Help me with removing about:blank PLEASE!

Please follow the steps below (make sure you pay attentions to things mentioning HSA and About:Blank hijackers.):

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

You should post the followup HJT log I requested. In most cases, true About:Blank problems do not go away very easily.

 

It was good that I requested you post the log. You still have problems.

Okay your Windows OS and IE version are way out of date and represent a major security risk. You must get updated after we finish fixing any remaining problems you have. We will discuss that later.

You seem to have both McAfee and Symantec products installed. If McAfee also contains an antivirus application, you need to uninstall one program or the other.

You do not have HijackThis installed as I requested. You are running it directly from the ZIP file as the next line shows:
C:\Documents and Settings\Dave Farrar\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

You must extract HijackThis into a folder like I gave you in my instructions. Do this before continuing.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [Update] C:\Program Files\\Carpe Diem\Bspears[1]\CDUpdater.exe CD_UPDATER
O15 - Trusted IP range: 206.161.125.149
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c420.cab
O16 - DPF: {79C03BC5-6C55-4B5B-921F-C02B6F1ABD7B} - http://404.x-share.com/vvv/Pribi.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\Carpe Diem\Bspears[1] <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Keep system restore disabled until all problems are known to be resolved.

You made a mistake in entering majorgeeks as your home page when I had you reset web settings. You set it to ww.majorgeeks.com Fix it by adding in the 3rd w.

It does not look like you fixed the below. Try again. Make sure when you fix lines with HijackThis that no browsers are open.

O4 - HKCU\..\Run: [Update] C:\Program Files\\Carpe Diem\Bspears[1]\CDUpdater.exe CD_UPDATER

 

Is the below line still in your HJT log:
O4 - HKCU\..\Run: [Update] C:\Program Files\\Carpe Diem\Bspears[1]\CDUpdater.exe CD_UPDATER

If so, you still have a problem.

Please also download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster

• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program

Can you access your sites now?

 

You seemed to have missed my point when I said in message number 6 that only one antivirus program must be installed. Why do you now have AVG and Symantec? Uninstall AVG which you just installed.

Please download this trial version of ewido security suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will prompt you to update click the OK button
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Click on Start

The update will start and a progress bar will show the updates being installed.

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, after rebooting continue with the below steps.

Open up Ewido and do the following:

• Click on scanner
• Make sure the following boxes are checked before scanning:
  • 
    [*]Binder
    [*]Crypter
    [*]Archives
• Click on Start Scan
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files, click OK

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report. And tell me if you are still having any problems.

 

Use Windows Explorer and tell me if you can find any of the below files and folders:

C:\sao tome dialer.txt
C:\14.00617
C:\16.02103
C:\cdupdater.zl9.exe
C:\Program Files\Common Files\hot dialer\parisvoyeur.lnk
C:\Program Files\Common Files\hot dialer\uninstall parisvoyeur.lnk
C:\Program Files\carpe diem\parisvoyeur\cdupdater.exe
C:\Program Files\carpe diem\parisvoyeur\parisvoyeur.exe
C:\Program Files\carpe diem\sexatoo.exe
c:\windows\accesmembre.dll or c:\windows\system32\accesmembre.dll

 

Right click Start and select Explore. That is an easy way to bring up Windows Explorer.

I don't think anything we removed is causing the problem but it could be that what had been installed had caused the problems.

This Carpe Diem thing is bugging me though. I'm trying to think of what to do next to remove this. Does the folder actually exist on your PC?

Did you try flushing your DNS cache? You run ipconfig /flushdns from a command prompt window to do this.

Which sites are you having problems with? Did you try accessing them via IP address rather than using a URL?

 

Choice of words and detailed explainations is important. You are not having problems getting to websites, you are having problems logging into them. Is that a more correct assumption?

The reason I have been trying to remove the Carpe Diem stuff is because we all know about the Britney Spears related crap. I'm not sure why we cannot delete this but it looks like the folder name may contain hidden characters. Download and install: ExplorerXP
Use it instead of Windows Explorer to look in C:\Program Files see if you can locate this problem folder. It may be that some folder name (which junk characters) appears inbetween Program Files and Carpe Diem

 

That's strange. The line was show in your previous HJT log.

Does the below still appear in your log:
O4 - HKCU\..\Run: [Update] C:\Program Files\\Carpe Diem\Bspears[1]\CDUpdater.exe CD_UPDATER

If so, click Start, Run, and enter regedit and click OK. This will bring up the Registry Editor. Now navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

and make sure the bottom of the window shows the registry key being selected. Then click File, Export, and where is says "Save as type" change the option to all files. Then give it a File name like hkcu-run.txt and save it where you can find it. Then upload that file here.

Also do this! Goto this link: How to Protect yourself from malware!

and look at step 7. But instead of chosing all the options given there try clicking Restore Defaults.

 

Please do the following:

Click Search and the Select "All files and folders"
Enter the CDUpdater.exe in the "All or part of the file name:" box
Now select "More advanced options"
Make sure the following check boxes are checked:
- Search system folders
- Search hidden files and folders
- Search subfolders
Then click the Search button.

Now tell me all the places you find CDUpdater.exe

Now do the following.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixrun.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixrun.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Now reboot and then post a new HJT log.

 

Yes but did you notice that it is no longer in your log now after running the last registry patch.

Did you do what I asked in the last two lines of message # 21?

Then also reset your IE security level to Medium.

Use IE, Tools, Internet Options, Security, Custom Level.

 

Explain in more detail what you mean and what happens.

And what about from my previous message:

 

Have you tried using a different browser like Mozilla FireFox which is a recommended download anyway in How to Protect yourself from malware!

You can also try doing the below:

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixIE.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixIE.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes

Then after doing the above download the IEmain.zip attachment and extract the IEmain.reg file from it. And double click on it and allow it to merge into your registry.

 

Was either firewall installed and running when you tried to use FireFox?

Use Firefox and try to access Majorgeeks two different ways as given below:

- by URL, use: www.majorgeeks.com

- by IP addreass, use: 67.19.72.100

Let me know if either of those work.

After trying that, use Internet Explorer and let's get your OS updated. See step 1 in the below thread and get updated.

How to Protect yourself from malware!

 

Windows Explorer is not a website. It is a program. Right click Start and select Explore. The window that comes up is Windows Explorer. I don't know what you are referring to with Windows express. Are you talking about Windows Update and trying to download your updates using the Express method?

Let's try a differnent way and also try only updating to SP1a to start. Click on the below link to download the WinXP SP1a upgrade file. Note it is about 128Mb in size so you better have a fast connection:

Windows XP Service Pack SP1a Download

Download the file and then run it.

 

Please post a current HJT log. How are you connecting here now?

 

I do not see any problems in your log. But answer a question, why do you keep running HSremove? We fixed the below line:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

in message # 6 and now it is back again. You do not need to run this unless you have an HSA hijacker which you do not have.

Do you require any special settings to connect to your ISP?

 

Try it in safe mode and also make sure you are logged in with Administrator priviledges.

If that does not help, try the below.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixHP.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixHP.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes

 

I don't understand. A couple of messages back you just said you could not select your home page in IE, now you are saying you cannot access IE. Please explain what your real problem is. Are you able to run IE (and Mozilla)?

 

Okay your problem is accessing Websites not accessing Mozilla or IE. What about what you said in message number 40 about not being able to change the Internet Explorer Homepage. Did the registry patch fix that?

How do you connect to the internet (dial-up, cable, dsl)? Do you need a proxy setting? Do you have a connection setup in IE?

 

If you run IE and click Tools, Internet Options, and then select the Connections tab (hopefully it lets you), what do you see for the below areas:

1) Dial-up and Virtual Private Network settings - is anything in the box under this title. What radio buttons are checked (they may be grayed out) under this box?

2) Click the LAN settings button - what check boxes are selected on the following window?


For Mozilla FireFox, try uninstalling the application. Then reboot your PC. Now reinstall. I believe it is upto version 1.06, make sure you have the latest version.

 

By the way, what toolbar are your referring to with the below.

The way to set your home page is to run IE and click Tools, Internet Options, and on the General tab set what you want. Sound like you are trying to use some other method.