about:blank

cum se poate scapa de porcaria asta about:blank Trusted Search Site? am incecat cu tot ce am avut, de la ad-aware la HiJackThis.....fara rezultat.
poate sa-mi dea cineva o solutie?

Poate asta te ajuta.

Am avut si eu ceva asemanator si de aceea am trecut de la IE la Opera si apoi la Firefox. Am reusit pana la urma sa o scot cu Ad-aware SE Personal, nu cu versiunile 6.x sau mai vechi.

nu merge cu ad-aware...nici personal, nici profesional...cu nici o versiune...

about:blank este un semn pentru diverse malware. Ca sa stim cu cine avem de a face:

Download HijackThis! 1.99.1 de aici

Extrage hijackthis.exe intr-un folder al lui, de exemplu c:\hjt, executa HijackThis.exe, apasa SCAN si apoi SAVE LOG. Posteaza log-ul aici.

Nu fixa nimic cu HJT, cele mai multe intrari de acolo sunt legitime !

Sau incearca cu AboutBuster http://www.besttechi...?showtopic=1488

Quote

Se foloseste numai pentru CWS_NS3 si nu inlatura in totalitate infectia. Daca esti infectat cu CWS_NS3 si folosesti doar about:Buster iti poti inrautati situatia.

Edited by Daisuke, 22 March 2005 - 11:28.

Logfile of HiJackThis v1.99.1
Scan saved at 8:33:19 AM, on 3/23/2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Zapp Turbo\Client\ventc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\Program Files\Zapp Turbo\Configurator\ventcfg.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
F:\HijackThis.exe
D:\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [Venturi Configurator] C:\Program Files\Zapp Turbo\Configurator\ventcfg.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - (no file)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: Venturi2 Client (Venturi2) - Venturi Wireless - C:\Program Files\Zapp Turbo\Client\ventc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

cam asta ar fi....

Dezinstaleaza daca gasesti in Add/Remove Programs si daca nu ai facut-o deja:
Security iGuard - program dubios, pe lista neagra http://www.spywarewa...nti-spyware.htm


Executa HiJackThis si bifeaza cele de mai jos:

O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe

O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - (no file)

Foarte important: Inchide toate celelalte ferestre si browsere, in afara de HijackThis, si apasa Fix Checked.


Iti mai apare about:blank ? In log nu e vizibil, dar putem patrunde mai adanc cu investigatiile.

am facut ce-ai spus tu, insa tot nu am scapat de problema mea....ca sa fiu mai elocvent, am atasat un printscreen

Sa le luam pe rand. Mai intai sa cautam un virus.

Download acest tool de la Kaspersky http://www.kaspersky...=154293695#open

si  salveaza-l pe desktop. Extrage continutul intr-un folder, de exemplu c:\av  si executa KLWK.COM. Spune-mi daca gaseste ceva.

Scan online aici: http://www3.ca.com/s...sinfo/scan.aspx , a gasit ceva ?

okeiu instaleaza SpySweeper si Pest Patrol5 fale update si scaneaza daca SpySweeper nu il scoate(ceea ce maindoiesc) Pest Patrol o va face  

am scanat cu karsperky si nu a gasit nimic suspect. am atasat din nou un printscreen cu ce-a gasit scanarea online...interesanta modalitatea de scanare...totusi, se pare ca nu am scapat de problemea mea initiala o sa vad dupa un reboot

Noteaza ce a gasit si delete in SafeMode. REBOOT si spune-mi daca cercetam mai departe.

"14 viruses were detected"   incerci sa bati vreun record ?

cercetam cercetam....am sters tot si about:blank tot nu l-am rezolvat, fir-ar sa fie

BeDe: daca incerci sa faci vreo gluma, sa stii ca nu-ti prea iese

Sa cautam un DLL care este loaded de svchost.

Download :  Getservices.zip

Extrage continutul pe c:\ . Mergi la c:\getservices  si click pe getservices.bat. Se va deschide Notepad cu un log. Posteaza-l aici.

Citam din imaginea atasata de tine la scanarea online in care aparea "14 viruses were detected". Nu era vorba de nici o gluma. Ma miram doar cum de iti mai merge windows-ul. Nu ai nici un antivirus instalat pemanent ?