Here's a link to a solution that was offered the last time this came up: About:Blank.

I did the download from "bleeping computer" before and now its back I do have "ccleaner" and cleaned the "registry" out with that, and have the following
Comodo-Pro Firewall
Comodo BOClean
Spywareblaster
Superantispyware
Avast

I called my tech here and he asked if I had been playing around with the "tabs" but I never use those, am not real computer smart but sure hate to haul this thing to the shop.

See if Mawarebytes tool will help - click the link and read the directions for Malwarebytes and run the scan..

Here is a link that might be useful: Malwarebytes

I went to Malwarebytes and run a scan it found 2 infected.
1)registry key infected "Adware.Minibug
2)the weather channel "adware.hotbar"
both Quarantined and deleted successfully.
rebooted went to weather.com and darned if the about:blank still showed up.
Everything else came back 0 detected.
Going to bed now think I will just stay away from the weather channel thats the only place it shows up.
Wish I could get to the bottom of the problem though.
Thank you for the help.
Gillian.

Shows up on mine too. Never have got rid of it. I have guv up trying.

Check your add/remove programs list for anything suspicious, possibility relating to weather (Weather bug) maybe - if found remove those entries..

Also check your java version in the add/remove programs remove old versions and install the latest version for windows (java 6 update 6) from the link..

Here is a link that might be useful: Sun Java Download

* Download the latest version of Java Runtime Environment (JRE) 6.
* Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 6".
* Click the "Download" button to the right.
* In the Window that opens, select Windows, your Language, check the "agree" box and click Continue.
* Click on the link to download Windows Offline Installation and save to your Desktop.
* Close any programs you may have running - especially your web browser.
* Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
* Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Examples of older versions in Add or Remove Programs:
o Java 2 Runtime Environment, SE v1.4.2
o J2SE Runtime Environment 5.0
o J2SE Runtime Environment 5.0 Update 2
* Click the Remove or Change/Remove button.
* Repeat as many times as necessary to remove each Java versions.
* Reboot your computer once all Java components are removed.
* Then from your desktop double-click on jre-6u6-windows-i586-p.exe that you downloaded to install the newest version.

secunia has a tool that you can use to see if you have the latest or not and if you do not where to get it and which to remove.

Here is a link that might be useful: software inspector

OK went in add/remove and unistalled the old Java's downloaded the latest Java "jre-6-6" everything went fine thought I would check the weather.com just to see if that was the cure but no "about:blank" still wants to arrive, I also have the "Malwarebytes'Anti-Malware 1.18" installed did a full scan it came up all 0s, I am now thinking it has something to do with Yahoo as I use it for home page and this morning it had Yahoo across the top.

About blank is usually associated with a browser hijacker that invades or changes your home page and redirects you to a different site, so I'm not a 100% on what you are seeing I know you described it in your first post, could you try again. Really the next step in the process here is to run hijackthis and present the log to a malware removal forum, usually when Malwarebytes finds even some problems as it did with you you must consider the possibility of other Malware on the system.

That window you get that you describe, can you right click it then choose properties or page source and give us the Information..

zep

From Weather.com American Express. Windows Explorer provided by Yahoo.(on the top)
http://ad.doubleclick.net/click%3Bh (on the bottom)
Protocol:hypertext transfer potocol (in middle
Type gif image(in middle)
Address (url) http://m1.2mdn.net/1297440(in middle)
Created 6/24/2008
Modified 6/24/2008
There is a privacy report & unknown zone (mixed) both with a red circle and line across them right at the bottom.

gillian 41,

Have you resloved this?

zep

No it still shows up have just been to check this time had "Done" at the bottom left corner, the "eye with the red circle and line" and a world when I held the curser over it "Double click to change security setting" the sign is about postcard size and weather.com is the only place it shows up. Could it be something to do with cookies? I have scanned with "malwarebytes" "superantispyware" both come back clean plus use "CCleaner" really don,t know what else to do, am alittle scared to play around to much did do the system restore thing and it went ok, am always open to advice.
Thank you for checking
Gillian.

do you know how to do a screen capture picture so we can view what you are seeing? When on that window hit the prt scr button to capture the screen.

I have just tried "screen shot" for the first time here goes
{{gwi:1478360}}
Gillian

do you have spywareblaster on that pc? it should really stop that if it is updated and all protection is enabled.
In case you don't here is the link to javacool where you can get the free spywareblaster, update it weekly and enable all protection, and also they have spywareguard free which is also a very good product.

Here is a link that might be useful: javacool

Yes I have spywareblaster updated and protection enabled for quite awhile, just looked there is a custom blocking also a flash killer should I click something in either of those settings, will look into spywareguard I do not have that.

Give this a try as well:

Assuming you have XP sp2, in IE go to Tools, Internet Options, Privacy, Sites. Then type doubleclick.com and hit Block, then type doubleclick.net and hit Block again, then Ok and OK again. You should not see cookies from either of those sites again as IE will block them outright. This will also delete the cookies from those sites that may be there already. Make sure that you spell the sites correctly.

No they are still coming up I did a reboot after following your instructions, I did notice that the ad arrives after I type in my zipcode could that give you a hint as to what is making this happen.

Went into the privacy and typed in ad.doubleclick.net now get this at least there is no ad
{{gwi:1478363}}

might be getting somewhere.
Gillian.

See the link, I think spyware blaster should have prevented this, you now probably have registery entrise with double click, lets try the steps in the link, then we can move to a more powerful tool called "clean up"

Here is a link that might be useful: Double click

Hope I did this right downloaded the Spyhunter ran a scan
{{gwi:1478366}}
here is the finish nothing found if I did it right, do I uninstall the Spyhunter now? will do nothing until I am told what to do.

Yes uninstall now and do this exercise:

Clean other Temporary files + Recycle bin

* Go to start > run and type: cleanmgr and click ok.
* Let it scan your system for files to remove. * Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
* Press OK to remove them.

I have a guy on another forum going through the same thing..

ok done that and did a reboot does the guy in the other forum only have the problem in the weather.com webpage?
I will wait to see if there is anything else to get done, also I need to go into my bank and pay bills will it be safe????

Lets also try good old spybotsearch&destroy:

See the link and download it follow the prompts in the program and do a scan.

Here is a link that might be useful: Spybot search & destroy

Or just try this weather page. I really like it.

Here is a link that might be useful: weather underground

No S&D did not find it had a clear scan.It just shows up on the weather.com so will just stay away from that webpage until we can figure something else out.
Thank you so much for helping me.
Gillian.

have you used superantispyware? It should clean that right out on the full scan. Try updating it and running the full scan let it remove anything it finds. IF you do not have superantispyware go get the free version, update it and run the full scan this should be done weekly.
Superantispyware is great at removing those kinds of tracking cookies and crud.

Here is a link that might be useful: superantispyware

Hi Raven
Yes I have the following on here

Avast
Comodo Firewall
Comodo BOClean
Superantispyware
Malwarebytes
Spyware Blaster
CCleaner

I did an upgrade and scan this morning with anything that would scan on that list everything comes back clean, so am at a stand still, was told down at the office supply store that "about:blank" was a webpage that companies use for advertising do not know anything about that.

the confusing thing with about:blank is it can be a legit response to having your homepage set to blank that instance if perfectly fine, then there is a nasty malware that incorporates an about:blank instance, that one is often very hard to get rid of, and it now appears this one you have found is yet another variable which may not be part of that nasty malware (coolwebsearch) but is some kind of ad link. It is pretty confusing.
about:blank = the URL interpreted by most web browsers as the command to display a blank HTML document

I think if it were me I would just avoid weather.com for now.
If you are showing clean with all your scans I think you are ok.

Just in case your IE is not set up this way you might want to check and make sure.

This is for IE 6.0. For other browsers, check microsoft or your browsers developer.
# Go to tools --> Internet Options and select Advanced tab. UN-check "Enable Install On Demand" and "Allow Software To Run or Install". That is UN-check!

# Go to security tab --> Internet --> Custom Level. Set " Download Unsigned Controls ' and " Initialize and Script Active-X controls not marked as safe " to Disable. Set ' Download Signed Controls ' to Prompt.

If you are not experiencing your actual homepage being hijacked and changed to about:com then I don't think you have the coolwebseach variant.

Boy do I feel stupid, the kids from a farm up my lane came by I,m reading your last post the kids also, one of them grabbed the mouse clicked on tools (I think) and put a mark by stop "pop-ups" went to weather.com no "about:blank" but will still stay away from the webpage living on the coast of AL know we are going to get storms most days, have printed up all the replies and have in a folder just incase.

It's always best to not to start another post.

Here is a link that might be useful: Your first post

Sorry about that "tumblenweed" I just saw where "raven" asked how I was doing with my problem and answered didn't think about which post it was on.
Gillian.