About:Blank - Removal

Are you sure you have the type of about:Blank covered in the Generic Procedure. Can you follow the steps in the Generic Procedure or are your problems preventing that.

You do not need Windows Explorer to open HijackThis.exe and you can put a shortcut on your Desktop which will run the EXE from the correct location (which will not be the Desktop). Putting the EXE on your Desktop is what we do not want.

Have you tried the standard cleanup procedures:

READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

 

See if you can do the following and get me the HijackThis log. Make sure you are in normal boot mode.
Do not reboot or shutdown after posting because that can cause mutation of the problems.

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

You don't need explorer to save it to that directory. You can do all of that right from WinZip that I see you have running. It allows you to choose where to extract files to and even allows you to browse and create new folders. I looking at you log now. You definitely have an HSA hijacker.

 

Are you loading IE at startup on purpose?
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe

I will be suggesting to remove that item from startup unless it is required for some reason.

 

Don't use msconfig anymore as a fix for things like that?

Make sure you have both about:Buster and HSremove downloaded from the READ ME FIRST. And make sure you have UPDATED the database for about:buster. I believe it is up to number 25.

You need to print or save these instructions locally because after this reading this sentence you will need to physically unplug your connection from your cable, ADSL, or dial-up modem to your PC and then you MUST exit all browsers and DO NOT run any again until requested.

Okay, unplug your internet connection and exit browsers now!!!!

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\winqh32.exe
C:\WINDOWS\system32\apizu32.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now (DO NOT OPEN ANOTHER BROWSER UNTIL AFTER POWER DOWN AND POWER UP, see below):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mhnan.dll/sp.html#44768
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {04F5DB37-A709-7E2A-A8A2-49B31757F0DC} - C:\WINDOWS\system32\apioz32.dll
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [apizu32.exe] C:\WINDOWS\system32\apizu32.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.wildtangent.com/webdrivers/webinstall/Install.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {94837F90-A2CA-4A8A-9DA0-B5438EC563EA} - http://install.wildtangent.com/activelauncher/activelaunchersetup.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/shockwave/blasterball2Remix/install.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.22/ttinst.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://player.virtools.com/downloads/player/Install3.0/Installer.exe

Then exit HJT after clicking FIX

Run Windows Explorer and look for and try to delete (sort the listing in windows explorer by Modification dates and look for possibly other similarly name files from the same date - let me know if you find others):
C:\WINDOWS\mhnan.dll
C:\WINDOWS\system32\apioz32.dll
C:\WINDOWS\winqh32.exe
C:\WINDOWS\system32\apizu32.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. If you cannot find or delete them, note which ones and continue (tell me the results when you come back here).

- Run about:Buster and save the log to ab1.log (make sure you let it do the second scan).

- NOW PULL THE POWER PLUG TO YOUR PC! Yes, you read that correctly. This is very important! I do not want you to power down the normal way.

- After that wait a minute or two and then power up into safe mode (still with no internet connection available and do not open any browsers). Only run what I request.

- Empty your Recycle Bin and delete all files in the c:\windows\prefetch folder. In fact as an additional measure do the following, run Ccleaner that you installed while running the READ ME FIRST.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

- Run HSremove and then run about:Buster again and save the log to ab2.log (let it do second scan)!

- Immediately after about:buster completes, reboot in normal mode. (you do not need to pull the powser plug here. Just reboot.)

- Plug your cable to the internet back in now.

- Open and close a couple of IE sessions and then with IE closed get a new HJT log.

- Now come back here and post both about:Buster logs and the new HJT log. And tell me what happened during the procedure.

Let me know anything else that you notice.

 

No you can use msconfig to disable startups, but it is just not a good method to use permanently. There are startup managers that are better suited for this. Also many times things that people stop from loading at startup, they never need. So it is best to fix it so they do not load ever (without even using msconfig).

 

You only posted one AB log. I really needed to see both. Was the one you posted the first one or second one. There was a load of bad stuff shown. You still have problems visible in you HJT log. If you have powered down or rebooted since posting it, the problems could have mutated. Either way, please do the following. Run About:Buster in normal boot mode (and let it do second pass scan) save the log (ab3.txt). Immediately reboot to safe mode and run About:Buster again (and let it do second pass scan) save the log (ab4.txt). Now reboot into normal mode and post a HJT log and do not reboot or power down. Wait for a fix. You can disconnect from the Internet (even unplug the internet connection cable to be safe) but no reboots.

 

Is this last log for the same user account as the one in message # 19. This last one does not show the problems in the R0 & R1 lines.

You need to run msconfig and enable Normal Startup so we can see what else would be loading in normal conditions.

Is MS Antispyware still detecting and blocking home page changes. If so, we may need to disable MS Antispyware so we can see and fix the problems. Blocking the problem does not remove and fix it which is the real desired solution.

 

Yes! Change msconfig to Normal Startup and then reboot your PC. After reboot open and close one browser. Note if you get any messages. Now post a new HJT log.

 

See! This is why I don't like people to use msconfig.

First look to see if any of the below are in Add/Remove programs. If they are uninstall them:
WildTangent
SAHBundle
Internet Optimizer
BearShare

If you don't use or don't want QuickTime uninstall it. If you just do not want the qttask.exe file to load (if is not needed) we can fix that line later with HJT. I did not add it below. That's up to you.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\Brian\LOCALS~1\Temp\bundle.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause


After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\WildTangent <--- the whole folder
C:\Program Files\Internet Optimizer <--- the whole folder
C:\Program Files\BearShare <--- the whole folder
c:\temp\salm.exe
C:\Documents and Settings\Brian\Local Settings\Temp\bundle.exe <--- delete all files and subfolders in this Temp folder (note: some will be denied - just skip them and continue)

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

Now run Ccleaner!

Now we need to Reset Web Settings (MS-AS my block or at least intercept this - allow the majorgeeks home page change. I want to see it take effect. You can always change it to something else later).
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You're welcome.

Only Administrator accounts can boot in safe mode. If you are not seeing all administrator accounts, make sure the mouse cursor is in the middle of the screen where the account show and either hit the down arrow key or use the mouse wheel (if you have a wheel mouse) to scroll down and see more accounts.

You can have HJT fix the following entries if you do not want them to load:
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

Keep the HJT backup file from this date and you can restore these entries if you ever need them.

Problems like this can come from any number of methods. Software you download and install, site you go to, having improperly protected systems, etc. Safe surfing starts with the end user. No AV or spyware blocking package (or firewall for that matter) can protect you from everything especially yourself. Be careful what you click on and read license agreements and messages that come on the screen. Quite often they word them tricky to and the answer you want could be the opposite of what you think. (Like click Yes if you do not want this instead of clicking No which would install it.) Malware changes every day and it is not easy to keep up with it.

You should follow all the steps in the below link (or their equivalents) to help avoid future problems (I said avoid because an absolute prevent is not possible):

How to Protect yourself from malware!

 

You're welcome! Happy to help! You should check out your other son's PC. The are many forms of malware out there that hide themselves. That is they do not show you any visible forms of problems. They just try to work behind the scenes so that you never know they are there.

 

Can you provide more specific information and exact messages ? Also when do you get these messages, as soon as you boot, after BIOS screens but before windows loads, as windows is loading?