Can't remove "about:blank" homepage. Please help.

Question

head_hunter 0 Newbie Poster

20 Years Ago

Hey all,
starting today I started getting this problem where I can't change my internet explorer
homepage from about_:blank to anything else. I usually use hotmail as my default page,
but now every time I change it it goes right back to about_:blank.

I've done the following to try and get rid of this problem (in order and multiple
times).

1. Updated my Windows XP
2. Ran CWShredder (updated version)
3. Rebooted my computer
4. Ran CWShredder (updated version)
5. Cleared my temporary internet files, cookies and offline files.
6. Searched and deleted all my *.tmp files
7. Emptied my C:\WINDOWS\Temp folder
8. Emptied my C:\Temp folder
9. Emptied my recycle bin
10. Ran SpyBot (updated version)
11. Ran Ad-Aware (updated version)
12. Ran Panda Antivirus (updated version)
13. Ran AVG Anitvirus (free updated version)

After this I still got the same problem that came up. Some of these programs found
some viruses and other things that I deleted and/or removed. But I still find myself
with the same problem at hand. I then decided to run "Hijack This" (offline) and
this is what it gave me:Logfile of HijackThis v1.97.7
Scan saved at 5:25:35 PM, on 08/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Documents and Settings\Emil\My Documents\Emil\Download\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about_:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FB9BA0F2-3A75-4666-A4A8-FF3E7D6EB5C4} - C:\WINDOWS\System32\ngeo.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: GraphicalChat Application -
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...7667.5103240741
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) -

I did this several times, that's my latest Hijack This offline log. I fixed it once while fixing some Hijack This stuff and it worked, but the problem came back a few hours later. Then I did everything AGAIN and it got fixed again, this time with system restore off, and it worked again. Evern the next morning it was fine, but now I come home from school and the problem's back again. There you go. I'm really getting mad at this problem. It's really bugging me. Any help would be greatly apreciated. Thanks again...

windows-virus

16 Contributors
63 Replies
1K Views
2 Months Discussion Span
Latest Post 20 Years Ago Latest Post by crunchie

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Tekmaven 258 Software Architect Team Colleague · Answer 1 · 2004-04-09T06:51:26+00:00

Dump these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about_:blank
O2 - BHO: (no name) - {FB9BA0F2-3A75-4666-A4A8-FF3E7D6EB5C4} - C:\WINDOWS\System32\ngeo.dll

I'm not sure what this is:
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent

If anything, do a start -> run -> msconfig -> on the startup tab uncheck steam. This way, if you need re-enable "steam" you can just go back there and recheck it ;-).

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2004-04-09T10:33:17+00:00

crunchie 990 Most Valuable Poster

20 Years Ago

Steam is used for Half-Life.

MAD_DOG 35 Practically a Master Poster · Answer 3 · 2004-04-09T11:17:15+00:00

Dude haha about:blank is the best home page you can have I say leave it but, hey what do I know.

Tekmaven 258 Software Architect Team Colleague · Answer 4 · 2004-04-09T11:48:27+00:00

Dude haha about:blank is the best home page you can have I say leave it but, hey what do I know.

I second that!

MAD_DOG 35 Practically a Master Poster · Answer 5 · 2004-04-10T06:21:33+00:00

haha I agree 100%.
Vote is approved end of topic sorry haha just kidding. Yeah man I don't know why people like Home Pages in some cases yeah but, for a hardcore guru about:blank is the best thing that came to IE and/or www.bink.nu as your home page haha oops did I say that. ha

head_hunter 0 Newbie Poster · Answer 6 · 2004-04-12T21:03:36+00:00

Even though about:blank could be a good homepage I still don't like knowing that there's a virus on my machine. I got rid of it numerous times with different procedures, but it seems to always come back 1 or 2 days later... Any suggestions?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 7 · 2004-04-12T21:23:32+00:00

First update CWShredder as I am pretty sure it has a fix for this. As well, do this. Reboot into safe mode following the instructions here. http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406 & Close all (browser) windows & have HJT fix these entries=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ngeo.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about_:blank

O2 - BHO: (no name) - {FB9BA0F2-3A75-4666-A4A8-FF3E7D6EB5C4} - C:\WINDOWS\System32\ngeo.dll

In spybot settings have it check for available Beta versions & download 1.3.6 & update it online & run it immediately after doing the above. Update Adaware & run that also. It has had 3 updates in the last 2 days.
Obviously do these updates first, then do everything in safe mode.

head_hunter 0 Newbie Poster · Answer 8 · 2004-04-12T21:57:13+00:00

I did what you told me, it worked and hopefully the problem won't come back this time. Thanks again.

head_hunter 0 Newbie Poster · Answer 9 · 2004-04-17T14:01:13+00:00

head_hunter 0 Newbie Poster

20 Years Ago

It came back... :(

MAD_DOG 35 Practically a Master Poster · Answer 10 · 2004-04-17T14:44:41+00:00

It's time for this.

http://download.com.com/3000-8022-10214379.html?tag=pop - Adaware

http://download.com.com/3000-8022-10194058.html?tag=pop - Spybot

If this doesn't work read my article on: http://www.daniweb.com/techtalkforums/thread5167.html

If that doesn't work stop giving your self a headache and seriously do a reformat and watch out for what web pages you go to seriously.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 11 · 2004-04-17T18:01:17+00:00

It came back... :(

There is no need to reformat because of spyware that CAN be removed. There is a fix for that now if you still need help.

MAD_DOG 35 Practically a Master Poster · Answer 12 · 2004-04-17T20:36:07+00:00

MAD_DOG 35 Practically a Master Poster

20 Years Ago

You can only say that sometimes

zenfulcreations 1 Retired DAM & Technical Architect · Answer 13 · 2004-04-17T21:22:53+00:00

I 100% agree with Crunchie!

DO NOT REFORMAT YOUR COMPUTER!

First if it keeps coming back, it is probably in System Restore so do the following:

Delete temp, temp internet files and history.

Turn off system Restore.

Rerun Hijack This and remove any of the entries that you see already mentioned above.

REPAIR IE:

Click start, cursor up to settings, then click control panel.
Next, click add/remove programs.
Scroll down to "Microsoft Internet Explorer& Tools..".
Highlight it, then click add/remove.
(((Have no fear, this will NOT remove your browser! )))
A box pops up, with the option to repair.
Select it, and allow it to run it's course.

Reboot.

When finished, Turn system Restore back on.

MAD_DOG 35 Practically a Master Poster · Answer 14 · 2004-04-17T22:47:48+00:00

Sorry I am going for a quick fix that will work no matter what. He can keep fixing it but, he seems to have so much it will just keep coming back and will keep giving him a headache.

Take there advice man but, your probably going down my road in a matter of time. See you on the road :)

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 15 · 2004-04-17T23:31:12+00:00

Sorry I am going for a quick fix that will work no matter what. He can keep fixing it but, he seems to have so much it will just keep coming back and will keep giving him a headache.
Take there advice man but, your probably going down my road in a matter of time. See you on the road :)

The thing is, he has ONE entry that is causing him grief & you want him to reformat! He may have more than one entry in his log, but it is only one in the registry creating them.
Sure, everyone reformats every now & then, but for one entry? Come on. :rolleyes:

zenfulcreations 1 Retired DAM & Technical Architect · Answer 16 · 2004-04-17T23:53:31+00:00

I don't reformat ever. But that is because I have never had the need to for any system I have worked on.

I know that there are occasions that it will have to be done - but it is the absolute LAST option.

Also, you say it keeps coming back, but until I said it, nobody told him to turn off system restore --- usually the reason things come back (in cases such as this) - That is unless there is an unexterminated virus, to which he has already looked into by doing his scans.

As I see it, he has only begun to troubleshoot the problems, and is miles away from the reformat stage.

Only my techie 2cents.

riomojo 0 Newbie Poster · Answer 17 · 2004-04-20T20:23:47+00:00

Try going here. http://www.hijackfix.rheoit.com it helped me!

oalee 53 cyberkill(ed) Team Colleague · Answer 18 · 2004-04-20T21:57:59+00:00

I don't reformat ever. But that is because I have never had the need to for any system I have worked on.
I know that there are occasions that it will have to be done - but it is the absolute LAST option.
Also, you say it keeps coming back, but until I said it, nobody told him to turn off system restore --- usually the reason things come back (in cases such as this) - That is unless there is an unexterminated virus, to which he has already looked into by doing his scans.
As I see it, he has only begun to troubleshoot the problems, and is miles away from the reformat stage.
Only my techie 2cents.

I 500% agree with this... a reformat is always the very last resort...

MAD_DOG 35 Practically a Master Poster · Answer 19 · 2004-04-21T04:05:10+00:00

Hey my fix works I know this. Like I said I will see you down my road in a matter of time and I agree with everybody else I am just giving you "My Two Cents" good luck.

head_hunter 0 Newbie Poster · Answer 20 · 2004-04-22T04:08:18+00:00

I'm starting to agree with MAD_DOG, because I think I've tried over 20 different fixes each multiple times and ways and maybe 90% of them actually do get rid of the problem, but it ALWAYS comes back sooned or later, even if I don't go on any bad sites or downloads. This is with and without system restore on, either way it comes back. I've used CWShredder, SpyBot, Ad-Aware, Panda Antivirus, AVG Antivirus, KillBox, Hijack This, Spyware Blaster and other programs and up to now none have done the job, I also went into my computer and deleted/repared a hell lot of files and the problem still comes back. Does anyone have a fix for this or will I have to result to the reformat? Thanks again...

caperjack 875 I hate 20 Questions Team Colleague · Answer 21 · 2004-04-22T04:52:40+00:00

if you got rid of the malware problems and they returned ,when you format and continue using IE and the internet you will get infected again and again ,so no real advantage to formating .I haven't formated my computer in about 10 mnts .I use xp firewall and spywareblaster and spywareguard and Norton antivirus ,ad-aware,spybot ,3 users all admins ,downloading from P2P ,haven't had spyware problem since i install a free screensave program !

caperjack 875 I hate 20 Questions Team Colleague · Answer 22 · 2004-04-22T05:03:46+00:00

I been doing some reading in the SWI fourm Bootcamp and you appear to have the latest CWS ,and it need to be handled in a different manner please bear with me as its new to me ,but i will try my best and get help from the experts at SWI for you ,so do the following ,first step of 5 steps .")

Download this zip.

http://http://tools.zerosrealm.com/downloads/pv.zip
Please unzip it to the desktop. It will not work if you run it from inside the zip.

After unzipped go to the desktop. Open the pv folder. Double click on the runme.bat

A dos window will open. Please select option 1 for explorer dll's by typing 1 and then pressing enter.

Notepad will open with a log in it. Please copy and paste the log into this post.

MAD_DOG 35 Practically a Master Poster · Answer 23 · 2004-04-22T07:17:33+00:00

Speaking of the devil. You know you want to come on reformat come on do it come on it will make things all better I promise. Go down my road it will make you feel really good. haha

Yzk 70 Posting Whiz · Answer 24 · 2004-04-22T18:37:00+00:00

So does the virus really caused the about:blank? I thought that you could just change the homepage in extra-->internet-options

MAD_DOG 35 Practically a Master Poster · Answer 25 · 2004-04-22T19:02:21+00:00

I don't even know any more man going to sit back and watch seriously.

head_hunter 0 Newbie Poster · Answer 26 · 2004-04-23T02:15:21+00:00

CaperJack, I've already done that fix several times with the pv.zip and the log file, but I'll try it again, maybe you have a step that I've missed. Here is my log:

Module information for 'Explorer.EXE'
MODULE BASE SIZE PATH
Explorer.EXE 1000000 1015808 C:\WINDOWS\Explorer.EXE 6.00.2800.1106 (xpsp1.020828-1920) Windows Explorer
ntdll.dll 77f50000 684032 C:\WINDOWS\System32\ntdll.dll 5.1.2600.1217 (xpsp2.030429-2131) NT Layer DLL
kernel32.dll 77e60000 942080 C:\WINDOWS\system32\kernel32.dll 5.1.2600.1106 (xpsp1.020828-1920) Windows NT BASE API Client DLL
msvcrt.dll 77c10000 339968 C:\WINDOWS\system32\msvcrt.dll 7.0.2600.1106 (xpsp1.020828-1920) Windows NT CRT DLL
ADVAPI32.dll 77dd0000 577536 C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) Advanced Windows 32 Base API
RPCRT4.dll 78000000 552960 C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.1361 (xpsp2.040109-1800) Remote Procedure Call Runtime
GDI32.dll 7e090000 266240 C:\WINDOWS\system32\GDI32.dll 5.1.2600.1346 (xpsp2.040109-1800) GDI Client DLL
USER32.dll 77d40000 573440 C:\WINDOWS\system32\USER32.dll 5.1.2600.1255 (xpsp2.030804-1745) Windows XP USER API Client DLL
SHLWAPI.dll 70a70000 413696 C:\WINDOWS\system32\SHLWAPI.dll 6.00.2800.1400 Shell Light-weight Utility Library
SHELL32.dll 773d0000 8331264 C:\WINDOWS\system32\SHELL32.dll 6.00.2800.1233 (xpsp2.030604-1804) Windows Shell Common Dll
ole32.dll 771b0000 1196032 C:\WINDOWS\system32\ole32.dll 5.1.2600.1362 (xpsp2.040109-1800) Microsoft OLE for Windows
OLEAUT32.dll 77120000 569344 C:\WINDOWS\system32\OLEAUT32.dll 3.50.5016.0 Microsoft OLE 3.50 for Windows NT(TM) and Windows 95(TM) Operating Systems
BROWSEUI.dll 71500000 1036288 C:\WINDOWS\System32\BROWSEUI.dll 6.00.2800.1400 Shell Browser UI Library
SHDOCVW.dll 71700000 1347584 C:\WINDOWS\System32\SHDOCVW.dll 6.00.2800.1400 Shell Doc Object and Control Library
UxTheme.dll 5ad70000 212992 C:\WINDOWS\System32\UxTheme.dll 6.00.2800.1106 (xpsp1.020828-1920) Microsoft UxTheme Library
comctl32.dll 71950000 933888 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll 6.0 (xpsp1.020828-1920) User Experience Controls Library
comctl32.dll 77340000 569344 C:\WINDOWS\system32\comctl32.dll 5.82 (xpsp1.020828-1920) Common Controls Library
appHelp.dll 75f40000 126976 C:\WINDOWS\system32\appHelp.dll 5.1.2600.1106 (xpsp1.020828-1920) Application Compatibility Client Library
CLBCATQ.DLL 7c890000 528384 C:\WINDOWS\System32\CLBCATQ.DLL 2001.12.4414.53
COMRes.dll 77050000 806912 C:\WINDOWS\System32\COMRes.dll 2001.12.4414.42
VERSION.dll 77c00000 28672 C:\WINDOWS\system32\VERSION.dll 5.1.2600.0 (xpclient.010817-1148) Version Checking and File Installation Libraries
cscui.dll 76620000 319488 C:\WINDOWS\System32\cscui.dll 5.1.2600.1106 (xpsp1.020828-1920) Client Side Caching UI
CSCDLL.dll 76600000 110592 C:\WINDOWS\System32\CSCDLL.dll 5.1.2600.0 (xpclient.010817-1148) Offline Network Agent
themeui.dll 559e0000 462848 C:\WINDOWS\System32\themeui.dll 6.00.2800.1106 (xpsp1.020828-1920) Windows Theme API
Secur32.dll 76f90000 65536 C:\WINDOWS\System32\Secur32.dll 5.1.2600.1106 (xpsp1.020828-1920) Security Support Provider Interface
MSIMG32.dll 76380000 20480 C:\WINDOWS\System32\MSIMG32.dll 5.1.2600.1106 (xpsp1.020828-1920) GDIEXT Client DLL
USERENV.dll 75a70000 675840 C:\WINDOWS\system32\USERENV.dll 5.1.2600.1106 (xpsp1.020828-1920) Userenv
actxprxy.dll 71d40000 110592 C:\WINDOWS\System32\actxprxy.dll 6.00.2600.0000 (XPClient.010817-1148) ActiveX Interface Marshaling Library
msutb.dll 5fc10000 196608 C:\WINDOWS\System32\msutb.dll 5.1.2600.1106 (xpsp1.020828-1920) MSUTB Server DLL
MSCTF.dll 74720000 278528 C:\WINDOWS\System32\MSCTF.dll 5.1.2600.1106 (xpsp1.020828-1920) MSCTF Server DLL
netapi32.dll 71c20000 319488 C:\WINDOWS\System32\netapi32.dll 5.1.2600.1343 (xpsp2.040109-1800) Net Win32 API DLL
msi.dll 1300000 2101248 C:\WINDOWS\System32\msi.dll 2.0.2600.1106 Windows Installer
urlmon.dll 1a400000 499712 C:\WINDOWS\system32\urlmon.dll 6.00.2800.1400 OLE32 Extensions for Win32
LINKINFO.dll 76980000 28672 C:\WINDOWS\System32\LINKINFO.dll 5.1.2600.0 (xpclient.010817-1148) Windows Volume Tracking
ntshrui.dll 76990000 147456 C:\WINDOWS\System32\ntshrui.dll 5.1.2600.1106 (xpsp1.020828-1920) Shell extensions for sharing
ATL.DLL 76b20000 86016 C:\WINDOWS\System32\ATL.DLL 3.00.9435 ATL Module for Windows NT (Unicode)
WINTRUST.dll 76c30000 176128 C:\WINDOWS\System32\WINTRUST.dll 5.131.2600.0 (xpclient.010817-1148) Microsoft Trust Verification APIs
CRYPT32.dll 762c0000 557056 C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.1123 (xpsp2.020921-0842) Crypto API32
MSASN1.dll 762a0000 65536 C:\WINDOWS\system32\MSASN1.dll 5.1.2600.1362 (xpsp2.040109-1800) ASN.1 Runtime APIs
IMAGEHLP.dll 76c90000 139264 C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.1106 (xpsp1.020828-1920) Windows NT Image Helper
rsaenh.dll ffd0000 143360 C:\WINDOWS\System32\rsaenh.dll 5.1.2600.1029 (xpsp1.020426-1800) Microsoft Base Cryptographic Provider
mslbui.dll 605d0000 32768 C:\WINDOWS\System32\mslbui.dll 5.1.2600.1106 (xpsp1.020828-1920) LangageBar Add In
idlemon.dll 1c000000 36864 C:\Program Files\AIM95\idlemon.dll 4.7.2517 Idle Monitor DLL
WINSTA.dll 76360000 61440 C:\WINDOWS\System32\WINSTA.dll 5.1.2600.1106 (xpsp1.020828-1920) Winstation Library
webcheck.dll 74b30000 266240 C:\WINDOWS\System32\webcheck.dll 6.00.2800.1106 (xpsp1.020828-1920) Web Site Monitor
stobject.dll 74b00000 131072 C:\WINDOWS\System32\stobject.dll 5.1.2600.1106 (xpsp1.020828-1920) Systray shell service object
BatMeter.dll 74af0000 36864 C:\WINDOWS\System32\BatMeter.dll 6.00.2600.0000 (xpclient.010817-1148) Battery Meter Helper DLL
POWRPROF.dll 74ad0000 28672 C:\WINDOWS\System32\POWRPROF.dll 6.00.2600.0000 (xpclient.010817-1148) Power Profile Helper DLL
SETUPAPI.dll 76670000 946176 C:\WINDOWS\System32\SETUPAPI.dll 5.1.2600.1106 (xpsp1.020828-1920) Windows Setup API
WTSAPI32.dll 76f50000 32768 C:\WINDOWS\System32\WTSAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) Windows Terminal Server SDK APIs
NETSHELL.dll 75cf0000 1642496 C:\WINDOWS\system32\NETSHELL.dll 5.1.2600.1106 (xpsp1.020828-1920) Network Connections Shell
credui.dll 76c00000 184320 C:\WINDOWS\system32\credui.dll 5.1.2600.1106 (xpsp1.020828-1920) Credential Manager User Interface
WS2_32.dll 71ab0000 86016 C:\WINDOWS\system32\WS2_32.dll 5.1.2600.0 (xpclient.010817-1148) Windows Socket 2.0 32-Bit DLL
WS2HELP.dll 71aa0000 32768 C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.0 (xpclient.010817-1148) Windows Socket 2.0 Helper for Windows NT
iphlpapi.dll 76d60000 94208 C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.2 (xpsp1.020828-1920) IP Helper API
WININET.dll 63000000 614400 C:\WINDOWS\system32\WININET.dll 6.00.2800.1405 Internet Extensions for Win32
RASDLG.dll 75550000 647168 C:\WINDOWS\System32\RASDLG.dll 5.1.2600.1106 (xpsp1.020828-1920) Remote Access Common Dialog API
MPRAPI.dll 76d40000 90112 C:\WINDOWS\System32\MPRAPI.dll 5.1.2600.0 (xpclient.010817-1148) Windows NT MP Router Administration DLL
ACTIVEDS.dll 76e40000 192512 C:\WINDOWS\System32\ACTIVEDS.dll 5.1.2600.0 (xpclient.010817-1148) ADs Router Layer DLL
adsldpc.dll 76e10000 151552 C:\WINDOWS\System32\adsldpc.dll 5.1.2600.1106 (xpsp1.020828-1920) ADs LDAP Provider C DLL
WLDAP32.dll 76f60000 180224 C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.1106 (xpsp1.020828-1920) Win32 LDAP API DLL
rtutils.dll 76e80000 53248 C:\WINDOWS\System32\rtutils.dll 5.1.2600.0 (xpclient.010817-1148) Routing Utilities
SAMLIB.dll 71bf0000 69632 C:\WINDOWS\System32\SAMLIB.dll 5.1.2600.1106 (xpsp1.020828-1920) SAM Library DLL
RASAPI32.dll 76ee0000 225280 C:\WINDOWS\System32\RASAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) Remote Access API
rasman.dll 76e90000 69632 C:\WINDOWS\System32\rasman.dll 5.1.2600.1106 (xpsp1.020828-1920) Remote Access Connection Manager
TAPI32.dll 76eb0000 176128 C:\WINDOWS\System32\TAPI32.dll 5.1.2600.1106 (xpsp1.020828-1920) Microsoft Windows(TM) Telephony API Client DLL
WINMM.dll 76b40000 180224 C:\WINDOWS\System32\WINMM.dll 5.1.2600.1106 (xpsp1.020828-1920) MCI API DLL
shdoclc.dll 28d0000 557056 C:\WINDOWS\System32\shdoclc.dll 6.00.2715.400 Shell Doc Object and Control Library
printui.dll 74b80000 532480 C:\WINDOWS\System32\printui.dll 5.1.2600.1106 (xpsp1.020828-1920) Print UI DLL
WINSPOOL.DRV 73000000 143360 C:\WINDOWS\System32\WINSPOOL.DRV 5.1.2600.1106 (xpsp1.020828-1920) Windows Spooler Driver
CFGMGR32.dll 74ae0000 28672 C:\WINDOWS\System32\CFGMGR32.dll 5.1.2600.0 (xpclient.010817-1148) Configuration Manager Forwarder DLL
MPR.dll 71b20000 69632 C:\WINDOWS\system32\MPR.dll 5.1.2600.0 (xpclient.010817-1148) Multiple Provider Router DLL
SXS.DLL 75e90000 684032 C:\WINDOWS\System32\SXS.DLL 5.1.2600.1106 (xpsp1.020828-1920) Fusion 2.5
drprov.dll 75f60000 24576 C:\WINDOWS\System32\drprov.dll 5.1.2600.0 (xpclient.010817-1148) Microsoft Terminal Server Network Provider
ntlanman.dll 71c10000 53248 C:\WINDOWS\System32\ntlanman.dll 5.1.2600.1106 (xpsp1.020828-1920) Microsoft Lan Manager
NETUI0.dll 71cd0000 90112 C:\WINDOWS\System32\NETUI0.dll 5.1.2600.0 (xpclient.010817-1148) NT LM UI Common Code - GUI Classes
NETUI1.dll 71c90000 245760 C:\WINDOWS\System32\NETUI1.dll 5.1.2600.0 (xpclient.010817-1148) NT LM UI Common Code - Networking classes
NETRAP.dll 71c80000 24576 C:\WINDOWS\System32\NETRAP.dll 5.1.2600.0 (xpclient.010817-1148) Net Remote Admin Protocol DLL
davclnt.dll 75f70000 36864 C:\WINDOWS\System32\davclnt.dll 5.1.2600.0 (xpclient.010817-1148) Web DAV Client DLL
browselc.dll 72430000 73728 C:\WINDOWS\System32\browselc.dll 6.00.2800.1106 (xpsp1.020828-1920) Shell Browser UI Library
AcroIEHelper.ocx 10000000 32768 C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx 1, 0, 0, 1 AcroIEHelper Module
dfcn.dll 2710000 53248 C:\WINDOWS\System32\dfcn.dll
asfsipc.dll 70eb0000 28672 C:\WINDOWS\System32\asfsipc.dll 1.1.00.3917 ASFSipc Object
MSISIP.DLL 605f0000 53248 C:\WINDOWS\System32\MSISIP.DLL 2.0.2600.0 MSI Signature SIP Provider
wshext.dll 74ea0000 65536 C:\WINDOWS\System32\wshext.dll 5.6.0.6626 Microsoft (r) Shell Extension for Windows Script Host
comdlg32.dll 763b0000 282624 C:\WINDOWS\system32\comdlg32.dll 6.00.2800.1106 (xpsp1.020828-1920) Common Dialogs DLL
MCPS.DLL 365a0000 86016 C:\PROGRA~1\MICROS~2\Office10\MCPS.DLL 10.0.2625 Media Catalog Proxy/Stub
MSVCP60.DLL 55900000 397312 C:\WINDOWS\System32\MSVCP60.DLL 6.00.8972.0 Microsoft (R) C++ Runtime Library

Hope this works. Thanks again for all the replies.

asw 0 Newbie Poster · Answer 27 · 2004-04-23T05:38:45+00:00

O.K. Easy Fix for anyone experiencing "About:Blank" homepage takeover.
Simply go to your system restore for your computer. I have a Compaq, so it was call Compaq system restore. Instead of doing a full blown "system recovery", instead do a "restore". Then select to do a partial restore, using your dated restore points. I selected a restore point of April 1st because I knew my About:Blank intrusion took place sometime during the month of April after that date. So my system restored its original settings as of April 1st, and presto, I went back into I.E., and my MSN homepage opened right up, and I have no more problem.

caperjack 875 I hate 20 Questions Team Colleague · Answer 28 · 2004-04-23T06:02:03+00:00

will get conformation on you log and post back when i get it .

head_hunter 0 Newbie Poster · Answer 29 · 2004-04-23T06:27:24+00:00

I tried that system restore where you restore to a date prior to when the problem started, but I can't select a date before the problem began because I can't go back to before April for some reason and there are only a few days I can select in April itself and they are all after when I started getting the problem. So I guess this fix won't work for me. Hopefully my PV log'll help... Thanks for the replies.