About blank help!

[ellie]

Have been browser hijacked by 'about blank'. It's taken over my homepage, wont let me use google and keeps throwing me off of the internet. Ive done 2 McAfee virus scans and it finds nothing but McAfee keeps popping up on my screen that it's found and deleted the same trojan over and over again. Ive ran Ad-Aware in safe mode and that just found a few cookies. Can anybody please help?

[punky]

You could try Microsoft Anti-spyware... See if that works.

Failing that, try running Hijack This, and posting us scan log, and see if we can sort it for you.

you could try the suggestions in the link, Ellie

http://www.pchell.com/support/aboutblank.shtml

- good luck

[ellie]

How do I work hijack this?

[punky]

It has a help guide on the front page. When the window comes up, press "Scan" at the bottom. The text box should fill up with the processes running on your computer, etc. Post all that in here, and we can see what might be causing it to come back.

[Paul K]

Once you get your browser back under control please make sure you are running some form of anti-spyware tool so that it stays under your control.
MS Anti-spyware and spybot S&D are both useful tools that will clean your PC of spyware but can also help to pro-actively protect you from further problems.
Spywareblaster, spywareguard and Ad-aware are also on my list of spyware protection tools.
MS Anti-spyware
Spybot S&D
Adaware
Spyware Blaster
Spyware Guard

[ellie]

Ok, Is this what you meant Punky?

Logfile of HijackThis v1.99.1
Scan saved at 20:27:22, on 05/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\vsnpstd2.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\DOCUME~1\Eagles\LOCALS~1\Temp\1FF.tmp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Eagles\Local Settings\Temp\Temporary
Directory 1 for hijackthis.zip\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695
ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5
_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6
BE0B3} - C:\Program Files\Adobe\Acrobat 6.0
\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {58F07DD3-924D-4141-BC74-299F523A95F1} - (
no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236
F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-
0090271D4F88} - C:\Program Files\Yahoo!
\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:
\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32
\NeroCheck.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32
\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark
X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program
Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program
Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client
Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1
\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5
.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.
com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.
com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.
com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.
com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1
\MpfTray.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [1FF.tmp] C:\DOCUME~1\Eagles\LOCALS~1\Temp\1
FF.tmp.exe
O4 - HKLM\..\Run: [1FF.tmp.exe] C:\DOCUME~1\Eagles\LOCALS~1
\Temp\1FF.tmp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop
Messenger\8876480\Program\LogitechDesktopMessenger .exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C
608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF
-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi
150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D
0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D
5-AD55-00010333D0AD} - C:\Program Files\Yahoo!
\Messenger\yhexbmesuk.dll
O9 - Extra button: MP3download - {76DD9E77-F06C-4471-AB6C-CF03C5
C6B5B0} - C:\WINDOWS\System32\MP3download (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318
AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F
795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11
d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers
Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.
cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (
MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/
MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper
Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.
cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter
Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet
Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/
FPDC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo
Upload Tool) - http://spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0
,910,0
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso
.masminutos.com/laaplicacion.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (
MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/
MessengerStatsClient.cab30149.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install
.wildtangent.com/bgn/partners/nike/nikefz4/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (
MsnMessengerSetupDownloadControl Class) - http://messenger.msn.
com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro
Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook
Class) - http://us.dl1.yimg.com/download.yaho...nstalls/suite/
autocomplete.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess
Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail
Attachments Control) - http://by9fd.bay9.hotmail.msn.com/activex/
HMAtchmt.ocx
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire
Showdown Class) - http://messenger.zone.msn.com/binary/
SolitaireShowdown.cab30149.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Network Security Service (NSS) ( 11FÃÃâ€*’ŸÃà †â€™Ãƒâ€*’¤#Ãà ¢â‚¬Å¡Ãƒâ€šÃ‚·Ãƒâ↚¬Å¡Ãƒâ€šÃ‚ºÃƒÃâ€*’à ƒÆ’¢â‚¬Å¾ÃƒÃâ€*†™ÃƒÂ¢Ã¢â€šÂ¬Ã¢â‚¬Å“`I) -
Unknown owner - C:\WINDOWS\sdkfd32.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:
\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe)
- McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte)
- Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.
com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee
Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe



The trojan that McAfee says it's finding all the time is START PAGE-DU.dll
__________________

Anyone?

[Paul K]

I would put a tick mark against this entry
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = about:blank
and tell hijackthis to fix selected. I've read that McaAfee should be able to remove the problem so I'm confused as to how it's coming back. I would sugest running Adaware, Spybot and spyware blaster to check your system is totally clean.
Also look through your control panel, add/ remove programs list for anything strange or anything with the word "search" in it.
__________________

Ellie, does McAdee say where the start page trojan is? It may be that you have to run the scans in safe mode after turning System restore off and then back on again. It could be that the trojan is locked in a system restore point and is being put back as Windows is being fooled into believing you need it.

From Homealone's link:-

AUTOMATIC REMOVAL METHOD
A new adware removal program called Adware Away has proven very successful in removing the About:Blank homepage hijacker along with many other hijacker type programs. They have a trial version that is fully functional which allows most people to remove the About:Blank hijacker without having to purchase it. The trial version of Adware Away seems to last between 5 to 7 days before timing out and requiring payment. You can visit their webpage and download a trial of Adware Away by clicking on the following link. You may also purchase the program for $29.95.

I recommend this program for instances where the manual removal methods dont work. Currently there are about 5 variants of the About:Blank homepage hijacker and Adware Away handles all these variants.

http://www.adwareaway.com/aboutblank.htm


Try that?

[Ignition]

Try the above if it doesn't work I'll talk you through how to remove the hi-jack manually.

EDIT: Ah here we go, http://www.lavasoftusa.com/software/adaware/ the daddy of Spyware / Hijack killers.

Also

http://www.microsoft.com/athome/secu...e/default.mspx

Microsoft's remover.

Quick and easy, no need to sift through a hijack-this report which is a bit of a PITA even to a geek like me!

If you're having probs getting to these sites download Firefox + get them that way, http://www.getfirefox.com.

[ellie]

Originally Posted by Paul

I would put a tick mark against this entry
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = about:blank
and tell hijackthis to fix selected. I've read that McaAfee should be able to remove the problem so I'm confused as to how it's coming back. I would sugest running Adaware, Spybot and spyware blaster to check your system is totally clean.
Also look through your control panel, add/ remove programs list for anything strange or anything with the word "search" in it.
__________________

Ellie, does McAdee say where the start page trojan is? It may be that you have to run the scans in safe mode after turning System restore off and then back on again. It could be that the trojan is locked in a system restore point and is being put back as Windows is being fooled into believing you need it.

Its says C/WINDOWS/system32/aytfq.dll was infected by START PAGE-DU.dll

Dont know if that's what you mean Paul?

[Paul K]

Have you followed any of the instructions on this thread?
If you have and it's coming back again then it may well be you have to turn off system restore to fully remove all traces of it, if not then please read through the posts made so far and run the necessary tools.

[ellie]

I got rid of the 'about blank' thing from 'hijack this' and I seem to have my homepage and browser back, but I keep getting a long brown bar at the top of the screen saying my pc is infected and also if I try to search my sites on my address bar it shuts down I.E

Also should I be worried about the 'URL searchhook is missing' thing on my hijack scan?

[Paul K]

Have you run any of the spyware tools in the thread? You may need to run them to fully cleanse your system.

[Ignition]

Come on MSN or something, I'll send you a clean copy of the file to replace the broken one.

What does the antivirus want to do with the infection?

Ta.