Close IE Shows About:Blank

Discussion in 'Malware Help (A Specialist Will Reply)' started by geeksrule, Apr 15, 2007.

  1. geeksrule

    geeksrule Private E-2

    Good Evening to All

    Problems: Close IE adress bar shows about:blank
    Close IE about:blank shows in the area where it shows "done"
    If I close IE and then relaunch IE the pages launch slow and the computer seems to run slower
    IE version 7.0.5730.11 (updated today original infection IE 5 or 6)

    For the last 3 weeks I have been trying to remove a CWS virus. I'm at the end of my rope. I located the following file that may be the problem :
    HKEY_Local_Machine\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Windows\Applnit_DLLs

    I've tried everything to no avail. Somebody please help by giving me detailed instructions on manual removal. A text file from hijackthis is attached. Thanks to all that are willing to help.

    John
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Why are you running your PC with no protection?
    • no antivirus
    • no true firewall
    • no realtime antispyware

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments. You have HijackThis installed incorrectly and not renamed. Make sure you follow our directions.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
      • CounterSpy - only for Windows XP, 2K, & NT users
      • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
      • Bitdefender - from step 6
      • Panda Scan - from step 6
      • runkeys.txt - the log from GetRunKey.bat
      • newfiles.txt - the log from ShowNew.bat
      • HijackThis
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
  3. geeksrule

    geeksrule Private E-2

    Close IE Shows About:Blank (Thread #2)

    Thanks for your help Major Attitude.

    I completed all actions outlined in the following: http://forums.majorgeeks.com/showthread.php?t=35407.
    I disabled system restore at the beginning. This was the only deviation from your instructions.

    I ran Panda ActiveScan but it didn't give me an option to save a report.

    When spybot completed it showed 4 problems.
    Number one stated "Alexa Related" clean on reboot. During start up of my computer Spybot stopped the computer and scanned it again. As I recall no messages after complete ion.
    Problem 2 was Microsoft firewall off.
    Problem 3 Microsoft update off.
    Problem 4 was Antivirus off.

    No other program identified any issues or problems after scanning.

    About blank still shows in IE addresses box after closing. If I restart IE my computer seems to run extremely slow. Also, since this problem showed up my computer shows a message on the line of virtual memory is running low increase paging system. These may not be related. What do you think? My RAM is 128 so this may be the problem as well. I want to purchase a new computer. However, I want to wait for Vista to show all of the problems, as did XP. Buying a computer now with Vista on would be comparable to buying the first Ford Pinto. I hope you didn’t buy the first Ford Pinto. If you did sorry for the insult. Thanks for your help.

    John
     
  4. geeksrule

    geeksrule Private E-2

    Close IE Shows About:Blank (Thread #3)

    Additional uploaded files.

    John
     

    Attached Files:

    Last edited: Apr 29, 2007
  5. geeksrule

    geeksrule Private E-2

    Close IE Shows About:Blank (Thread #4)

    Additional files.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs do not show an about:blank hijacker type problem. about:blank appearing at shutdown is not what an about:blank hijacker would cause anyway.

    The amount of RAM you have is totally inadequate for running Windows XP (no matter what Microsoft indicates for minimum requirements this is insufficient).


    Virtual Memory problems are not an issue for this forum, but you need to increase your settings especially since you have so little memory.
    If you want to improve things on your PC and use less memory, dump the Norton/Symantec resource hog and use something else. Also dump all the stuff from NetZero that you don't need and only keep what is required to connect to the internet. I don't believe either of the below are required:

    O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
    O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w

    I doubt their toolbar is necesary too.

    Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
    C:\Documents and Settings\All Users\Application Data\Sunbelt Software
    C:\Program Files\Sunbelt Software

    You can also have HJT fix the below two unnecessary startup items which will help improve performance a little:
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE


    That is a valid a necessary registry key! What get's put in it could be bad or good. You have nothing in it.

    If you have a CSW trojan, you will have to give me a log that shows that it is finding something.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds