about:Blank browser hijack

Discussion in 'Malware Help (A Specialist Will Reply)' started by Mart_in68, Feb 4, 2007.

  1. Mart_in68

    Mart_in68 Private E-2

    Hi all,

    I lost my homepage last week to about:blank. The home page was reset to about:blank (with a blank screen) but no other symptoms (no pop-ups, search page still set to google, etc.). I have read and followed (to the best of my understanding all of your directions in the READ & RUN ME FIRST post, as well as the special removal instructions for about:Blank and HSA Hijacker-Simplified Removal. I still cannot re-set my home page, but I do have one new twist after running about:buster and HSremove. My home page is now set to http://hsremove.com/done.htm, but actually opens the following URL:
    http://searchportal.information.com...32UVsPWVALXVUMVV8LSxcDXg5CAxkAWlpHAGpcXAUDCFE.
    Glad someone has a sense of humor. One final note-I cannot boot in safe mode (password screen is different and won't let me log on with my regular password), so I had to do everything in normal mode.

    I will post the first three logs here; the other three in the next message. Thanks in advance for any help or advice on where to go from here.
     

    Attached Files:

  2. Mart_in68

    Mart_in68 Private E-2

    Here are the next 3 files. I had to zip bdscan (was too big for your upload limit). I was able to get around the password problem mentioned, and re-ran HS remove and about:buster in safe mode, but still no luck. Will post HJT log in the next post.
     

    Attached Files:

  3. Mart_in68

    Mart_in68 Private E-2

    Here is the HJT log, run in safe mode.

    Can someone work some magic and make all of this go away??
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Delete this file:
    C:\1893636133


    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix, exit HJT.

    Now attach new logs for:

    * GetRunKey - please download the current version first!
    * ShowNew
    * HJT

    Be sure to tell us how things are running.
     
  5. Mart_in68

    Mart_in68 Private E-2

    Thanks for the suggestions. I downloaded getrunkeys again (although the version I ran last night was only downloaded yesterday-is there a different source for a newer version?), deleted the file you mentioned, ran HJT again (in normal mode) after closing all browser windows, fixed the two items, then ran HJT again as well as getrunkeys and ShowNew. Logs attached.

    I am now back to where I was last week. Home page is back to being stuck on about:blank (with a blank screen); no other symptoms. As you can see, I have implemented a pretty good work-around in the interim-a switch to Firefox!

    Thanks again for the time and help!
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Go into Spybot > Mode > Advanced Mode > Tools > IE Tweaks.

    There are three "Miscellaneous locks" on Spybot's IE tweaks page:
    Lock Hosts file read-only as protection against hijackers
    Lock IE start page setting against user changes (current user)
    Lock IE control panel against opening from within IE (current user)
    If the "Lock IE start page setting against user changes (current user)" is checked, uncheck it and see if you change your home page.
     
  7. Mart_in68

    Mart_in68 Private E-2

    Ding! Ding! Ding! Ding!

    We have a winner! You guys are amazing. Thanks again for all the help!
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You're welcome.:)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds