[Shady K]

I dont know wherre I have been, but everytime I launch IE I get about:blank in my address bar. It is HOME SEARCH with all different search categories. the URL is full-search.net. It has popup windows for spyware removal, and other things. I have run AdAware, SpybotS&D & Spykiller. I cannot get rid of it. I go into Internet Options to change my homepage, and everytime it goes right back. I have run searchs trying to find its origin in my PC. I am at a loss and I am frustrated. Please help me get rid of this.

[telecom69]

OK go here and download the shredder click to see if there are any updates before running it http://www.soft32.com/download-CWShredder-19014-5.html

When you have done that go here and download hijackthis to its own folder http://www.majorgeeks.com/download3155.html read all instructions carefully on how to post a log back here....

about:blank is the most common problem we get on here and sometimes its difficult to remove so be patient we will get there in the end

[Shady K]

Well, Shredder didn't find anything, but here is the Hijack this log

Logfile of HijackThis v1.97.7
Scan saved at 11:55:28 PM, on 8/14/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\windows\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\system32\mfcun.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\system32\ieyx32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\windows\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\Shady\LOCALS~1\Temp\Rar$EX00.328\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\ebubm.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\ebubm.dll/sp.html#21259
O2 - BHO: (no name) - {56CEBCF1-61DF-21E9-D514-D3171D072D49} - C:\windows\sdknb32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mfcun.exe] C:\windows\system32\mfcun.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...213.7597337963
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

[telecom69]

Did you get that hijack from the link I gave you? it should be version 1.98.2 anyway put a tick by these and after closing all open windows have hijack fix them

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\ebubm.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\ebubm.dll/sp.html#21259

[Shady K]

Ok I Checked all of the items, Hijack fixed and removed them, and it is still happening. No I didn't download from the place you said . I already had hijack this. should I get the newer version?

[Shady K]

I also noticed in my ADD/Remove programs I have a program called Search Extender and Shopping Wizard which cannot be removed because it is unable to open http://looking-for.cc/uninstall/SearchExtender.html and http://looking-for.cc/uninstall/ShoppingWizard.html. Plus the about:blank homepage which is called Home Search, has the windows logo next to it.

[telecom69]

Yes please get the latest version of hijackthis

get rid of that homepage from add/remove

did you try that uninstall/search extender?

[Shady K]

OK I got the newest version, I cannot get rid of that homepage from add/remove programs. It willnot open the uninstall Url that I listed previously. Here is the new Hijack this log


Logfile of HijackThis v1.98.2
Scan saved at 12:51:28 AM, on 8/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\system32\mfcun.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\windows\System32\rundll32.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\windows\System32\nvsvc32.exe
C:\windows\system32\ieyx32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\windows\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {56474FA3-EE2A-DC66-C8A6-35AC8A3C5C6C} - C:\windows\system32\addvl32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\windows\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mfcun.exe] C:\windows\system32\mfcun.exe
O4 - HKLM\..\Run: [NeroCheck] C:\windows\system32\NeroCheck.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

[telecom69]

Put a tick by these and after closing all open windows have hijack fix them

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\system32\bhuiy.dll/sp.html#21259
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

If this doesnt do any good I will get a Moderator to have a look at your log

[Shady K]

Nope, it works 1 time. Afterchecking all the boxes and having Hijack this fix them, I click Internet Explorer and Yahoo.com(my normal homepage) comes up. I exit out and click IE again and it goes right back to about:blank.

[telecom69]

OK Shady K I have now asked a Moderator to look at your log,she is very good,if she cant sort it no-one can her name is Cookiegal

[CarreMarie]

Ok, I've had the same problem as you, I simply restarted the computer in safe mode, ran Ad-Aware, Adware Away, Shredder, Buster, and then Hijack this while in safe mode. It got rid of everything spyware.

Thats the easiest way i found to get rid of it.
To get to safe mode, simply press F8 during boot-up, and run the programs I've listen.

When it comes to Hijack This, just click the following.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\windows\system32\bhuiy.dll/sp.html#21259
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\windows\system32\bhuiy.dll/sp.html#21259
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

That should clean up your system. It did for me. Look, I'm becoming a computer geek! Yay!

[telecom69]

Not always as simple as that Im afraid CarreMarie,Im thinking that maybe that one time you were lucky

[dvk01]

download aboutbuster from http://forums.subratam.org/index.php?showtopic=1072

and folow instructions on the last post of that thread

run it twice yahne post a new hjt log here please

[Shady K]

Well, I can't even use about:Buster, I open it up hit OK and I get an error message:
Run-time Error '339'
Component 'mscomctl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid.
Now What?