About: blank only on a specific link 1

[abwrebel]

I am encountering a problem with About: blank that is atypical of the variants I have seen before. The homepage, etc. is not being changed. I can browse the web anywhere I would like to go. For business however, I have to go to a special website to book vacations. I can get to the website fine, but on one of the links specifically from this website, you have to verify a certificate. This works fine. Then you choose the certificate and after this the about blank page comes up. It has the appearance of a pop up. The top bar is blue, it says about: blank and the popup is completely blank. The link never comes up. It stops with this about: blank popup.

I have run TrendMicro and AVG to get rid of the viruses. I have also run Microsoft Anti Spyware, AdAware, AdAware Away, & SpyBot. While these items have found many items and removed them, the problem persists.

Any help would be appreciated!


Here is the hijackthis log file:

Logfile of HijackThis v1.99.1
Scan saved at 4:24:46 PM, on 7/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Automatic Update\AutoUpdate.exe
C:\Amaprt\MainSrv.exe
C:\Amaprt\AmaPrt.exe
C:\Amaprt\AmaPrt.exe
C:\Amaprt\ComAdapt.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\nrpn\osoa.exe
C:\DOCUME~1\Laura\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.bellsouth.net/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\pbalrn.exe reg_run
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone:

http://*.amadeusproweb.com

O15 - Trusted Zone:

http://*.amadeusvista.com

O15 - Trusted Zone:

http://*.amadeus.com

(HKLM)
O15 - Trusted Zone:

http://webconfig.amadeus.com

(HKLM)
O15 - Trusted Zone:

http://*.amadeuscruise.com

(HKLM)
O15 - Trusted Zone:

http://*.amadeusproweb.com

(HKLM)
O15 - Trusted Zone:

http://*.amadeusvista.com

(HKLM)
O16 - DPF: {051FE707-9706-11D5-A836-000102A7C938} (Amadeus Automatic Update) -

http://amadeusvista.com/AutomaticUpdate/AutoUpdateATL.CAB

O16 - DPF: {266BB960-7DA8-11D4-A849-00008321B7D9} (Amadeus Cmd Page Cross Communication) -

http://amadeusvista.com/VWP/common/cabs/VistaPWComms.CAB

O16 - DPF: {3D518D7D-422F-4787-AC71-10BB552E897B} (Amadeus_SP2_Patcher Class) -

http://amadeusvista.com/VWP/common/cabs/SP2Patch.CAB

O16 - DPF: {665C05C1-517D-11D3-BE4A-00008322ED5D} (MSIInspect.Inspector) -

http://amadeusvista.com/VWP/common/cabs/MSIInspect.CAB

O16 - DPF: {EBE01DF7-D451-11D5-A842-000102A97CAB} (AmadeusInit.Init) -

http://amadeusvista.com/VWP/common/cabs/AmadeusInit.CAB

O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} -

http://download.winfixer.com/files/installers/cab/WinFixer2005ScannerInstall.cab

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Amadeus Automatic Update - Amadeus - C:\Program Files\Automatic Update\AutoUpdate.exe
O23 - Service: AmadeusProPrinter - Amadeus - C:\Amaprt\MainSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

 

[linney]

Have you tried the settings for IE's Pop-Up Blocker and making sure they are not interfering with this particular site?

IE/ Tools/ Pop-Up Blocker.

Who is Amadeus that is mentioned in the log?

 

[abwrebel]

Amadeus is the travel agent website where this is happening.

 

[abwrebel]

If a pop up blocker was interfering would this be one of the symptoms? I have turned off the pop up blocker is IE, but could there be another one? This symptom actually started after tech support installed some popup blockers on this computer. How do I find if other pop up blockers are there?

Thanks

 

[linney]

Lateral thinking, combined with fate, is suggesting you cancel that holiday.

Did the Pop-Up blocker have any result?

 

[abwrebel]

No still the same. I am searching for any other pop up blocker that may be causing the problem.

 

[linney]

Another common pop-up blocker is put in by installing the Google Toolbar. Firewalls do the same some times.

Just clarify that you are allowing access to this site pop-up via IE pop-up blocker and its settings and not turning it off, you may need it on for Amadeus.

Try cleaning out your Temporary Internet Files too.

 

[abwrebel]

I found a tool on the Univ of Georgia website that says I have no pop-up blocker enabled on the machine where the problem is taking place. Thanks for the idea, I really thought that was going to be the problem! Anything else?

Thanks

 

[Frank4d]

Google search says "C:\Program Files\nrpn\osoa.exe" is adware/censorware.

 

[linney]

Is there any support from Amadeus that you can tap into?

Internet Explorer Fix

http://www.mvps.org/sramesh2k/IEFIX.htm

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.


Try your your options in IE/ Tools/ Internet Options/ Advanced.


Try running temporarily with the third box "Enable Third Party Browser Extensions" unchecked and see how this goes.

"This specifies that you want to disable features you installed for use with Internet Explorer that may have been created by companies other than Microsoft.
If you encounter problems with Internet Explorer that you cannot resolve, you can use this option to help determine if third-party features are causing the problems without uninstalling the feature. You must restart Internet Explorer after turning this option on or off."


If that stops your errors, you will know where the trouble is.

This a specific "About Blank" remover you may like to look at.

http://www.majorgeeks.com/download4289.html

You Cannot Access Your MSN E-mail Account or Authenticate with a Web Site in Various Programs

http://support.microsoft.com/?kbid=813951

Troubleshoot Situations Where You Cannot Connect to Secure Web Sites by Using Internet Explorer in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;813444

This site also has some good thoughts on the issue:

http://www.mvps.org/inetexplorer/answers2.htm#secure_sites

You Receive a "Page Cannot Be Displayed" Error Message When You Post to a Site That Requires Authentication

http://support.microsoft.com/default.aspx?scid=kb;en-us;821814

 

[abwrebel]

Linney,

You did it!! After all the scan, checks, sweeps, reboots, etc what finally worked was Linney's suggestion to run ieFix found here:

http://www.mvps.org/sramesh2k/IEFIX.htm

(link is also in linney's post)

Finding the locations of the files on the XP disk and the Service Packs was a little cumbersome, but I just followed the instructions on the mvps site. While running it found some files that were already on my computer that were more recent than the one's that it wanted to install. I kept the ones that were on my computer. Other than that I just followed the instructions.

A big thanks to linney, as well as any others who took the time to research and reply in my time of need.

Thanks again linney!!!!

 

[abwrebel]

For more info about what other steps were taken prior to running ieFix, see the thread with the same title in the Virus/Spyware forum. pechenegs post in that thread was run prior to ieFix tool and I think this also helped in its final solution.