About:blank won't stop coming back

I've gone through the steps in the read this first thread.

I recently had help cleaning up the smitfraud trojan and thought I was good to go, but haven't been able to get rid of about:blank. It just keeps reloading itself and giving me random popup ads.

After getting help with smitfraud I downloaded and have since been runing the ZoneAlarm firewall and the Avast! anti-virus protection.

I'm able to clear the about:temporarily, but it just keeps coming back. What should I do?

 

This particualar hijacker can be difficult to remove. However, it is possible but may take some time. Lets start by getting a HJT log.


http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Here's the log. I appreciate your help.

 

Download this file: SpSeHjfix109

Unzip it to your desktop or to a folder.

Boot into Safe Mode

Start SpSeHjfix, click on " Desinfecton starten" (the other button means close) then it will reboot and finish the cleaning.

Run SpSeHjfix one more time.

Reboot in Normal mode.

Run HijackThis again and post a new log. Also post the log from SpSeHjfix, the log should be on your desktop or the same folder as SpSeHjfix.

 

Here are my logs.

After running SpSeHjfix I was unable to open Internet Explorer from the desktop icon. I was able to get in via the link to my Yahoo mail on the start bar. I dont know if you need that info, I'm just letting you know.

 

Scan with HijackThis and Check the Boxes for the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

Make sure All Browser Windows are Closed when you Click FIX.

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then

click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful

like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all

Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it

may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web

Settings". Now go back to the General tab and set your home page address to something useful like

www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline

content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the

Security Tab and click Default Level for Internet, Local

Intranet, Trusted Sites


After doing the above steps reboot your computer. Your HJT log is clean! Are you having any further problems?

 

Everything is looking good. Thank you, your site has helped me twice now.

Would using a different browser, other than IE, help prevent this from happening again? If so, what do you suggest?

 

Yes, I would recommend using Mozilla Firefox 1.04 from now on as it is a lot safer.

Everything you need to protect yourself in mentioned in this thread below.

How to Protect yourself from malware!