Hello,

This is the problem:

If I have a browser (for instance opened to a news website) open and then I open a second one and click a link off my homepage (which is made with microsoft word) it opens a third page with the about:blank in the address bar and the page itself is blank. Then the page for the link shows up in the first browser and of course I lose the news webpage I was on.

EDIT: I have just realized that I also have this problem on links from other pages so I guess the fact that I used microsoft word to make my homepage is not necessarily relevant.

So...I tried to follow your directions and I ran the SUPERAntiSpyware Scan. The first time I did it wrong but it gave me this:

SUPERAntiSpyware Scan Log
Generated 03/31/2008 at 04:03 AM

Application Version : 3.6.1000

Core Rules Database Version : 3427
Trace Rules Database Version: 1419

Scan type : Complete Scan
Total Scan Time : 00:42:48

Memory items scanned : 622
Memory threats detected : 0
Registry items scanned : 7656
Registry threats detected : 0
File items scanned : 97764
File threats detected : 21

Adware.Tracking Cookie
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@2o7[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@ad.yieldmanager[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@adinterax[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@ads.pointroll[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@ads.revsci[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@advertising[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@anad.tacoda[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@atdmt[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@casalemedia[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@doubleclick[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@edge.ru4[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@fastclick[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@media.adrevolver[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@mediaplex[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@questionmarket[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@revsci[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@richmedia.yahoo[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@tacoda[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@tribalfusion[2].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@usatoday1.112.2o7[1].txt
C:\Users\New User\AppData\Roaming\Microsoft\Windows\Cookies\Low\new_user@zedo[1].txt

Because I did it wrong, I ran it again. It ran for over 10 hours, I figured something was amiss and cancelled it. At which point it said "scan completed" and had found no problems:

SUPERAntiSpyware Scan Log
Generated 03/31/2008 at 02:33 PM

Application Version : 3.6.1000

Core Rules Database Version : 3427
Trace Rules Database Version: 1419

Scan type : Complete Scan
Total Scan Time : 10:20:23

Memory items scanned : 568
Memory threats detected : 0
Registry items scanned : 7663
Registry threats detected : 0
File items scanned : 984303
File threats detected : 0

Then I tried to run Panda but when I pressed the SCAN button, it only pulled up a blank page and I could not proceed.

I appreciate your time and patience with my problem.

thanx4urhelp

This post has been edited by thanx4urhelp: Apr 1 2008, 01:24 AM

Hi thanx4urhelp,

Welcome to Geeks to Go.

Let's first check for any Malware.

Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis.
• Read the Licience Agreement and click I Accept and then it will launch HijackThis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Thank you for taking time to help me.

Here is the log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:05:06 PM, on 4/10/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\TabUserW.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Eset\nod32kui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Users/New%20User/Documents/HOMEPAGE2.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to EverNote - res://C:\Program Files\EverNote\EverNote\enbar.dll/2000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program Files\EverNote\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program Files\EverNote\EverNote\enbar.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.ameritrade.com
O15 - Trusted Zone: http://www.bnaiisrael-nm.org
O15 - Trusted Zone: http://ipgweb.cce.hp.com
O15 - Trusted Zone: http://www.mayoclinic.com
O15 - Trusted Zone: http://www.netlibrary.com
O15 - Trusted Zone: http://www.operationfindachild.org
O15 - Trusted Zone: http://www.questionpoint.org
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h20364.www2.hp.com/CSMWeb/Customer/...DataManager.CAB
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6899 bytes

Hi thanx4urhelp,

That log is clean and I can't see anything there that would be causing problems.

There are only "cookies" in the SUPERAntiSpyware Scan Log from your Post#1 so there is nothing of real concern there.

Let's clear the cache and any temp files that you have and see what happens then.

Please download ATF Cleaner by Atribune.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

Click Exit on the Main menu to close the program.

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 5 and save it to your desktop.
• Scroll down to where it says "JJava Runtime Environment (JRE) 6 Update 5...allows end-users to run Java applications".
• Click the "Download" button to the right.
• Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version.

Reboot the computer.

Open your browser and test to see if the condition happens again.

Please post back with the results whether that fixed it or not.

Thanks.

I have followed all the instructions and regret to say, the condition still persists as before.

Hi thanx4urhelp,

The problem does not appear to be Malware related. I suggest that you start a topic in either the Windows Vista or Web Browsers and Email forums as one of the Techs there will be able to help. Be sure to let them know that you have been given the all clear from the Malware forum.

Well, I guess that's good news.
Thank you for your time and effort.
I have followed your advice and posted in the Windows Vista forum.

thanx4urhelp

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.