About:Blank frustration 3

[bjdobs]

XP Pro sp2

Is there a new variation of the VSB About Blank virus?

Does anyone have any ideas?

This one infected a machine in mid October ... It got by Norton NIS 4 ... it won't allow connections to microsoft, or any antivirus site ... it appears to hyjack any address and goes to a proxy to determine what it will allow the user to access ... I have run both the Symantec and macaffe scans by copying their scan files to cd with no luck.

I used an XP Sp2 disk to load Sp2 hoping it would get rid of this but that didn't work.

I tried to do a restoral from September no luck

Note can't even get around it in Safe mode

 

[SuaveRick]

I'd run hijack this, then go to config, then misc tools and then open host files manager. Take out everything except the localhost entry and try getting to some sites that were once blocked, see if that helps.

Hijack this is how I got rid of an about:blank problem

 

[zoeythecat]

I have found this link to be very valuable. This has helped me resolve several spyware/virus issues.

http://forums.majorgeeks.com/showthread.php?t=35407

 

[SuaveRick]

Great link zoey!

 

[burnside]

pretty sure MS antispy does it- saved me from sbout:blank when nothing else did

 

[iamnotageek]

A word to the wise...

In order to prevent immediate reinfection you have to remove the trojan that is downloading and/or reinstalling it, before you reboot the machine into protected mode (I always remove this crap while in safe mode). It has been my experience that this is one area where the scanners fall short.

It often proves to be a hidden/system dll or exe file. These are usually found in the user's Docs & Settings subfolders (mainly under application data & temp), in /system32, in c:\temp or c:\temporary, in \temporary internet files, or in /windows/temp. Sometimes they are in the root of \program files or \common files. I have also found them in the root directory (c:\).

Other places they hide are in their own little subfolders under \windows or \system32.

 

[jimbopalmer]

I had good luck by booting into safe mode and deleting c:\windows\system\jlob.dll and making a folder with the same name and deleting c:\windows\temp\se.dll and making a folder with the same name.

Windows cannot replace a folder with a file.

I tried to remain child-like, all I acheived was childish.