about:blank, sp.html hijack problem

Re: about:blank sp.html problem will not go away

Please do not start new threads for a problem you have already posted. I'm merging back to your original thread. You really should start by running ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal While it normally not fix about:blank infections, it does typically fix other problems that can make moving these hijackers more difficult.

In you other thread you posted a HijackThis log already. There are guidelines on posting HJT logs:
Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT

You need to install yours properly. You have it installed exactly where we say not too. You have it here:
C:\Documents and Settings\John Hilsabeck\Desktop\hijackthis\HijackThis.exe

Fix that before continuing.

Did you install this UpromiseRemindU stuff (see the two lines below)? If not, look in Add/Remove programs for an unintall.
O8 - Extra context menu item: RemindU - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0.htm
O9 - Extra button: RemindU - {16BF42FD-CA0A-4f48-819D-B0343254DD67} - file://C:\Program Files\UpromiseRemindU\System\Temp\upromise_script0.htm (HKCU)

 

Re: about:blank sp.html problem will not go away

Let's try this, download Pocket KillBox and unzip it to its own directory. But do not run it yet we will run later.

Print these instructions or save them locally because after this sentence I want you to have all programs (especially browsers like IE) closed and I want you to physically disconnect (unplug cable) from the internet.

OK exit programs & do physical disconnect now.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JOHNHI~1\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JOHNHI~1\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {C7EE4395-64D3-482E-AF89-F156F5765A8E} - C:\WINDOWS\system32\kbfc.dll
O15 - Trusted Zone: http://www.windowsupdate.com
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
O18 - Filter: text/html - {95E009F4-8B07-4011-AECD-E0694F5254D3} - C:\WINDOWS\system32\kbfc.dll
O18 - Filter: text/plain - {95E009F4-8B07-4011-AECD-E0694F5254D3} - C:\WINDOWS\system32\kbfc.dll

After clicking Fix, exit HJT.

Run Pocket Killbox. Select the option to Replace on Reboot.
Copy and Paste C:\WINDOWS\system32\kbfc.dll into the box. Check the option to Use Dummy and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your machine to reboot but boot into Safe Mode.

Boot into safe mode and use Windows Explorer to delete (if found):
c:\filter.log
C:\WINDOWS\system32\kbfc.dll <--- just double checking to make sure it's gone

Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You're welcome. If you have rebooted a couple of times and ran a few Internet Explorer sessions (opened and closed at a minimum), you are probably okay. If you want to make it less likely that problems like this from will happen, you need to do all of the steps in the below thread. Make sure you use FireFox instead of IE.

How to Protect yourself from malware!