Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cant Resolve Ie V6 About:blank Home Page Change On Xp Sp 2


  • Please log in to reply
11 replies to this topic

#1 101warhorse

101warhorse

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:15 AM

Posted 30 May 2006 - 01:53 PM

A few days ago my laptop running home edition XP sp2, was infected with spyfalcon. I have always used avast, ad-aware, and spybot religiously but none of them detected it or cleaned it. So i followed the removal instructions here and they worked.

i have now lose my internet home page, which was yahoo.com. it is now set to about: blank. when i open tools-internet options and reset my home page i can type in the correct url for yahoo, it will accept it, i click ok but it doesnt "take."

so i purchased spycatcher 2006, and windows register repair pro, ran them. sc2006 says i am clean, wrr pro fixed 146 invalid paths. ad-aware and avast both say i am clean. all four of these programs i ran in safe mode and in "regular" desktop mode.

but i still cant resolve my home page issue. i can type anythin i want into the address window and IE will take me there, and my favorites will work, but its just getting my home page set back that i cant get!

Im sure this is fairly easy but i dont know what to do next. any help would be appreciated. thanks

BC AdBot (Login to Remove)

 


#2 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:15 AM

Posted 30 May 2006 - 02:28 PM

Hello 101warhorse and welcome to Bleeping Computer!
There is a tutorial here that should help you with the removal of this infection.
Hope this helps,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#3 101warhorse

101warhorse
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:15 AM

Posted 30 May 2006 - 04:56 PM

did this...my system is clean. it did not find any of the cw variants of any kind.

#4 JPHarvey

JPHarvey

  • Members
  • 508 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sydney, Australia
  • Local time:07:15 PM

Posted 30 May 2006 - 06:34 PM

Have you tried fixing it in the registry? Obviously wait for the professionals from Bleeping Computer (I would), but if you changed it in the registry it should stick....

To get there: go to Start>Run
Type "regedit" and press enter (no quotes)
In the registry editor, go to the following entries and change them to what you want your start page to be (and search page etc..):

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

and the entry under "Start Page" is your browser home.

Warning though: backup your registry before you make any changes. But like I said, I would have a look, but wait for the HJT and admin guys - ESPECIALY if you already have a HJT log submitted for analysis....

:thumbsup:
[CPU]Intel E6600 Core 2 Duo @ 3.19GHz
[MoBo]ASUS P5N32-SLI Premium (nForce590)
[RAM]4GB Corsair XMS2 DDR2-800 CL4 @ 710MHz
[GPU]XFX 8800 GTX 768MB [SLI] @ Stock
[PSU]CoolerMaster 1kW
[Audio]ASUS Xonar D2
[Case]Antec Nine Hundred
[OS]Windows Vista Ultimate 64
[LCD]SAMSUNG 226BW
[Other]WC'd CPU & SLI

#5 Elendil

Elendil

  • Members
  • 660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The US
  • Local time:04:15 AM

Posted 30 May 2006 - 08:28 PM

You're probably doing this, but just making sure because you said you only clicked Ok ; however, did you click Apply and then Ok?
Stanford '14
B.S. Candidate | Computer Science

#6 101warhorse

101warhorse
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:15 AM

Posted 30 May 2006 - 08:38 PM

I deleted IE v6 all together and reloaded it from scratch. When I rebooted i lost all my desktop icons. I rebooted into safe mode and ran another sweep of my laptop using ad-aware, spybot, spycatcher 2006, and avast. Everything came up clean.!? After i rebooted I got my desktop icons back!

But now whenever I run a search through start - search there is a long wait, and i get an error msg that says windows can not find (null) and i should recheck spelling and try again?!?!

I did another sweep of my laptop in normal mode, using all the above ad-aware, spybot,spycather 2006, and avast. It is clean accordding to all of these programs. I reinstalled a new copy of IE v6.
This still did not fix the about:blank.

Whenever I click on My documents, My comouter, or Windows Explorer, it takes forever to populate the file list. I have to be infected or my registry is hosed. ????

#7 JPHarvey

JPHarvey

  • Members
  • 508 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sydney, Australia
  • Local time:07:15 PM

Posted 30 May 2006 - 09:32 PM

Have you tried any of the online scanners (TrendMicro Housecall, PandaSoftware Active Scan etc..)? They are often good at finding malware the ones you have used wont find. And have you tried Microsofts Malicious Software removal tool - it will check all your windows files.....
[CPU]Intel E6600 Core 2 Duo @ 3.19GHz
[MoBo]ASUS P5N32-SLI Premium (nForce590)
[RAM]4GB Corsair XMS2 DDR2-800 CL4 @ 710MHz
[GPU]XFX 8800 GTX 768MB [SLI] @ Stock
[PSU]CoolerMaster 1kW
[Audio]ASUS Xonar D2
[Case]Antec Nine Hundred
[OS]Windows Vista Ultimate 64
[LCD]SAMSUNG 226BW
[Other]WC'd CPU & SLI

#8 101warhorse

101warhorse
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:15 AM

Posted 31 May 2006 - 12:32 AM

i have completed everything to prepare for a clean hijack this system scan. Housecall came up clean, panda came up clean. i have installed zone alerts basic level firewall. every time i reboot i loose my desktop icons. I have to reboot into safe mode, run all the spy, ad ware programs. I find nothing. but when i reboot after i run them i get my desktop icons back!?!

i have run sfc /scannow and compared my files to my original cd. my laptop pulled some files off my cd but it never said which ones.

WTF??????? :thumbsup: oh and i still am getting about:blank as my home page.

#9 101warhorse

101warhorse
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:15 AM

Posted 31 May 2006 - 01:18 AM

yes.....i clicked apply then clicked ok. Also just downloaded and ran ms malicicous software removal tool, and it came up completely clean!? No infected files.

#10 Elendil

Elendil

  • Members
  • 660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The US
  • Local time:04:15 AM

Posted 31 May 2006 - 10:46 AM

I think it's time for HiJackThis (HJT) to be implemented. Please read this tutorial on how to use HJT.
http://www.bleepingcomputer.com/tutorials/how-to-use-hijackthis/
Also, please DO NOT attempt fixing any of the items that appear after HJT's scan without a HJT Team member advising it and DO NOT alter your computer after your HJT log has been posted. A HJT Team member will get to your log ASAP, so just relax and enjoy life until it's time for the fixing to begin. :thumbsup:
Stanford '14
B.S. Candidate | Computer Science

#11 101warhorse

101warhorse
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:04:15 AM

Posted 01 June 2006 - 05:49 PM

yeh.....thanks. i sent in a hijack this log a day or two ago......

#12 Elendil

Elendil

  • Members
  • 660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The US
  • Local time:04:15 AM

Posted 01 June 2006 - 05:58 PM

Ok, now it's extremely important that you don't alter your computer in any way (installing things, deleting things, etc.) until an experienced HJT Team member replies to your topic with cleaning instructions.
Stanford '14
B.S. Candidate | Computer Science




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users