BleepingComputer.com: about:blank malware

Hi,

As was running Safari, on Leopard, a flashy program popped up on my screen and told me it wanted to do an emergency scan. There was an option cancel the scan, which I stupidly pushed, and a new window popped up saying that Antivirus 2009 was scanning my computer. I quickly quit Safari and hoped that nothing happened. But now when I go the google homepage I am taken to a page that looks exactly like the google page but is titled about:blank in my History. What is this? And how can crush it?

Simaster

As you suggest, about:blank is a browser hijacker. I got it a long while back and had to do a manual registry fix which wasn't funny. There may be a patch available (assuming you are not up to date?) You could also try loading Spybot 'Search and Destroy' which may be able to recover control of your homepage but will not necessarily remove the malware. What Anti-virus/spyware programmes are you running? I'm surprised this has managed to get through without some kind of alert tbh.

EDIT: A 'Hijackthis' scan might fix it but I'm not sure if it runs on your browser set-up.

Or how about just trying to reset your start page manually? For the record, about:blank is not necessarily malware. It is merely a code that tells the browser to load a blank document, after which a page is loaded.

Quote

Please do not suggest to members to run HJT. It is clear that you do not understand the nature of the tool, or the danger in using it in an unsupervised manner. As it is, you could scan your computer with HJT 1000 times, and it will never fix anything. HJT is a primarily an information gathering tool. Using that information incorrectly can destroy the operating system.

Quote

It says the same thing in my history also, and I know for a fact my system is clean, so I am not sure why you would think there is an issue. What is the address on the Google page once it loads?

Well, this did not happen prior to the Antivirus 2009 thing. I noticed it because after the google page loads, the browser immediately loads again (almost unnoticeably fast). It only does this on the google site. So, when I noticed it I checked the history and it always says that last page to load is "about:blank." Though the web address shown in the address bar is unchanged.

And every once and while a little ad pops up on my screen. It point to one of my tabs and then disappears. Maybe I'm just paranoid but this all just started yesterday, and it seems weird.

When was the last time you updated your anti-virus?

Edit: Let me be clear here, I said the condition that you re describing is not necessarily malware. Given that you are not running a Windows based OS, it would be highly unusual that you would have any malware that shows about:blank as a symptom. Also, it is rather difficult to spoof a URL, and almost completely pointless to spoof Google. URL spoofing is done to send information to a third party, and are usually found in conjunction with spoofed login pages. Finally, as far as I am aware, Antivirus 2009 does not run on non-windows based machines. I don't know of a single instance of any non-Windows Os being affected.

Pop-ups can can be from a variety of things, and by itself means nothing more than someone figured out a way around the pop-up blocker.

There could be a multitude of reasons for the behavior that you are seeing.

I don't have an anti-virus. I just downloaded ClamXav, but have not ran it yet.

Do I need an anti-virus for OS X? If so, which would you recommend? I don't want something that will bog down my computer.

Clam should be fine. That is what I use on my server.

Alright. Thanks Groovicus. I guess I was overreacting. I'll keep an eye things and hope that everything is fine.

Simaster