blank box on startup

[1sleeper]

Hello, was wondering if anyone had a fix for this. I get a blank window on startup with ok on the bottom. I can't "x" it out, but if I click "ok" it finishes booting to the desktop. I have removed all spyware and virus' but it seems this is left behind. My windows firewall wasn't working but I just fixed that hoping they were related. I got one clean boot but the blank box is back. Sometimes it says windows/system32 and then some archives at the top of the box. It is winXP sp2 and fully up to date.
I had a ton of file extension problems after that I had to repair (.bat ,.exe associations) and have been running ok for about 4 months with the occasional program (exe) problem requiring reboot but the blank box has always been there.
Any help would be awesome. Thanks.
Jim
Hijack file:

 

[howard_hopkinso]

Hello and welcome to Techspot.

I can`t see anything nasty in your HJT log. However, go and read this thread HERE, then post a fresh renamed HJT log as an attachment.

Regards Howard :wave: :wave:

 

[1sleeper]

Thanks and sorry bout that. Won't happen again.

 

[howard_hopkinso]

This is taken from your HJT log.

C:\Documents and Settings\User\Desktop\must folder\Virus Fix\HijackThis.exe

As you can see, you have not renamed the HijackThis.exe file as per the instructions, nor have you placed HJT in the proper location. Go back to the link I gave you and follow the instructions exactly, then post a fresh HJT log.

Regards Howard

 

[1sleeper]

Busted.
Thanks for being patient. I actually did do that but they looked exactly the same so I posted the first one.

 

[howard_hopkinso]

Your HJT log is clean.

Try this on order to stop the Window from opening on bootup.

Click start/Run and type regedit into the run box and press the enter key.

Navigate to the following registry key.

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon

In there there should be a value (on right hand side of screen) called Userinit.

The data for this value is probably something similar to:

C:\windows\system32\userinit.exe,C:\windows\system32\userinit.exe,

If you do see a duplicated string in there similar to the above - simply double click on the Userinit value and edit the data so as to delete everything to the right of the first comma (,). In the case above you would leave only:

C:\windows\system32\userinit.exe,

Exit registry edit and reboot.

Let me know if that helps. If it doesn`t, please give me full details of the window that opens on bootup, maybe a screen shot?

Regards Howard

 

[1sleeper]

Unfortunately, the userinit was C:\windows\system32\userinit.exe,
Here is a screen shot.
Thanks Howard

 

[howard_hopkinso]

Mmm, give this a try.

Cick start/run and type msconfig into the run box and press the enter key. When the window appears, click the startup tab. Look for anything you don`t recognise and untick the checkbox next to that entry. Click apply/ok and reboot your computer. Once you computer has rebooted, you will see a window that says you have used msconfig to make changes etc. Tick the box that says not to run msconfig the next time you start your system.

See if that helps.

Regards Howard

 

[1sleeper]

I unchecked one of three, the other two were adobe and ad-watch.
No change upon two reboots.
Thanks Howard

 

[howard_hopkinso]

This has got me a little stumped I`m afraid. Try this. Open my computer and click the tools menu and select folder options. Click the view tab and scroll down until you see "Restore previous folder windows at logon" Make sure the check box next to that entry is unticked, click apply ok and reboot your computer. See if that helps and let me know.

Regards Howard

 

[1sleeper]

it was not checked.

 

[howard_hopkinso]

Go HERE and follow the instructions for downloading, installing and running AVG Antispyware. Post an AVG Antispyware log when done.

Download the Autoruns programme from HERE. When the programme runs, click options and make sure the "Hide Microsoft Entries" is ticked. Click the file menu and select refresh. Click the save icon and save the Autoruns log to wherever you want.

Attach the Autoruns log here.

Regards Howard

 

[1sleeper]

Here goes.
AVG was clear
Thanks for the persistance Howard.
Jim

 

[howard_hopkinso]

Your Autoruns log doesn`t show anything that jumps out at me.

It appears you`ve posted an AVG antivirus log, rather than an AVG Antispyware log. Note: These are two completely different programmes. See this pictorial guide to AVG Antispyware.

Regards Howard

 

[1sleeper]

I had run SS&D and it removed a few threats.
Then I ran the AVG and it removed 70ish cookies and a sherriff.

 

[howard_hopkinso]

That all seems fine.

This is my very last suggestion.

Download and run these four tools. Follow the instructions for using each tool.

Tool1 Tool2 Tool3 Tool4

Let me know the results.

Regards Howard

 

[1sleeper]

nothing to report box is still there.
Thanks for trying, it was very nice of you Howard.
The top of the box had this the last time:
睈ᓐ
Ɛ i740dnt5.dll

And any idea how I can get rid of about:blank as my home page?

 

[howard_hopkinso]

Have HJT fix these two entries.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

Reboot your system, then set whatever home page you want.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

See if you can find the Ɛ i740dnt5.dll file. It may be in the C:\windows\system or system32 folders.

If you find it, try and delete it.

Rehide your protected OS files and reboot your system again.

Regards Howard

 

[1sleeper]

I couldn't find the file and about:blank was still there after reboot.
This thing needs a clean install but it's hard for me to backup 80g.
The window appeared with c:\windows\system32\drivers\mf.sys
I have no such file.

 

[howard_hopkinso]

That`s quite interesting.

mf.sys is an important Microsoft file.

Name Mf.sys
Size (bytes) 62.208
Version 5.1.2600.0 (xpclient.010817-1148)
Company Microsoft Corporation
Description Multifunction Enumerator

Click start/run and type sfc /scannow into the runbox and press the enter key. Windows will now scan for and attempt to replace and damaged or missing system files. You will need to have your Windows cd handy.

If that doesn`t help, then doing a Windows repair as per this thread HERE might.

Regards Howard

 

[1sleeper]

Thanks Howard. I can't find my windows cd so I haven't been able to try. Funny how every other disk I ever bought is there.
Thanks for all the help.
Jim