Member Avatar for rhoman2004

Can you help out with this HJT log? I have tried using KIllbox and other methods but they keep popping up:

Logfile of HijackThis v1.98.2
Scan saved at 1:07:15 PM, on 12/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\addlo32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\netny.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\User\LOCALS~1\Temp\Temporary Directory 8 for hijackthis.zip\HijackThis.exe

O2 - BHO: (no name) - {9901F3E7-FA3D-4625-F19B-9AC4EDCBCF55} - C:\WINDOWS\wingu32.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [netny.exe] C:\WINDOWS\netny.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

Any help would be appreciated.

Thanks

  • 3 Contributors
  • 2 Replies
  • 111 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

A concise recovery plan and clarifications for the persistent "about:blank" symptom. That behavior is frequently a side effect of a homepage hijack, a malicious toolbar/BHO, or a startup/persistence component that keeps restoring Internet Explorer settings. The HijackThis output shown in the thread looks truncated and was created from a temporary location; and were correct to flag that. Running diagnostic tools from a permanent folder and producing a complete log makes safe backups and restores possible.

Recommended immediate steps:

  • Boot into Safe Mode with Networking so fewer third-party components are active.
  • Run a current anti-malware scan (second-opinion tool like Malwarebytes) to remove obvious spyware/adware.
  • Use Autoruns (Sysinternals) to inspect all persistence points (Logon, Scheduled Tasks, Explorer, Internet Explorer sections). Uncheck unfamiliar entries rather than deleting them immediately.
  • Review Internet Explorer Add-ons (BHOs/toolbars) and reset IE settings if the homepage keeps reverting. Also check browser shortcut Target fields for injected parameters.
  • If a rootkit is suspected (reappearing processes, hidden files), run a dedicated rootkit scanner or a rescue/bootable scanner; these require care.

Notes on log analysis and safety: generate a fresh, complete HijackThis log saved in a non-temporary folder and capture results from any scans/Autoruns exports. Avoid "blind" fixes — many Windows entries look odd but are legitimate; disabled entries can usually be restored from tool backups. When seeking help, include the full HJT log plus the output of the anti-malware scan and an Autoruns screenshot or export for faster, accurate advice.

References: more background on the about:blank page (About:blank — Wikipedia), Autoruns for persistence analysis (Autoruns — Microsoft Sysinternals), and a recommended second-opinion scanner (Malwarebytes).

Recommended Answers

All 2 Replies

Member Avatar for deonnanicole

That isn't a complete log...it's awful short. And be sure to save it in its own permanent foler, not a temporary one like where you have it now, so it can safely make backups in case you need them. :)

Member Avatar for caperjack

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.