about::blank homepage hijack help

[castlef]

HEllo

I usually try to fix these things before I post or help. I found a good guide : http://computercops.biz/postitle56914-0-0-.html .... but I have a problem.....

WHen I run Hijack this I delete all entries with sp.html.... and I delete the filed called BHOno name) - {AA491f48-0d......} C:\Windows\system32\ntlw32.dll




WHen i delete these files the problem goes away maybe for 10 minutes and the comes back. From reading that article im aware that this is because there is another dll file that is the primary one that causes this. The name of the primary DLL file is suppose to be

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\

and there is supposed to be something called: "AppInit_DLLs"

but all i see is:

(default) (value not set)
DeviceNotselectedtimeout 15
GDIprocesshandlequota 10000(ox2710)
spooler yes
transmissionretrytimeout 90
userprocesshandlequoata 10000(ox2710)

I do not see anything called Appinit_dll in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\(default)

This is windows xp any help appreciated

[mikezel]

I'm not sure if you've tried this method, but Panama Red posted one a while back:
http://forum.pcmech.com/showthread.p...=about%3Ablank

Scroll to the last post of the thread and download Panama Red's guide. See if that helps you.

Mike

[castlef]

Originally Posted by mikezel I'm not sure if you've tried this method, but Panama Red posted one a while back: http://forum.pcmech.com/showthread.p...=about%3Ablank Scroll to the last post of the thread and download Panama Red's guide. See if that helps you. Mike

quoted from Panamas guide:

1) With “Reglite.exe” find name of hidden file:

Double Click on “AppInit_DLLs” located in
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\”
The “value” window reveals the hidden file name.
(mine was “hlpl.dll”, yours may be different!)
In this example let’s call it “hidden.dll”

I dont see anything called Appinit+dlls in there... i can post a screenshot if it helps.. but thanks for the help