about:blank problems

[stamina]

hi Can anyone help me with problems regarding the dreaded about:blank homepage. There are various posts on this site concerning this nasty little problem. I've followed them all however the problem still reappears no matter what I try. Please can someone help?

Do I need to post my hijackthis log here or something? I've not used this site before. Thanks.

[stamina]

I should point out that the registry settings for app_init_dlls is currently set to a dll that doesn't exist as I had managed to get rid of it previously. So I think the problem lies elsewhere.

[dlh6213]

hi Can anyone help me with problems regarding the dreaded about:blank homepage. There are various posts on this site concerning this nasty little problem. I've followed them all however the problem still reappears no matter what I try. Please can someone help?

Do I need to post my hijackthis log here or something? I've not used this site before. Thanks.

This needs to be put in the Security section and you can also post your hjt log there. I would move it for you, but I don't know how yet.

[stamina]

It's ok thanks I think I've fixed it. The problem with this is that there are a lot of advice and fixes and they are pretty much all incorrect. You should follow the registry fixes etc but there is still one final step:

Users will need to search for the latest dll in windows/system32 (i.e. list by date), rename it. Reboot into safe mode and delete it.

[Catweazle]

Moved to Security.

[dlh6213]

It's ok thanks I think I've fixed it. The problem with this is that there are a lot of advice and fixes and they are pretty much all incorrect. You should follow the registry fixes etc but there is still one final step:

Users will need to search for the latest dll in windows/system32 (i.e. list by date), rename it. Reboot into safe mode and delete it.

Hey all you senior techies out there, is this a good fix?

[stamina]

Not being funny but a lot of the solutions offered to this fix are a) incorrect or b) correct to some degree or c) badly written in the extreme.

One thing is for sure, cwshredder, about:buster, hijackthis, reglite.exe, ad aware - none of these will fix this problem for sure. You need to run my dll check as listed above or it will keep coming back. I hope this helps I can't believe that there isn't an automated solution to this yet another glaring security problem.

[stamina]

ok after my previous posturing this thing appears to back. Similarly to other people it has come back about two days later. I think it's to do with other users logging onto my pc, somehow this propogates again. Can anyone help?

[Catweazle]

All I can say is this:

The system I'm using now was infested with this about|blank rubbish, it is'nt now!

Just after it got hit with the about|blank thingy, it also got hit with a netsky variant virus. Here's the combination of tools I used on it, all in 'Safe mode'.

Stinger
AdAware
Spybot Search & Destroy
CWShredder
Trojan Remover

It took several reboots before full functionality of the system was restored, as several OS functions 'dissappeared for a little while (System Properties, Add/Remove programs and a few others. They came back after a few reboots)


Having got the system back to clean, working order, I've installed a better AntiVirus package and paid more attention to keeping it updated, as failure to install an update is the reason it copped the virus infection. I've also switched to using Mozilla as my default browser, and use Internet Explorer only when absolutely necessary.

[stamina]

I'm sorry catweasle but I simply don't believe you and I reckon you are trying to hawk adaware. Why on earth would it require several reboots? Either it's fixed or not. Similarly why would system properties disappear and come back?

[Catweazle]

Oh my! I'm not accustomed to being called a liar! The tale was related just as it occurred.

And as far as 'hawking AdAware' goes, I think you should read the Security forum 'sticky'! You'll notice that it suggests the use of several programs in combination to deal with Malware. Anyone who thinks any one program is 'the answer' is simply a fool!

[stamina]

Rather than rant I thought I would explain a bit more why I think you are trying to hawk adware software on here. Here is an excerpt from elsewhere:
=======================
So here are the programs I TRIED to use to remove this malware!

-Ad aware 6.0 w. updates
-Spybot w. updates (doesnt seem like they update anymore though)
-Latest version of cwshedder
-Hijack this
-Spy Sweeper with updates (takes a long time to scan but picks up more stuff than spybot/adaware)
-BHO Demon 2.0 (picks up the randomly generated .dll file

None of these programs have helped me remove this nasty spyware..

*all done in safe mode btw*
=====================

You seen this on the web time and time again. People are running these progs in safe mode and not getting anywhere. How come the security experts on this site cannot find a fix for this either?

[crunchie]

So far you have given us nothing to work with, so *nothing* is the result. :)

[stamina]

What do you need to work with? All you need to know really is that any spurious entries in any of the hijack this logs mentioned in ANY threads related to this problem are deleted accordingly, however they come back. The registry setting that needs to be deleted is also non-existent on my machine.

[dlh6213]

What do you need to work with? All you need to know really is that any spurious entries in any of the hijack this logs mentioned in ANY threads related to this problem are deleted accordingly, however they come back. The registry setting that needs to be deleted is also non-existent on my machine.

If you've done any research on the "about:blank" problem, then you should know that recent versions have become very sophisticated and difficult to remove.

You need to start somewhere, so start with the tools you've already found in other posts, then post an hjt log here so the techs have someplace to start.

[stamina]

Well guys all i can say is that I eventually removed it I believe by running all the tools mentioned in safe mode and also for each individual user in safe mode.

The part I believe I can offer as a solution was my original dll removal posting at the start of this thread. You need to find the newest dll in the system32 directory, rename it and remove in safe mode, this came back twice. Hope this can help someone.

[crunchie]

In some of the infections that file will not be visible even when you have all files/folders set to show.

[stamina]

Well I hate to say it but it is now back... I'm slowly drawing a blank, the file pointed to in the registry does not exist. A new dll gets created but I delete it in safe mode. hijackthis shows up some entries which i remove in safe mode, I then run, spybot, noadaware etc, cw shredder, about:buster, in safe mode, for each user, but then it comes back.

any new ideas?
Do you reckon sp2 will help? I can only see it leading to problems to be honest if other microsoft software is anything to go by.

[Catweazle]

I reckon formatting and installing fresh would help.

Or you could do what I did:

Download and install Mozilla, and set it as your default browser. I only use Internet Explorer nowadays for the Windows Update site, and a handful of others I visit regular which have an issue or two with Mozilla. Most sites work just fine, and the browser is better (tabbed browsing is GREAT!) and also not prone to the net nasties that plage IE.

(Service Pack 2 is marvellous, by the way. But it doesn't stop IE from being a mess that can't be fixed ;))

[caperjack]

Well I hate to say it but it is now back... I'm slowly drawing a blank, the file pointed to in the registry does not exist. A new dll gets created but I delete it in safe mode. hijackthis shows up some entries which i remove in safe mode, I then run, spybot, noadaware etc, cw shredder, about:buster, in safe mode, for each user, but then it comes back.

any new ideas?
Do you reckon sp2 will help? I can only see it leading to problems to be honest if other microsoft software is anything to go by.

Notice you haven't posted a hijackthis log ,any reason!!