about:blank hijack

Okay let's see what type of infection you have.

If you have run ALL steps from the READ ME FIRST,andyou still have a problem:- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following: your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message.(Do NOT copy/paste the log into your post).

 

The Generic Solution to HSA is much more complex than just running AdsSpy and Process Explorer. So exactly what did you do with the Generic Solution. And when did this error message begin.

If you want help, you must post your HijackThis log. about:Blank and HSA hijacks do show in a log. They may be many variations of how they show, but they do show.


The error message you posted seems more like a hardware or software conflict message.

 

It is very important to always remember to exit ALL browsers before running HijackThis. You had the below running:
C:\Program Files\Mozilla Firefox\firefox.exe

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file move.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the move.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge say yes.

Make sure you have both about:Buster and HSremove downloaded from the READ ME FIRST. And make sure you have UPDATED the database for about:buster. I believe it is up to number 23. The download only comes with version 19 which is out of date. You must update.

You need to print or save these instructions locally because after this reading this sentence you will need to physically unplug your connection from your cable, ADSL, or dial-up modem to your PC and then you MUST exit all browsers and DO NOT run any again until requested.

Okay, unplug your internet connection and exit browsers now!!!!

Now we need to use HijackThis to remove the Network Security Service!

Please run HijackThis click on the "Open the Misc Tools Section" button on the open page. Then select "Delete an NT service" on the left-hand side.
A "Delete a Windows NT Service" window will pop up. Try entering the following into the box and then click OK:
Network Security Service (NSS)
If that does not work try entering the short name: ? 6QÔõ'ª´ÆÐ8
Then reboot and let's see if the service is truly gone.

You should use cut and paste to copy the above info into HJT since you cannot easily enter the above characters from your keyboard.

After fixing doing the above the following steps will continue to work on fixing the hijack problem. Hopefully your log has not changed. These hijackers quite often mutate and rename or recreate new problem files.

Now still with HJT running select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\atlyj.exe
C:\WINDOWS\nthw.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now (DO NOT OPEN ANOTHER BROWSER UNTIL AFTER POWER DOWN AND POWER UP, see below):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xjewp.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xjewp.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xjewp.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xjewp.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xjewp.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xjewp.dll/sp.html#93256
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {831707D7-0820-512C-1A76-D057092ABDCD} - C:\WINDOWS\system32\apitq32.dll
O4 - HKLM\..\Run: [nthw.exe] C:\WINDOWS\nthw.exe
O4 - HKLM\..\RunOnce: [atlyj.exe] C:\WINDOWS\atlyj.exe
O16 - DPF: {B4F32846-56DD-4CF5-94FD-17DE1A12E9EB} - http://t058.com/cabtest/counter.cab

Then exit HJT after clicking FIX

Run Windows Explorer and look for and try to delete (sort the listing in windows explorer by Modification dates and look for possibly other similarly name files from the same date - let me know if you find others):
C:\WINDOWS\system32\xjewp.dll
C:\WINDOWS\system32\apitq32.dll
C:\WINDOWS\atlyj.exe
C:\WINDOWS\nthw.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. If you cannot find or delete them, note which ones and continue (tell me the results when you come back here).

- Run about:Buster and save the log to ab1.log (make sure you let it do the second scan).

- NOW PULL THE POWER PLUG TO YOUR PC! Yes, that is what I said. This is very important! I do not want you to power down the normal way.

- After that wait a minute or two and then power up into safe mode (still with no internet connection available and do not open any browsers). Only run what I request.

- Empty your Recycle Bin and delete all files in the c:\windows\prefetch folder. In fact as an additional measure do the following:
Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin
And Click OK.

- Run HSremove and then run about:Buster again and save the log to ab2.log (let it do second scan)!

- Immediately after about:buster completes, reboot in normal mode. (you do not need to pull the powser plug here. Just reboot.)

- Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

- Plug your cable to the internet back in now.

- Open and close a couple of IE sessions and then with IE closed get a new HJT log.

- Now come back here and post both about:Buster logs and the new HJT log. And tell me what happened during the procedure.

Let me know anything else that you notice or had problems with.

 

You forgot to post a new HJT log. Please do not reboot or shutdown after posting the log or problem files could mutate making any suggested fixes non-useful.

 

Okay! Talk with you later. Hope it's warm where you are going. It's snowing here.

 

Have HijackThis fix this one below entry (left over from running HSremove).
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm



we need to do the registry merge one more time! Overwrite the previous move.reg file with the below.

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file move.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the move.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge say yes.

 

You're welcome. You should now perform the steps in the below link to help prevent future problems:

How to Protect yourself from malware!