe Mode). Remove whatever is detected. You
might want to do the same with Ad-Aware
(http://www.download.com/3001-8022_4-10399602.html?
idl=n), Spybot (http://www.download.com/3001-8022_4-
10401314.html?idl=n), and ewido
(http://www.download.com/3001-8022_4-10326287.html?
idl=n). Make certain to not to select any of the
pernament protection for Spybot and DO NOT immunize the
system, as this can interfere with MSAS' Real-tme
Protection. Also make certain to remove the check marks
for "Install backgroud guard" and "Install scan via
context menu" when installing ewido. Make certain to
update every app before booting into Safe Mode since you
WILL NOT have access to the Internet from Safe Mode.
NOTE: Only scan with one app at a time, remove what it
finds, and then repeat for the remaining apps.

After this has been accomplished, you should then use
MSAS to change the IE settings.

Alan

 

[John]

Hi Alan

Thanks. I've done those various things and found some
interesting stuff! However, none of it was
on "about:blank". The hijacker has not actually
installed, because I had blocked it, but it seems I still
can't get rid of it ..... or of the recurring notice from
MSAS that tells me that it has been blocked.
Is this a feature of MSAS? Or is there a way of
cancelling that notice? Would uninstalling MSAS achieve
that result, without letting "about:blank" loose on my
system?
Sorry for the extended list of questions ..... but I do
appreciate your guidance.

John

 

[Alan]

Check to see if any of the itmes removed by the other
apps were spyware or cookies. If somce of them were
spyware, first check sarc.com's (Symantec, i.e. Norton)
list of known infections to see if any of them change
some IE URL's to about:blank. If that doesn't help, use
Google to see what you can find. If either of these
methods result in a positive hit, then its safe to assume
that a hijacker was on your system and was the source of
the about:blank attempted change.

Another possible source is that some sites try to change
URL settings without your consent. This could have also
been the source of this attempted change.

Either way I think you can delete the entry from MSAS
since the hijacker is no longer on your system. If you
don't delete it though, MSAS will use your setting to
always block these attempted hijacks in the future since
the item stored in MSAS is a setting not a file.

Alan

 

[Alan]

If you go to Tools > Internet Options... in IE and change
the Home page to about:blank, svae it, and then go to
that page, MSAS will ask you if you want to allow or
block that change. In the future because of the block on
the changing of the Start Page from
http://www.anywhere.com to about:blank without even
asking if you want to allow or block the change. I just
tried this out, and it works just as I described.

So I'd recommend leaving the item stored in MSAS since
you have told it to block the attempted change. If
future attempts are made to change the Start Page to
about:blank, you will get a warning dialog box that tells
you about the attempted change and you can manage the
blocked events, which is what MSAS is displaying when it
displays about:black in the app.

Alan

 

[John]

Alan

A (hopefully!) final note to say thanks for the
guidance. Much appreciated.
I've decided to follow your final thought and leave the
block in MSAS with the purpose of preventing any new
attempt to install it. I'll get accustomed to having the
notice appear each time I boot the machine ..... at least
until MS provides another way of managing those things.
Perhaps as the program moves towards release there'll be
a modification.
Anyway, thanks heaps!

Regards from Oz