This is a cut and paste from a notepad file a friend sent me, he had murder trying get rid of about blank from a customers machine. I have not tried this myself but I know a few who have and they say it has worked for them.
Please read it very carefully as it involves registry editing and one mistake in the registry can crash your OS.
Quote:
Programs Needed:
Reglite.exe
(available at “ http://www.resplendence.com/download/reglite.exe ”)
Microsoft Recovery Console
(an option available on your Windows CD or root drive)
run “X:\i386\winnt32.exe /cmdcons”
where “X” is either CD drive letter or is “C” for your root.
HiJackThis.exe
(available at “ http://download.com.com/3000-2144-10227352.html ”)
There are two application extensions (.dll) files that
Need to be deleted. One is hidden (thanks Akadia!),
one is detected with “HiJackThis.exe”
1) With “Reglite.exe” find name of hidden file:
Double Click on “AppInit_DLLs” located in
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\”
The “value” window reveals the hidden file name.
(mine was “hlpl.dll”, yours may be different!)
In this example let’s call it “hidden.dll”
2) Rename the hidden file:
Close Windows and reboot using “Windows Recovery Console”
Go to “c:\Windows\system32\” and do two things.
Change file from read only by typing “attrib –r hidden.dll”
Then rename it (I don’t know why, but this procedure did not work
until I renamed it) type “rename hidden.dll nasty.dll”
(and remember that “hidden.dll” is for this explanation only
use the name you found earlier) Type “exit” and reboot to Windows.
3) Edit registry to remove hidden file
Run “reglite.exe” again.
Double Click on “AppInit_DLLs” located in
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\”
Delete the file in “value” window, the “size” window changes also.
“Apply” changes and exit “reglite.exe”
4) Edit registry to remove the second file
Run “HiJackThis.exe” and scan the registry.
Check the boxes to remove the following entries:
“R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\jheckb.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank”
(as you can see my second .dll was called “jheckb.dll” yours may be different) For this example let’s call it “obvious.dll”.
Finally delete the two .dlls (“hidden.dll” and “obvious.dll”)
You should be running again.
|