Find your solution!

Shady K · 14-Aug-2004, 10:48 PM #1

I dont know wherre I have been, but everytime I launch IE I get about:blank in my address bar. It is HOME SEARCH with all different search categories. the URL is full-search.net. It has popup windows for spyware removal, and other things. I have run AdAware, SpybotS&D & Spykiller. I cannot get rid of it. I go into Internet Options to change my homepage, and everytime it goes right back. I have run searchs trying to find its origin in my PC. I am at a loss and I am frustrated. Please help me get rid of this.

telecom69 · 14-Aug-2004, 11:46 PM #2

OK go here and download the shredder click to see if there are any updates before running it http://www.soft32.com/download-CWShredder-19014-5.html

When you have done that go here and download hijackthis to its own folder http://www.majorgeeks.com/download3155.html read all instructions carefully on how to post a log back here....

about:blank is the most common problem we get on here and sometimes its difficult to remove so be patient we will get there in the end

Shady K · 14-Aug-2004, 11:56 PM #3

Well, Shredder didn't find anything, but here is the Hijack this log

Logfile of HijackThis v1.97.7
Scan saved at 11:55:28 PM, on 8/14/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\windows\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\system32\mfcun.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\system32\ieyx32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\windows\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\Shady\LOCALS~1\Temp\Rar$EX00.328\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\ebubm.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\ebubm.dll/sp.html#21259
O2 - BHO: (no name) - {56CEBCF1-61DF-21E9-D514-D3171D072D49} - C:\windows\sdknb32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mfcun.exe] C:\windows\system32\mfcun.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...213.7597337963
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

telecom69 · 15-Aug-2004, 12:47 AM #4

Did you get that hijack from the link I gave you? it should be version 1.98.2 anyway put a tick by these and after closing all open windows have hijack fix them

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\ebubm.dll/sp.html#21259

Shady K · 15-Aug-2004, 05:04 PM #5

Ok I Checked all of the items, Hijack fixed and removed them, and it is still happening. No I didn't download from the place you said . I already had hijack this. should I get the newer version?

Shady K · 06:37 PM

I also noticed in my ADD/Remove programs I have a program called Search Extender and Shopping Wizard which cannot be removed because it is unable to open http://looking-for.cc/uninstall/SearchExtender.html and http://looking-for.cc/uninstall/ShoppingWizard.html. Plus the about:blank homepage which is called Home Search, has the windows logo next to it.

telecom69 · 15-Aug-2004, 10:53 PM #7

Yes please get the latest version of hijackthis

get rid of that homepage from add/remove

did you try that uninstall/search extender?

Shady K · 17-Aug-2004, 12:52 AM #8

OK I got the newest version, I cannot get rid of that homepage from add/remove programs. It willnot open the uninstall Url that I listed previously. Here is the new Hijack this log

Logfile of HijackThis v1.98.2
Scan saved at 12:51:28 AM, on 8/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\system32\mfcun.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\windows\System32\rundll32.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\system32\ieyx32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\windows\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {56474FA3-EE2A-DC66-C8A6-35AC8A3C5C6C} - C:\windows\system32\addvl32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mfcun.exe] C:\windows\system32\mfcun.exe
O4 - HKLM\..\Run: [NeroCheck] C:\windows\system32\NeroCheck.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

telecom69 · 01:30 AM

Put a tick by these and after closing all open windows have hijack fix them

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\system32\bhuiy.dll/sp.html#21259
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

If this doesnt do any good I will get a Moderator to have a look at your log

Shady K · 18-Aug-2004, 02:10 AM **#10**

Nope, it works 1 time. Afterchecking all the boxes and having Hijack this fix them, I click Internet Explorer and Yahoo.com(my normal homepage) comes up. I exit out and click IE again and it goes right back to about:blank.

telecom69 · 18-Aug-2004, 02:48 AM **#11**

OK Shady K I have now asked a Moderator to look at your log,she is very good,if she cant sort it no-one can her name is Cookiegal

CarreMarie · 18-Aug-2004, 07:25 AM **#12**

Ok, I've had the same problem as you, I simply restarted the computer in safe mode, ran Ad-Aware, Adware Away, Shredder, Buster, and then Hijack this while in safe mode. It got rid of everything spyware.

Thats the easiest way i found to get rid of it.
To get to safe mode, simply press F8 during boot-up, and run the programs I've listen.

When it comes to Hijack This, just click the following.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\system32\bhuiy.dll/sp.html#21259
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

That should clean up your system. It did for me. Look, I'm becoming a computer geek! Yay!

telecom69 · 18-Aug-2004, 02:40 PM **#13**

Not always as simple as that Im afraid CarreMarie,Im thinking that maybe that one time you were lucky

**dvk01** · 18-Aug-2004, 03:54 PM **#14**

download aboutbuster from http://forums.subratam.org/index.php?showtopic=1072

and folow instructions on the last post of that thread

run it twice yahne post a new hjt log here please

Shady K · 19-Aug-2004, 01:15 AM **#15**

Well, I can't even use about:Buster, I open it up hit OK and I get an error message:
Run-time Error '339'
Component 'mscomctl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid.
Now What?

Tag Cloud
access audio black screen blue screen boot bsod connection crash dell desktop driver drivers dvd email error excel excel 2003 firefox hard drive hardware hdmi hijackthis internet itunes keyboard laptop malware monitor motherboard network networking outlook problem recovery router screen slow sound spyware trojan upgrade video virus vista vundo windows windows 7 windows vista windows xp wireless

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)