Please Help Me Remove About :blank

Click here to download the PeperFix tool, save it to your desktop, doubleclick on it, click 'Find and Fix' and reboot if prompted.

Open HJT>Config>Misc Tools and update to v1.99

Post anew log and we'll remove the rest of it manually.

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, find, zip and send this file:

C:\WINDOWS\BTGrab.dll

to this e-mail address including a link to this thread in the body of the email. It may be OK but I'd like to take a closer look at it - I'll get back to you about it if any further action is required.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: (no name) - {A2F792AD-524D-2BED-1C54-5DF075CC6BB2} - C:\WINDOWS\System32\zmcqab.dll
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [mPt3pr.exe] C:\documents and settings\jay\local settings\temp\mPt3pr.exe
O4 - HKLM\..\Run: [cocxfploc] C:\WINDOWS\System32\rywmrhg.exe
O4 - HKLM\..\Run: [2KMEWCJ58@LEN9] C:\WINDOWS\System32\Tfae5lMu.exe
O4 - HKLM\..\Run: [8304fc27876a] C:\WINDOWS\System32\msidle34.exe
O4 - HKCU\..\Run: [Ewwr] C:\Documents and Settings\jay\Application Data\roto.exe
O4 - HKCU\..\Run: [Sae] C:\WINDOWS\System32\??chost.exe
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe
O13 - WWW. Prefix: http://
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

Reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\documents and settings\jay\local settings\temp\mPt3pr.exe
C:\WINDOWS\System32\rywmrhg.exe
C:\WINDOWS\System32\Tfae5lMu.exe
C:\WINDOWS\System32\msidle34.exe
C:\Documents and Settings\jay\Application Data\roto.exe

Reboot when done, rescan with HJT and post a new log here.

I have followed your instructions. The only thing that I couldn't do was delete the following two files in safe mode as they were not there - could they have alreaady been deleted? C:\documents and settings\jay\local settings\temp\mPt3pr.exe C:WINDOWS\System32\Tfae5lMu.exe However there was a file in the same place as the last with the name tftp.exe - could it have changed its name or is this a completely different program?

They may have been orphan entries. That looks better. Let me check that file you sent.

OK, checked it - it's bad.

With only HJT running, have it fix:

O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll

Reboot when done and post a new HJT log. Are you still having trouble getting online with the computer? If so exactly what happens when you try?

Delete those entries from your favorites. Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Click here to download mwavscan. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.

Sorry for delay. Had a bit of trouble with System Security Suite - downloaded file seemed to be something different. However, I had no problems with MWAVScan. Here is the result. In the meantime I have updated AdAware and it has found 92 objects which I am about to delete so they may also appear on the attached log at the moment. File C:\WINDOWS\win32.bmp infected by "TrojanClicker.JS.Gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\UnstSA2.exe infected by "TrojanDropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\WINDOWS\sys32_app.dll infected by "TrojanDownloader.Win32.Small.mk" Virus. Action Taken: No Action Taken. File C:\WINDOWS\fixit.exe infected by "not-a-virus:AdWare.Midadle.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\63vqBmw.exe infected by "not-a-virus:AdWare.Midadle.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\r.exe infected by "Trojan.Win32.Small.j" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\14yf08fg.exe infected by "TrojanDropper.Win32.Small.gt" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\ATPartners.dll infected by "TrojanDownloader.Win32.Rameh.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\TVM_B5_Bundle_34.EXE infected by "TrojanDownloader.Win32.Small.wk" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\iehost34.exe infected by "not-a-virus:AdWare.ToolBar.VB.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\nvms.dll infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\bridge.dll_tobedeleted infected by "TrojanSpy.Win32.Briss.h" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\maxspeed.exe infected by "Trojan.Win32.VB.od" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exdl2.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\javex80.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\wsaupdater.exe infected by "not-a-virus:AdWare.BlazeFind.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\optimizer.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\ozhnkd.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\ozhnkf.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\WebRebates_Broadspring1_InstallAS.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\r.exe infected by "Trojan.Win32.Small.j" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\14yf08fg.exe infected by "TrojanDropper.Win32.Small.gt" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ATPartners.dll infected by "TrojanDownloader.Win32.Rameh.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\TVM_B5_Bundle_34.EXE infected by "TrojanDownloader.Win32.Small.wk" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\iehost34.exe infected by "not-a-virus:AdWare.ToolBar.VB.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\nvms.dll infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\bridge.dll_tobedeleted infected by "TrojanSpy.Win32.Briss.h" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\maxspeed.exe infected by "Trojan.Win32.VB.od" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl2.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\javex80.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wsaupdater.exe infected by "not-a-virus:AdWare.BlazeFind.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\optimizer.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ozhnkd.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ozhnkf.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\WebRebates_Broadspring1_InstallAS.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\twain_32\stdsc\unreg.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\win32.bmp infected by "TrojanClicker.JS.Gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\UnstSA2.exe infected by "TrojanDropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\WINDOWS\sys32_app.dll infected by "TrojanDownloader.Win32.Small.mk" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\instafin.dll infected by "Trojan.Win32.Delf.gh" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\on-line.exe infected by "Trojan.Win32.Dialer.bh" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\d_coolx.exe infected by "Trojan.Win32.Dialer.by" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\on-line.exe infected by "Trojan.Win32.Dialer.bh" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\on-line.exe infected by "Trojan.Win32.Dialer.bh" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.3\on-line.exe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.4\on-line.exe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.5\on-line.exe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.6\on-line.exe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: No Action Taken. File C:\WINDOWS\fixit.exe infected by "not-a-virus:AdWare.Midadle.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\63vqBmw.exe infected by "not-a-virus:AdWare.Midadle.b" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Program Files\install.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\Program Files\HJT\backups\backup-20040816-192649-675.dll infected by "not-a-virus:AdWare.BHO.NoName.a" Virus. Action Taken: No Action Taken. File C:\Program Files\MyWay\myBar\3.bin\MY2NS.EXE infected by "not-a-virus:AdWare.Toolbar.MyWay.b" Virus. Action Taken: No Action Taken. File C:\Program Files\MyWay\myBar\3.bin\NPMYWAY.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.f" Virus. Action Taken: No Action Taken. File C:\Program Files\Startenc1\forkford.dll infected by "TrojanDownloader.Win32.Swizzor.s" Virus. Action Taken: No Action Taken. File C:\Program Files\Startenc1\2639.exe infected by "TrojanDownloader.Win32.Swizzor.q" Virus. Action Taken: No Action Taken.

Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it.

Start Killbox, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\Program Files\install.exe
C:\Program Files\MyWay\myBar\3.bin\MY2NS.EXE
C:\Program Files\MyWay\myBar\3.bin\NPMYWAY.DLL
C:\Program Files\Startenc1\2639.exe
C:\Program Files\Startenc1\forkford.dll
C:\WINDOWS\63vqBmw.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\on-line.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\on-line.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\on-line.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\on-line.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\on-line.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.6\on-line.exe
C:\WINDOWS\Downloaded Program Files\d_coolx.exe
C:\WINDOWS\Downloaded Program Files\instafin.dll
C:\WINDOWS\Downloaded Program Files\on-line.exe
C:\WINDOWS\fixit.exe
C:\WINDOWS\System32\14yf08fg.exe
C:\WINDOWS\System32\angelex.exe
C:\WINDOWS\System32\ATPartners.dll
C:\WINDOWS\System32\bridge.dll_tobedeleted
C:\WINDOWS\system32\exdl0.exe
C:\WINDOWS\system32\exdl2.exe
C:\WINDOWS\System32\iehost34.exe
C:\WINDOWS\system32\maxspeed.exe
C:\WINDOWS\system32\nvms.dll
C:\WINDOWS\System32\optimizer.exe
C:\WINDOWS\System32\ozhnkd.exe
C:\WINDOWS\System32\ozhnkf.exe
C:\WINDOWS\system32\r.exe
C:\WINDOWS\System32\TVM_B5_Bundle_34.EXE
C:\WINDOWS\System32\WebRebates_Broadspring1_InstallAS.exe
C:\WINDOWS\system32\wsaupdater.exe
C:\WINDOWS\UnstSA2.exe
C:\WINDOWS\win32.bmp

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Reboot if it doesn't automatically and you should be good to go. Let me know how it's running.

Sorry, I have just realised that Ad-Aware SE and eScan are both still running - they hadn't finished when I pasted the log. Shall I let them finish or cancel one and let the other finish before I do anything? I have had to cancel the Adaware scan as it had stopped responding. However eScan is still going. I'll wait until the end and then paste you a new log.

OK, I will just add any additional files to my previous reply.

It's been going for 1 hour 52 mins and has scanned 63,000-odd files - less than half of the total. It has reported 109 viruses so far. It looks as if it will take some time. Thanks for your patience. What time do you log off?