About Blank Nightmare

sheilab38 · Nov 13, 2005

I am pretty sure I have the about blank hijacker on my computer along with several others. Can you help me. I will need really simple instructions if possible. Thanks and here is a copy of my hijack this log.

Shadow_Puter_Dude · Nov 13, 2005

Download LSP-Fix

After download is complete, Run LSP-Fix

Check the Box labeled "I know what I'm doing" and then click on the farlsp.dll file (in the “Keep” section) to select it.

Then, Select the >> button to move farlsp.dll into the Remove section.

Now, click the Finish Button. When the Repair Summary box appears, click OK.

(Note: If the file farlsp.dll is already in the remove section, then just click FINISH.)

Now run HijackThis and fix the following:

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM (file missing)
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O10 - Broken Internet access because of LSP provider 'farlsp.dll' missing
Click to expand...

Post a fresh HijackThis log when finished with the above.

sheilab38 · Nov 13, 2005

Okay, I think I did everything right. Here is the new log and thanks for your help.

sheilab38 · Nov 13, 2005

Oh, also the reason I didn't take out any of the iespell stuff is that is the spellcheck program I use in my job. Wanted to make you aware in case that would wipe it out. I don't want to lose it because if is for medical spell checking.

Shadow_Puter_Dude · Nov 13, 2005

Uninstall Spyware Cleaner this is a rogue application and affords you no real protection.

Now scan and have HJT Fix the following:

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
Click to expand...

Post a fresh HijackThis log after you have completed the above.

sheilab38 · Nov 14, 2005

I am sorry if my last message may have offended when I said I did not delete the i.e. spell. I am not professing in any way to know what I am doing. It is just that the transcription company that I work for put that in there because it is a medical dictionary and we have to use it to check our work. I was not sure if by deleting those files if it would wipe all of it out or change my ability to use it. I was just making you aware of this. Thanks......sb

sheilab38 · Nov 14, 2005

Ok, this is my new log after deleting the last files.

Shadow_Puter_Dude · Nov 14, 2005

sheilab38 said:

I am sorry if my last message may have offended when I said I did not delete the i.e. spell. I am not professing in any way to know what I am doing. It is just that the transcription company that I work for put that in there because it is a medical dictionary and we have to use it to check our work. I was not sure if by deleting those files if it would wipe all of it out or change my ability to use it. I was just making you aware of this. Thanks......sb
Click to expand...

You didn't offend me. I told you to fix those lines, because IEspell appeared to be broken. If IEspell is working gine then don't worry about it.

Shadow_Puter_Dude · Nov 14, 2005

Your HijackThis log looks OK. How is your computer running?

sheilab38 · Nov 14, 2005

My start page is still not right and when I load it it says at the bottom "done but with errors on page". Also, I noticed today when I went into a search it looked like it flipped me over to double click, not sure.

Shadow_Puter_Dude · Nov 14, 2005

Please run Panda Online Scan. After the scan attach the log to your next post. Also please follow the below:

1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.

Now come back here and post all three logs as attachments

sheilab38 · Nov 19, 2005

Finally I am able to get these logs back to you. Have been tied up with work all week. Hope these are what you are looking for. Thanks.

sheilab38 · Nov 19, 2005

Here is the last log.

Shadow_Puter_Dude · Nov 19, 2005

sheilab38 said:

Here is the last log.
Click to expand...

I need the RKFiles Tool log.

Shadow_Puter_Dude · Nov 19, 2005

Download
- Pocket Killbox

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

C:\Documents and Settings\Sheila\Local Settings\Temp\bkinst.exe
C:\WINDOWS\SYSTEM32\defaulttxt.dat
C:\WINDOWS\SYSTEM32\setup_incred_6.exe
C:\WINDOWS\SYSTEM32\SHAgentNew.dll
C:\WINDOWS\NDNuninstall4_88.exe
C:\PROGRAM FILES\180search Assistant
C:\Documents and Settings\Sheila\Local Settings\Temp\Auh16.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Cil1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Efo1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Egd1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Env1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Ers1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Fxp1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Iag1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Ivd1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Iyn1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Jnh1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Juc1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Kki1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Lbe1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Lcm1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Olh1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch251.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch261.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch271.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch281.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\pch132.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\pch209.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Pjd1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Qnr1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\res171.tmp
C:\Documents and Settings\Sheila\Local Settings\Temp\Shj1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\sta429.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\temp.cab
C:\Documents and Settings\Sheila\Local Settings\Temp\Thw1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\toolbar.dll
C:\Documents and Settings\Sheila\Local Settings\Temp\Tsj1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Unq1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Vhu1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Vjx1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Wcm1.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Xgm14.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\YinD.exe
C:\Documents and Settings\Sheila\Local Settings\Temp\Zkv1.exe
C:\Program Files\64 vc aim\2 that.exe
C:\Program Files\64 vc aim\ylbvcdtf.exe
C:\Program Files\CreativeHoldGrey\thirdstore.dll
C:\WINDOWS\NDNuninstall4_88.exe
C:\WINDOWS\NDNuninstall5_20.exe
C:\WINDOWS\NDNuninstall5_40.exe
C:\WINDOWS\NDNuninstall5_48.exe
C:\WINDOWS\system32\setup_incred_6.exe
C:\WINDOWS\system32\siae3123.exe
Click to expand...

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

C:\Documents and Settings\Sheila\Local Settings\Temp\bkinst.exe <---- Delete the File
C:\WINDOWS\SYSTEM32\defaulttxt.dat <---- Delete the File
C:\WINDOWS\SYSTEM32\setup_incred_6.exe <---- Delete the File
C:\WINDOWS\SYSTEM32\SHAgentNew.dll <---- Delete the File
C:\WINDOWS\NDNuninstall4_88.exe <---- Delete the File
C:\PROGRAM FILES\180search Assistant <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Auh16.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Cil1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Efo1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Egd1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Env1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Ers1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Fxp1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Iag1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Ivd1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Iyn1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Jnh1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Juc1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Kki1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Lbe1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Lcm1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Olh1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch251.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch261.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch271.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Patch281.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\pch132.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\pch209.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Pjd1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Qnr1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\res171.tmp <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Shj1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\sta429.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\temp.cab <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Thw1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\toolbar.dll <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Tsj1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Unq1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Vhu1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Vjx1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Wcm1.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Xgm14.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\YinD.exe <---- Delete the File
C:\Documents and Settings\Sheila\Local Settings\Temp\Zkv1.exe <---- Delete the File
C:\Program Files\64 vc aim\2 that.exe <---- Delete the File
C:\Program Files\64 vc aim\ylbvcdtf.exe <---- Delete the File
C:\Program Files\CreativeHoldGrey\thirdstore.dll <---- Delete the File
C:\WINDOWS\NDNuninstall4_88.exe <---- Delete the File
C:\WINDOWS\NDNuninstall5_20.exe <---- Delete the File
C:\WINDOWS\NDNuninstall5_40.exe <---- Delete the File
C:\WINDOWS\NDNuninstall5_48.exe <---- Delete the File
C:\WINDOWS\system32\setup_incred_6.exe <---- Delete the File
C:\WINDOWS\system32\siae3123.exe <---- Delete the File
Click to expand...

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

sheilab38 · Dec 2, 2005

Hi.

I have been out of town on vacation but I am back and want to finish this up. I ran the pocket kill and deleted. I know that I am no computer whiz but when I go to Windows Explorer for the next step I cannot find these files. How on earth do I find them. I tried doing a search.

Shadow_Puter_Dude · Dec 2, 2005

sheilab38 said:

Hi.

I have been out of town on vacation but I am back and want to finish this up. I ran the pocket kill and deleted. I know that I am no computer whiz but when I go to Windows Explorer for the next step I cannot find these files. How on earth do I find them. I tried doing a search.
Click to expand...

Then the files were sucessfully deleted by pocket killbox. Using WIndows Explorer to check for and delete the files is a secondary check.

sheilab38 · Dec 3, 2005

I hope that I did this all correctly. Attached is a new hijack log.

Shadow_Puter_Dude · Dec 3, 2005

Do you recognize this program; C:\Program Files\Print!\print!.exe.

Scan with HijackThis and fix teh following:

O4 - HKLM\..\Run: [apsvc] C:\WINDOWS\java\Packages\apsvc.exe
Click to expand...

Follow these instructions
Running Spy Sweeper.

I still need the RKFiles Tool log.

Come back here after you have finished the above and post the Spy Sweeper and RK Files logs; along with a fresh HijackThis log.

Log in or Sign up

About Blank Nightmare

sheilab38 Private E-2

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

sheilab38 Private E-2

Attached Files:

hijackthis.log

sheilab38 Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

sheilab38 Private E-2

sheilab38 Private E-2

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter

Shadow_Puter_Dude MG Authorized Malware Fighter

sheilab38 Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

sheilab38 Private E-2

Attached Files:

Activescan.txt

QoologicScan.txt

sheilab38 Private E-2

Attached Files:

ntuser.dat.LOG

Shadow_Puter_Dude MG Authorized Malware Fighter

Shadow_Puter_Dude MG Authorized Malware Fighter

sheilab38 Private E-2

Shadow_Puter_Dude MG Authorized Malware Fighter

sheilab38 Private E-2

Attached Files:

hijackthis.log

Shadow_Puter_Dude MG Authorized Malware Fighter