About Blank And Low Memory

Click here to download FindnFix.exe (2K/XP only!) by freeatlast. Double-click on the FINDnFIX.exe and it will install a folder called FINDnFIX on your system. Go to that folder and double-click on !LOG!.bat. The program takes a few minutes to collect the necessary information. When done post the contents of Log.txt in this thread.

In the keys1 folder, double click on FIX.bat. You will get an alert of about 15 seconds before reboot - allow it to reboot. On restart, open Explorer and navigate to C:\Windows\System32 folder, find the LOGJB.DLL file (it should be visible now). Highlight the file and using top menu, click Edit>Move to folder…

Select C:\Findnfix\junkxxx as destination. Move the file.

Open the FINDnFIX folder again and double-click on RESTORE.bat. When it is finished, in FINDnFIX folder, there will be a file called Log2.txt - post it's contents in your next reply.

Thank you so much. I followed your instructions and my computer operting power seems to be performing normally. While findfix was working, Norton detected the backdoor agent virus. It deleted the virus thanks to you. Here is my is my log from log2. »»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»» Thu 29 Jul 04 16:07:30 4:07pm up 0 days, 0:06 Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q330994-Q824145-Q832894-Q837009-Q831167-Q823353 The type of the file system is NTFS. C: is not dirty. »»»»»»»»»»»»»»»»»»***LOG2!(*updated 7/28)***»»»»»»»»»»»»»»»» This log will confirm if the file was successfully moved, and/or the right file was selected… Scanning for file(s) in System32… »»»»»»» (1) »»»»»»» »»»»»»» (2) »»»»»»» »»»»»»» (3) »»»»»»» No matches found. Unknown/hidden files… No matches found. »»»»»»» (4) »»»»»»» Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»»»(5)»»»»» »»»»»(6)»»»»» »»»»»»» Search by size… No matches found. No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. »»»*»»» Scanning for moved file… »»»*»»» No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.* File not found - C:\FINDnFIX\junkxxx\*.* CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock. MD5 Message Digest Algorithm by RSA Data Security, Inc. File name Size Date Time MD5 Hash ________________________________________________________________________ CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk C:\FINDNFIX\JUNKXXX No files found ####################################################### *Known files are… ——————– File: ((56k; (57,344 bytes) (CRC16 : 3138) CRC-32 : D5C9FB2E MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249 ——————– File: ((35k; (35,840 bytes) (CRC16 : EEB1) CRC-32 : 33081C8B MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE ——————– File: ((21k; (21,504 bytes) (CRC16 : 90A5) CRC-32 : 2258F59E MD5 : EFEE2CB3 B342A351 51802356 9637F8E6 ####################################################### »»Permissions: ERROR: There are no more files. Directory "C:\FINDnFIX\junkxxx\." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000003 tco- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000002 tc– 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000009 –o- 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 00000002 tc– 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000009 –o- 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 0000001B -co- 10000000 —A —- —- BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x DJQTQ141\Gresham Lang Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Allow 0000001B -co- A0000000 R-X- —- —- BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: DJQTQ141\Gresham Lang Primary Group: DJQTQ141\None Directory "C:\FINDnFIX\junkxxx\.." Permissions: Type Flags Inh. Mask Gen. Std. File Group or User ======= ======== ==== ======== ==== ==== ==== ================ Allow 00000010 t— 001F01FF —- DSPO rw+x BUILTIN\Administrators Allow 0000001B -co- 10000000 —A —- —- BUILTIN\Administrators Allow 00000010 t— 001F01FF —- DSPO rw+x NT AUTHORITY\SYSTEM Allow 0000001B -co- 10000000 —A —- —- NT AUTHORITY\SYSTEM Allow 00000010 t— 001F01FF —- DSPO rw+x DJQTQ141\Gresham Lang Allow 0000001B -co- 10000000 —A —- —- \CREATOR OWNER Allow 00000010 t— 001200A9 —- -S– r–x BUILTIN\Users Allow 0000001B -co- A0000000 R-X- —- —- BUILTIN\Users Allow 00000012 tc– 00000004 —- —- –+- BUILTIN\Users Allow 00000012 tc– 00000002 —- —- -w– BUILTIN\Users Owner: DJQTQ141\Gresham Lang Primary Group: DJQTQ141\None »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450 »»Dumping Values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 AppInit_DLLs = »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM 00001150: vk UDeviceNotSelecte 00001190:dTimeout 1 5 ( h vk ' zGDIProce 000011D0:ssHandleQuota" 9 0 =t vk Spooler2 00001210: y e s _ vk 5swapdisk h 00001250: X vk . TransmissionRetryTimeout vk 00001290: ' b USERProcessHandleQuota3 h X 000012D0: vk y AppInit_DLLsecte = ZG 00001310:h P h / E ZG B P h Q tzh 00001350: P h j| RG > h # P u< 00001390: t1 ZG d E h 0 d + E 000013D0:h = G t h4 F { = G t h8 F s{ d 00001410:@VG j d d ` Ph E d ` Q 00001450: ; = G t+ ` R P ` P d Qh\ F z 00001490: = ZG @ j} RG = j / h \ R E 000014D0:_ \ FG FG FG \ R w FG FG FG d 00001510: FG FG FG j |  E j | " | 00001550: ———- NEWWIN.TXT AppInit_DLLsecte ————– ————– $0117F: UDeviceNotSelectedTimeout $011C7: zGDIProcessHandleQuota $01270: TransmissionRetryTimeout $012A0: USERProcessHandleQuota3 $012F0: AppInit_DLLsecte ————– ————– No strings found. d…. 0 Jul 28 17:56 . d…. 0 Jul 28 17:56 .. 2 files found occupying -1024 bytes =============================================================================== 0 bytes 0 cps Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01 VDIR v1.00 Path: C:\FINDNFIX\JUNKXXX\*.* —————————————+————————————— . 07-28-:4 17:56|.. 07-28-:4 17:56 —————————————+————————————— 2 files totaling 0 bytes consuming 0 bytes of disk space. 17299968 bytes available on Drive C: No volume label …File dump… junkxxx\*.* The system cannot find the file specified. 0 file(s) copied. Detecting… C:\FINDnFIX\junkxxx Finished Detecting… 

Delete the entire FINDnFIX folder. Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.

Looks better. With only HJT running, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {1EB64969-AD79-4117-B9CE-262AFB5415E4} - (no file)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {DE1D8C2B-82EE-4912-9B30-458779FF172E} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

Reboot when done, rescan with HJT and post a new log here for a final check over.

That's a clean log - how is it running now?

Daemon, My computer is running smoothly and flawlessly now. The last time I went on I updated my AOL spyware program, ran it and it detected about blank. The program deleted it. I then went to Norton web cleanup which removed the cookies and cache. However, when I went into Start, programs, accesories, system tools, disk cleanup and viewed my temporary internet folders, I fold internet explorer folders listed as index. These internet explorer index cookies show that about blank webpage. I deleted them and then emptied my norton protected recycle bin. I then went to Microsoft Update and loaded the most recent patch and Norton Liveupdate. Is there anything I can do with my Firewall to prevent these predators from attacking me. How did the about blank get back on my computer? I know your helping alot of people so if I'm asking too much, please let me know Sincerely, Gresh

Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

The measures you have taken are good. In addition, to help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?




As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.