Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

About:Blank Search Page

Started by hookem_horns79 , Jan 20 2005 05:20 PM

  • Please log in to reply

#1
hookem_horns79
Posted 20 January 2005 - 05:20 PM

hookem_horns79

    New Member

  • Member
  • Pip
  • 6 posts
Here is my Hijack this log. Any help?

Logfile of HijackThis v1.99.0
Scan saved at 5:12:47 PM, on 1/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\taskman.exe
C:\WINNT\system32\ctfmon.exe
c:\WINNT\system32\dllcache\iexplore.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {7D6F71E3-138A-4480-9AF2-C0B226BD8D9A} - C:\WINNT\system32\mdiigp.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = regencygas.local
O18 - Filter: text/html - {64B12706-C536-4842-AFDA-2F24D9F4B07A} - C:\WINNT\system32\mdiigp.dll
O18 - Filter: text/plain - {64B12706-C536-4842-AFDA-2F24D9F4B07A} - C:\WINNT\system32\mdiigp.dll
  • 0

Advertisements

#2
-=jonnyrotten=-
Posted 20 January 2005 - 06:40 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
You have a nasty About:Blank infection. This fix requires several tools that need to be downloaded. Please download these now, we will run them later.

1) About:Buster - Download it and extract it to C:/aboutbuster.
2) CleanUp! - Download it and install it.
3) CWShredder 2.11 - Download it and save it to your desktop.
4) Ad-Aware - Download, install, and update.

Enable hidden files and folders: http://www.bleepingc...torial=62#winme

During the fix do NOT connect to the internet. Unless you can memorize these instructions, it would be a good idea to print them out.

Boot into safe mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Run AboutBuster
-Click Start to begin the process
-Click OK on the Buster Report dialogue box to start the scan
AboutBuster scans the computer for malicious files and deletes them.
Save the report (copy and paste into Notepad and save as a .txt file) to post a copy for review.

Run CWShredder
-Next, click on the: ‘Fix’ button
-Follow the prompts, and press OK

Run CleanUp
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Run Ad-Aware
-Configure Ad-Aware for a full system scan
-Run it

Clean Up the left overs

Run HJT, close any open windows, and fix the following items (if they are still there):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {7D6F71E3-138A-4480-9AF2-C0B226BD8D9A} - C:\WINNT\system32\mdiigp.dll
O18 - Filter: text/html - {64B12706-C536-4842-AFDA-2F24D9F4B07A} - C:\WINNT\system32\mdiigp.dll
O18 - Filter: text/plain - {64B12706-C536-4842-AFDA-2F24D9F4B07A} - C:\WINNT\system32\mdiigp.dll

Then delete the following files (if they exist):

C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll
C:\WINNT\system32\mdiigp.dll

Reboot into normal mode (simply restart your computer as you normally would), and run the following free, online virus scans:

http://housecall.tre.../start_corp.asp
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp

Then restart your computer one more time and post a new HJT log as well as the About:Buster log I asked you to save earlier.

-=jonnyrotten=- :tazz:
  • 0

#3
hookem_horns79
Posted 20 January 2005 - 07:08 PM

hookem_horns79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Sounds good. May not get it all done today, but will tomorrow. Thanks
  • 0

#4
hookem_horns79
Posted 20 January 2005 - 07:13 PM

hookem_horns79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
The link for enabling hidden files and folders would not open. Any help?
  • 0

#5
-=jonnyrotten=-
Posted 20 January 2005 - 07:32 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Control Panel, Folder Options, scroll down the list and look for "Show Hidden Files and Folders" and make sure that option is selected. Then click "OK".

-=jonnyrotten=- :tazz:
  • 0

#6
hookem_horns79
Posted 21 January 2005 - 11:10 AM

hookem_horns79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Okay. Ran everything. Used Panda scan. Here is my hijack:

Logfile of HijackThis v1.99.0
Scan saved at 11:07:13 AM, on 1/21/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\taskman.exe
C:\WINNT\system32\ctfmon.exe
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {EFC10621-DCB1-4455-B82B-2550212C96E7} - C:\WINNT\system32\ppeeih.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = regencygas.local
O18 - Filter: text/html - {9B2D998B-C6A7-4207-9246-7D329D6D0B56} - C:\WINNT\system32\ppeeih.dll
O18 - Filter: text/plain - {9B2D998B-C6A7-4207-9246-7D329D6D0B56} - C:\WINNT\system32\ppeeih.dll

And here is the About:Buster log

Scanned at: 8:10:37 AM on: 1/21/2005


-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 19

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 19

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!
  • 0

#7
-=jonnyrotten=-
Posted 21 January 2005 - 02:38 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Hmm, lets try a different approach.

Please download "Service Filter" from here:

http://www.geekstogo...=download&id=41

Unzip the contents of the .zip file to a convenient location and follow the instructions below.


Double Click ServiceFilter.vbs to run it.

If you have a script blocking program you will get a warning asking if you want to allow ServiceFilter.vbs to run, some will say "malicious script warning" or something to that effect. There is nothing malicious about this script, you can click to allow it to execute.

When the script finishes a wordpad doc should open with the unknown services listed in it. If the script could not access wordpad then you will see a message box telling you so, in that case you need to open POST_THIS.TXT by double clicking it. . Paste the contents back here.

From the moment you post your list, until you see a detailed fix written up, DO NOT reboot your system or log off. If you do, the service will have changed and the fix provided will not work

-=jonnyrotten=- :tazz:
  • 0

#8
hookem_horns79
Posted 21 January 2005 - 02:56 PM

hookem_horns79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
The script did not recognize the services listed below.
This does not mean that they are a problem.

To copy the entire contents of this document for posting:
At the top of this window click "Edit" then "Select All"
Next click "Edit" again then "Copy"
Now right click in the forum post box then click "Paste"

########################################

ServiceFilter 1.1
by rand1038

Microsoft Windows 2000 Professional
Version: 5.0.2195 Service Pack 4
Jan 21, 2005 2:55:45 PM


---> Begin Service Listing <---

Unknown Service # 1
Service Name: .NET Connection Service
Display Name: .NET Framework Service
Start Mode: Disabled
Start Name: LocalSystem
Description: .NET Framework ...
Service Type: Own Process
Path: c:\winnt\svchost.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Unknown Service #2
Service Name: DefWatch
Display Name: Symantec AntiVirus Definition Watcher
  • 0

#9
-=jonnyrotten=-
Posted 21 January 2005 - 03:04 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
No malicious services, don't know why the fist fix didn't work.... If you connect to the internet or reboot the computer (other than into Safe Mode) the files may morph. If you notice the files did in fact change too. So lets try the first fix again, and make sure you only reboot into safe mode to do this fix and the next time you reboot will be at the end when you're done and you reboot back into normal mode.

During the fix do NOT connect to the internet. Unless you can memorize these instructions, it

would be a good idea to print them out.

Boot into safe mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu

should come up where you will be given the option to enter Safe Mode.

Run AboutBuster
-Click Start to begin the process
-Click OK on the Buster Report dialogue box to start the scan
AboutBuster scans the computer for malicious files and deletes them.
Save the report (copy and paste into Notepad and save as a .txt file) to post a copy for review.

Run CWShredder
-Next, click on the: ‘Fix’ button
-Follow the prompts, and press OK

Run CleanUp
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Run Ad-Aware
-Configure Ad-Aware for a full system scan
-Run it

Clean Up the left overs

Run HJT, close any open windows, and fix the following items (if they are still there):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {EFC10621-DCB1-4455-B82B-2550212C96E7} - C:\WINNT\system32\ppeeih.dll
O18 - Filter: text/html - {9B2D998B-C6A7-4207-9246-7D329D6D0B56} - C:\WINNT\system32\ppeeih.dll
O18 - Filter: text/plain - {9B2D998B-C6A7-4207-9246-7D329D6D0B56} - C:\WINNT\system32\ppeeih.dll

Then delete the following files (if they exist):

C:\DOCUME~1\DUBACH~1.REG\LOCALS~1\Temp\sp.dll
C:\WINNT\system32\ppeeih.dll

Reboot into normal mode (simply restart your computer as you normally would), and run the

following free, online virus scans:

http://housecall.tre.../start_corp.asp
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp

Then restart your computer one more time and post a new HJT log as well as the About:Buster log you were asked to save earlier.

-=jonnyrotten=- :tazz:
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP