Having Problems..."about:blank"

Have you run all (skip the online scans you have a problem with) the other steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal ?


If so, and you still have a problem, do the following:

Make sure you have HJT Version 1.98.2 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT

 

Please read my directions again:

- Make sure you have HJT Version 1.98.2
- All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

You must do the above and post a new log before we can continue.

You also need to get your update from Microsoft. You are way out of date. Your IE version is only: Internet Explorer v5.51 SP2 (5.51.4807.2300)

 

It tells me you are still using HijackThis v1.97.7

Please download the correct version from our link given in the READ ME FIRST thread: Hijack This!

 

Are you sure no IE windows were open? I see the below in your log:

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

You are also going to have to disable Spybot from placing these restrictions:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

Just while we work on your problem. We can enable them again later.

 

Make sure you have system restore disabled and viewing of hidden files enabled.

Please bring up Task Manager by hitting CTRL-ALT-DEL. Find the below processes and End them:
AIEPK2


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {9B4C7A1D-80ED-4ED4-AA50-89CAF6EA6803} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {F441428B-FFC5-41BF-AC17-158BF4256B4E} - C:\WINDOWS\SYSTEM\DBILKAA.DLL
O3 - Toolbar: (no name) - {0AAF602E-72A1-45FE-BAB1-06971E07EAA2} - (no file)
O4 - HKLM\..\Run: [aiepk] C:\WINDOWS\DESKTOP\DOWNLOADS\AIEPK2.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: @Home - {C87CEC04-1739-4D89-9746-34435CE6958F} - http://home.excite.com (file missing) (HKCU)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

O16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} (WWWInstall Class) - http://go.securelive.com/speed/uk/WebInstall.dll
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:mhtml:file://C:\path.mht!http://64.200.26.76/d1/arctaa.chm::/painter.exe
O18 - Filter: text/html - {F459C402-EF0E-43D7-92EC-24B4916E031F} - C:\WINDOWS\SYSTEM\DBILKAA.DLL
O18 - Filter: text/plain - {F459C402-EF0E-43D7-92EC-24B4916E031F} - C:\WINDOWS\SYSTEM\DBILKAA.DLL


Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\SYSTEM\DBILKAA.DLL
C:\WINDOWS\DESKTOP\DOWNLOADS\AIEPK2.EXE

Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Check this out and see if it applies to you: http://securityresponse.symantec.com/avcenter/venc/data/js.seeker.k.html


Please download the latest version of HJT before continuing. It is now V1.99. Get it here: http://www.majorgeeks.com/download3155.html
Do you know what this process from HP is supposed to be for?
C:\PROGRAM FILES\HEWLETT-PACKARD\HPIS\BIN\MAD.EXE

Did you fix athe three O16 and two O18 lines I gave you last time in HJT? They are back. We need to find and delete: C:\WINDOWS\SYSTEM\DBILKAA.DLL
Try fixing them again but do it after booting in safe mode.
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB
O16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} (WWWInstall Class) - http://go.securelive.com/speed/uk/WebInstall.dll
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:mhtml:file://C:\path.mht!http://64.200.26.76/d1/arctaa.chm::/painter.exe
O18 - Filter: text/html - {F459C402-EF0E-43D7-92EC-24B4916E031F} - C:\WINDOWS\SYSTEM\DBILKAA.DLL
O18 - Filter: text/plain - {F459C402-EF0E-43D7-92EC-24B4916E031F} - C:\WINDOWS\SYSTEM\DBILKAA.DLL

 

Please download the following tool: Pocket KillBox

Run Pocket Killbox and choose the Delete on Reboot option. Enter the following into the box for Full Path of File to Delete C:\WINDOWS\SYSTEM\FEBLECB.DLL
Select the Delete on Reboot button.
and press the Delete button (red X) and then Yes or OK until your machine reboots.

What version of XoftSpy do you have? Versions before 4.0 where consider rogue/suspect spyware removal tools. See: http://www.spywarewarrior.com/rogue_anti-spyware.htm#xos_note

You are still foregetting to exit browser sessions. Remember what I said:
- All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

You had nine IE sessions running:
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

You are going to have difficulty fixing problems unless you remember to always exit all browser sessions before running HijackThis. And that brings up another question, are you actually clicking Fix in HijackThis. I keep seeing the same info in your log over and over again.

Please run Spybot and temporarily disable it from placing the restrictions the we see in HJT's O6 lines. Run Spybot and click Mode, select Advanced Mode, Tools, then IE Tweaks. Make sure none of the Miscellaneouse Locks are checked. Then quit Spybot.

Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).
Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = %START_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = %SEARCH_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {28945D86-82D8-4BE4-A25A-B3672F4B4529} - C:\WINDOWS\SYSTEM\FEBLECB.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://gfetc.webex.com/client/v_eureka-fiji/event/ieatgpc.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O16 - DPF: {15320607-1001-1831-1000-118599957123} - ms-its:mhtml:file://C:\path.mht!http://64.200.26.76/d1/arctaa.chm::/painter.exe
O18 - Filter: text/plain - {7881D918-08BD-4B19-9DF9-2BD919D31023} - C:\WINDOWS\SYSTEM\FEBLECB.DLL
O18 - Filter: text/html - {7881D918-08BD-4B19-9DF9-2BD919D31023} - C:\WINDOWS\SYSTEM\FEBLECB.DLL

Now Reset Web Settings again:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You still have something locking your settings
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

Did you disable Spybot from doing that (and leave it that way for now)?
If not Spybot, do you have SpywareBlaster or something else placing those restrictions? If so, please disable it.

Did you Reset Web Setting as instructed?

How is everything working otherwise?

The restrictions and the below are bothering me (although they are not big problems). I want to know why they are not clearing. Something is locking them.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = %SEARCH_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = %START_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = %SEARCH_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = %SEARCH_PAGE_URL%
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

 

Do you have SpywareBlaster installed? If yes, temporarily uninstall it.
I know you have Spybot installed but what version does it say. If 1.3 final, get the current updated detections updates and also make sure you have installed this: Spybot - Search and Destroy DSO Exploit Fix

Then run HJT and have it fix these lines if still present:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

Then post an new HJT log.

 

Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = %START_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = %SEARCH_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {17C8F5B3-AAAB-421F-B2F5-B6E9704553E5} - C:\WINDOWS\SYSTEM\JME.DLL
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O18 - Filter: text/html - {1E30EE60-062C-4577-A459-5603E6AB5DD8} - C:\WINDOWS\SYSTEM\JME.DLL
O18 - Filter: text/plain - {1E30EE60-062C-4577-A459-5603E6AB5DD8} - C:\WINDOWS\SYSTEM\JME.DLL

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\SYSTEM\JME.DLL
Let me know if you have a problem finding or deleting the above file.

Now Reset Web Settings again:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to www.majorgeeks.com (please leave it at this URL for the time being) . Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Follow my directions below in my previous message. Run those steps and post the new log as requested.

 

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).


Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\PROGRAM FILES\ADMANAGER CONTROLLER\ADMANCTL.EXE
C:\PROGRAM FILES\ADMANAGER CONTROLLER\ADMANKEEP.EXE


After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = %START_PAGE_URL%
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = %SEARCH_PAGE_URL%
O4 - HKLM\..\Run: [Admanager Controller] C:\PROGRAM FILES\ADMANAGER CONTROLLER\ADMANCTL.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\PROGRAM FILES\ADMANAGER CONTROLLER <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

Now Empty your Recycle Bin.

Now reboot in normal mode and post a new HJT log. And tell us how things are working. If you have problems, explain them in detail.

 

Goto to your c:\windows\inf folder and find the file named IERESET.INF and rename it to IERESET.OLD

Download the attached ZIP file and extract the IERESET.INF file from it into your c:\windows\inf folder.

Then get a new HJT log and post it.

 

Looks clean! How are things working now?

 

I don't know what that statement means! More detail would be helpful.


You should also perform the steps in the below link to help avoid future problems:
How to Protect yourself from malware!