Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

aboutblank


  • Please log in to reply
13 replies to this topic

#1 clayt

clayt

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 04 February 2009 - 01:31 AM

every time I try to go on line this shows up. Is it a problem? I haven;t seen it any where else on BC.,but my H page takes forever to load.Are the two related? Any help or comments will be appreciated.

BC AdBot (Login to Remove)

 


#2 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,810 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:12:20 PM

Posted 04 February 2009 - 03:13 AM

Aboutblank is a home page hijacker, try running SUPERAntiSpyware.


Please download and scan with SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#3 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:04:20 PM

Posted 04 February 2009 - 10:28 AM

Moving to AII
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#4 clayt

clayt
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 07 February 2009 - 05:41 PM

OK I followed all the instructions in your post and about blank is still showing up every time I go to my home page. any advise about what to do now?Thanks for all your help so far. :thumbsup:

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,567 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:20 PM

Posted 07 February 2009 - 10:10 PM

Did SAS find and remove any Trojans or virus? We ask for logs so we can see what is found. That will help us determine the next steps,plus there is other useful info in a log.

Try the steps in our BC tutorial How To Remove About:blank

Then please run these:

Next run ATF:
Please download ATF Cleaner by Atribune & save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • If you use Opera browser click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".


Next run MBAM:
Please download Malwarebytes Anti-Malware (v1.32) and save it to your desktop.
alternate download link 1
alternate download link 2
If you have a previous version of MBAM, remove it via Add/Remove Programs and download a fresh copy.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 clayt

clayt
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 09 February 2009 - 03:07 AM

:flowers: when my home page loads it takes a long time and aboutblank appearce to be everyotherscreen call on the bottom of the wqindow as it try's to setup. It also interfiers in web [pages that are trying to load. As you can probably quese I'm not very sophisticated at this and so have a dificult time following orders. ex I sdidn't know you wanted me to copy and paste the swearch results until the :thumbsup: :trumpet: whole issue was over.

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,567 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:20 PM

Posted 09 February 2009 - 09:15 PM

Ok not a problem. Run the Malwarebytes program and post that log.

The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply


If you ran the SAS program that log is here
To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 clayt

clayt
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 19 February 2009 - 01:29 AM

Hi. How do I copy and paste from my desktop to here?

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,567 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:20 PM

Posted 19 February 2009 - 04:33 PM

If you mean copy/paste the log... Then just click on the log's text ,drag the mouse along till it is all highlighted. Right click in the highlighted text ,
Select copy. Now in the forum ,click Add Reply... Right click inthe text field and select paste...
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 clayt

clayt
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 25 February 2009 - 08:25 PM

Hi boopme. :thumbsup: I got taken away for awhile by a problem with my content advisor blocking a license I bought for my jv16 reg. cleaner. It is all fixed now and I still have about blank on my home page sign in. I hope you are still willing to work with me since I've run through all the programs you have given me and it is still there, I don't know where to go next. Thanks for all your help so far. Clayt :flowers:

#11 clayt

clayt
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 26 February 2009 - 08:32 PM

Hi boopme. I hope this is the way
Database version: 1749
Windows 5.1.2600 Service Pack 3

2/11/2009 1:33:04 PM
mbam-log-2009-02-11 (13-33-00).txt

Scan type: Quick Scan
Objects scanned: 62039
Time elapsed: 4 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7370f91f-6994-4595-9949-601fa2261c8d} (Adware.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7370f91f-6994-4595-9949-601fa2261c8d} (Adware.BHO) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)
to copy and paste to this reply. Here goes; Jeese! It looks like it might have worked. Hope you can make some sense out of it.

#12 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:04:20 PM

Posted 26 February 2009 - 08:44 PM

You did great with the copy and paste, but missed a check removing the bad "stuff"

Please rerun malwarebytes and be sure to do the following after the scan finishes ...

Click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#13 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:20 PM

Posted 23 October 2009 - 12:29 AM

Sorry to dredge up this old thread, but clayt PMed me about this issue cropping up again for him. I believe there are some misunderstandings involved here.

Aboutblank is a home page hijacker...

It can be, but it can also be what shows in your address bar when you have your home page set to a blank page. I really doubt you have an infection. For one thing, the aboutblank hijackings don't happen anymore--the coolwebsearch people that used to do that have moved on to more lucrative endeavors, namely hijacking your desktop in order to try to fool you into buying a rogue antivirus/spyware or utility.

Secondly, if you were hijacked with about blank, your homepage would be a rather strange search page and you wouldn't be able to change it back to what you want. Refer to the Removal Guide boopme linked you to:
How To Remove About:blank

When you open Internet Explorer your browser will be redirected to a page called about:Blank, sp.html, or about:NavigationFailure. If you attempt to change your home page to another site, it will not work and continue opening about:blank.


That description does not mention that the home page is a search page, but I know that that infection was a search hijacker as I'm very familiar with it from a few years back when it was very prevalent. You don't mention anything about a search page in your description here:

:thumbsup: when my home page loads it takes a long time and aboutblank appearce to be everyotherscreen call on the bottom of the wqindow as it try's to setup. It also interfiers in web [pages that are trying to load.

I also take it from this description that the problem is actually something causing slow browsing. I'm not sure exactly how it works, but when you load a webpage, I've seen about:blank on the page's title before it loads the destination address--so for a slow browser this should be normal. What's causing your slowness could be any number of things.

One, you've mentioned using a reg cleaner--if you've let it clean automatically, then it could be causing more problems than it's worth--and jv16 is the best as far as reg cleaners go, you just have to use it properly if you're going to use it at all. Secondly, MBAM found some mid-level adware--nothing too serious, but you don't need those toolbars foisted on you that use up your computer's resources.

So you may have picked up some toolbars again--or even something more serious--so what i suggest you do is click here and follow the instructioons for running SUPERAntiSpyware Free. Please post the log when finished.

Then click here and follow the instructions for running Malwarebytes Anti-Malware. Also be sure to post its log.

Finally, to be 100% sure it isn't an about blank infection that's risen from the dead, post a HijackThis log for me to look at. It will show right away if you're infected or not. Please don't fix anything with it or follow instructions from anyone except me or a member of the HJT Team or a moderator/Admin.

Click here and download HijackThis.exe--be sure to chose the Exe File. Save the file to your desktop. Now double-click on it and chose Do a system scan and save a log file. The scan will only take a few seconds--when the log opens in Notepad, copy and paste the entire contents into your next post. BTW, here's a tip on how to copy and paste the entire log; click anywhere in the log file and then press Ctrl and A at the same time. Then Ctrl and C will copy the entire log to the clipboard.

We always did feel the same

We just started from a different point of view

Tangled up in blue--Bob Dylan


#14 chrisatbluescreen

chrisatbluescreen

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southern California
  • Local time:03:20 PM

Posted 23 October 2009 - 12:34 AM

bad taste. reply deleted.

Edited by chrisatbluescreen, 23 October 2009 - 12:48 AM.

"What I cannot create, I do not understand"
Richard Feynman
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users