about:blank Fixed!

  • Thread starter Thread starter runner
  • Start date Start date
R

runner

Ron Kinner ([email protected]) just saved my bacon. I found contamination on
my computer by OldSpHome (about:blank) and Ebates_NoeMoneyMaker and couldn't
get rid of them. Even Beta 1 couldn't see them.
I noticed Ron helping someone else in this forum and wrote him asking for
advice. A great move!
Ron had me download WinsockXPfix.exe for safety, then AdAware SE Personal.
(I had that one already.) He had me add the VX2 Cleaner add-on to AdAware.
I ran HijackThis and found:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} -
C:\WINDOWS\dlmax.dll
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} -
file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file
missing) (HKCU)

I checked and removed them all.
Then I found dlmax.cab, dlmax.dll, and dlmax.inf all over the place on my C:
drive. Removed them too.
After that Ron clued me into a "timebomb" these guys sometimes put on your
computer in strange places. That was "farmmext". I found two of those and
removed them.

After all this, I think I'm clean.
Kudos to Ron and many thanks for his help.
Someday this won't be necessary, but for now it is great to have guys like
Ron who can help.
 
AND,

You just made Ron's correct email address available to all spammers.

Ron, looks like you will have to kill that address!

JohnF.
 
What about the bandwidth and processor time sacrificed to 1,000 junk
messages a day?

JohnF.
 
Hi Pete:

Pete wrote "Someday this won't be necessary."
And "...but for now it is great to have guys like Ron who
can help."

(About Ron K, yes, the guy is great! And a wiz with
HiJackThis logs plus lots of other stuff, see his posts!)

This is the point some of the more knowledgeable folks
have tried to make here.

We'd all love for MSAS to be perfect and take care of all
spyware, adware, malware, trojans, etc. And maybe
someday it will be. But in the meantime it isn't. But
we all appreciate the expert help to fix these problems
now. And some of us have had the chance to become a bit
wiser due to help and guidance from to Bill S, Steve D,
Ron C, Ron K, Andre, Randy K and Plun. And others as
well. Tks All.

RobbieA
 
i just change their address and tell them to stop posting it all over the
internet.

JohnF.
 
No he didn't. I've been posting it myself for several
months. I haven't noticed any increase in SPAM so I
assume most of it is getting caught by AT&T Worldnet's
SPAM filter. This address is so old it almost predates
SPAM.

Ron
 
Ron,

I just noticed that while looking over some of your other posts.

Good luck with that!

JohnF.
 
Back
Top