ive read through other topics and havent gotten it to work, ive ran the cwshredder 
and it always comes back, and here is my hijackthis log(if there are any other things 
on there that i dont need, please let me know which ones to remove, thanks):

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ron\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 216.40.230.4 desktop.kazaa.com
O1 - Hosts: 216.40.230.4 alpha.kazaa.com
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx
O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE 
/run
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O8 - Extra context menu item: Download with IDM - C:\PROGRA~1\INTERN~2\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Nocs Bar (HKLM)
O9 - Extra 'Tools' menuitem: Nocs Bar (HKLM)
O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and 
Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup 
Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37871.9656134259
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Tip: Run a free scan for common Windows errors ad

re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 4:13 am Posted by Jazz (2029 messages posted) http://annoyances.org/exec/forum/winxp/1082849458 And people wonder why they have problems when they use KaZaA! On Sunday, April 25, 2004 at 2:08 am, rons wrote: >ive read through other topics and havent gotten it to work, ive ran the cwshredder >and it always comes back, and here is my hijackthis log(if there are any other things >on there that i dont need, please let me know which ones to remove, thanks): > >Running processes: >C:\WINDOWS\System32\smss.exe >C:\WINDOWS\system32\winlogon.exe >C:\WINDOWS\system32\services.exe >C:\WINDOWS\system32\lsass.exe >C:\WINDOWS\system32\svchost.exe >C:\WINDOWS\System32\svchost.exe >C:\WINDOWS\system32\spoolsv.exe >C:\WINDOWS\Explorer.exe >C:\Program Files\AVPersonal\AVWUPSRV.EXE >C:\WINDOWS\System32\svchost.exe >C:\Program Files\Internet Explorer\iexplore.exe >C:\Documents and Settings\ron\Desktop\HijackThis.exe > >R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = >R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm >R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank >R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) >O1 - Hosts: 216.40.230.4 desktop.kazaa.com >O1 - Hosts: 216.40.230.4 alpha.kazaa.com >O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll >O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx >O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) >O4 - HKLM\..\Run: [SystemTray] SysTray.Exe >O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe >O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE >/run >O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto >O8 - Extra context menu item: Download with IDM - C:\PROGRA~1\INTERN~2\IEExt.htm >O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 >O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) >O9 - Extra button: Nocs Bar (HKLM) >O9 - Extra 'Tools' menuitem: Nocs Bar (HKLM) >O9 - Extra button: AOL Instant Messenger (TM) (HKLM) >O9 - Extra button: Messenger (HKLM) >O9 - Extra 'Tools' menuitem: Messenger (HKLM) >O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and >Media Control) - http://office.microsoft.com/templates/ieawsdc.cab >O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab >O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab >O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab >O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup >Player) - http://www.installengine.com/engine/isetup.cab >O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37871.9656134259 >O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab > [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 4:41 am Posted by triplate (20745 messages posted) Nother Kazza Kowboy..... On Sunday, April 25, 2004 at 4:13 am, Jazz wrote: > > >http://annoyances.org/exec/forum/winxp/1082849458 > >And people wonder why they have problems when they use KaZaA! > > >size=+2 color=#990000> > > [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 4:46 am Posted by Jazz (2029 messages posted) Hey.........Good morning @ 04.43hrs! Yeah, another one! On Sunday, April 25, 2004 at 4:41 am, triplate wrote: >Nother Kazza Kowboy..... > > > [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 6:05 am Posted by phantom (5587 messages posted) See if you can get help at Kazaa!!!!!!!!!!!!!! On Sunday, April 25, 2004 at 2:08 am, rons wrote: >ive read through other topics and havent gotten it to work, ive ran the cwshredder >and it always comes back, and here is my hijackthis log(if there are any other things >on there that i dont need, please let me know which ones to remove, thanks): > >Running processes: >C:\WINDOWS\System32\smss.exe >C:\WINDOWS\system32\winlogon.exe >C:\WINDOWS\system32\services.exe >C:\WINDOWS\system32\lsass.exe >C:\WINDOWS\system32\svchost.exe >C:\WINDOWS\System32\svchost.exe >C:\WINDOWS\system32\spoolsv.exe >C:\WINDOWS\Explorer.exe >C:\Program Files\AVPersonal\AVWUPSRV.EXE >C:\WINDOWS\System32\svchost.exe >C:\Program Files\Internet Explorer\iexplore.exe >C:\Documents and Settings\ron\Desktop\HijackThis.exe > >R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = >R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm >R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank >R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) >O1 - Hosts: 216.40.230.4 desktop.kazaa.com >O1 - Hosts: 216.40.230.4 alpha.kazaa.com >O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll >O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx >O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) >O4 - HKLM\..\Run: [SystemTray] SysTray.Exe >O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe >O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE >/run >O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto >O8 - Extra context menu item: Download with IDM - C:\PROGRA~1\INTERN~2\IEExt.htm >O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 >O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) >O9 - Extra button: Nocs Bar (HKLM) >O9 - Extra 'Tools' menuitem: Nocs Bar (HKLM) >O9 - Extra button: AOL Instant Messenger (TM) (HKLM) >O9 - Extra button: Messenger (HKLM) >O9 - Extra 'Tools' menuitem: Messenger (HKLM) >O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and >Media Control) - http://office.microsoft.com/templates/ieawsdc.cab >O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab >O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab >O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab >O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup >Player) - http://www.installengine.com/engine/isetup.cab >O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37871.9656134259 >O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab > [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 6:27 am Posted by Jazz (2029 messages posted) Nice touch phantom.......... On Sunday, April 25, 2004 at 6:05 am, phantom wrote: > >See if you can get help at Kazaa!!!!!!!!!!!!!! > > > > > [Reply or follow-up to this message] re: We keep pitching them but they keep ducking them... Sunday, April 25, 2004 at 6:45 am Posted by Michael McMillan (811 messages posted) No one really wants to listen. The pull for free music is too strong, and the fact that it's stealing doesn't bother them. Still, for those where it may not yet be too late, here we go yet again: http://users.sisna.com/mjmcmillan/myweb2/P2P.htm [Reply or follow-up to this message] re: We keep pitching them but they keep ducking them... Sunday, April 25, 2004 at 6:51 am Posted by Jazz (2029 messages posted) Unfortunately, you have a valid point there Michael. Dangle a carrot in front of a donkey and what do you get............... On Sunday, April 25, 2004 at 6:45 am, Michael McMillan wrote: >No one really wants to listen. The pull for free music is too strong, and the fact >that it's stealing doesn't bother them. > >Still, for those where it may not yet be too late, here we go yet again: > > > > > >http://users.sisna.com/mjmcmillan/myweb2/P2P.htm [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 8:09 am Posted by rons (5 messages posted) have you ever thought that maybe im trying to get help removing all this stuff?? wow people...., i thought this was a friendly place when i was reading through the other threads. and i got not one bit of help here [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 8:16 am Posted by jaf (3408 messages posted) KazaaBegonel On Sunday, April 25, 2004 at 8:09 am, rons wrote: >have you ever thought that maybe im trying to get help removing all this stuff?? >wow people...., i thought this was a friendly place when i was reading through the >other threads. and i got not one bit of help here [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 8:34 am Posted by Jazz (2029 messages posted) With all due respect, this is an anti KaZaA and p2p forum. In addition, it is also a very friendly forum dealing with XP OS related annoyances, not third party applications. Furthermore, the mentality of KaZaA users, and p2p users in general, amazes me. You are downloading programs, movies, whatever, from people you do not even know. And, with all due respect, the majority of these users do not even have AV or Firewalls installed on their systems. IMO, it is like participating in an orgy and not wearing a condom. I will not even go through the additional fact, that it is blatant theft. BTW, Tom Swanson gave you sound advice, verbatim, "Fix your home page entries in the register. Delete all Kazaa garbage (that mean all Kazaa) as well as any other P2P entries. Download Spybot S&D, update and run. Install a good firewall and av. Disable System Restore, run av and Spybot and remove everything they point to. Turn on your System Restore again. Then stay away from the P2P sites". I also gave you a link to Tom's initial response! Also, jaf has given you advice as well. All in all, you have received more constructive advice than mostp2p users. On Sunday, April 25, 2004 at 8:09 am, rons wrote: >have you ever thought that maybe im trying to get help removing all this stuff?? >wow people...., i thought this was a friendly place when i was reading through the >other threads. and i got not one bit of help here [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 9:01 am Posted by Michael McMillan (811 messages posted) The problem is, there's not much help we can give you beyond the obvious. Download and run Spybot S&D, D/L and run CWShredder, keep your antivirus and firewall software up-to-date, and get rid of P2P programs. One more thought: Before running any of these programs, turn off System Restore. S/R gives bad guys a place to hide while you're trying to clean them out, by turning it off you remove a hiding place. Remember to turn it on again after you've cleaned your system, and you're sure it is, indeed, clean. No advice we can give you will help as long as Kazaa is on your system, serving as an open doorway to every miscreant who wants to take over your system. That, and porn sites, are the two primary ways of non- email attachment infection these days. [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 9:22 am Posted by triplate (20745 messages posted) Ron...please understand that most that post about kazza are all proud of their accomplishment...and defend it too the bitter end.We get these all the time, and after a while..we too, get defensive...As Jaf offered..run KazzaBeGone...that should clean up the mess, however..you may need to "repair" a few things after that...feel free to ask ,and be specific...it helps us diagnose your concerns more efficiently...;) triplate... On Sunday, April 25, 2004 at 8:09 am, rons wrote: >have you ever thought that maybe im trying to get help removing all this stuff?? >wow people...., i thought this was a friendly place when i was reading through the >other threads. and i got not one bit of help here [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 11:33 am Posted by Ms. Eagle (33507 messages posted) First thing, move Hijack This into a folder somewhere; it creates backups. Run HIjack This again. Select these entries. Press Fix Checked. Reboot. R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 216.40.230.4 desktop.kazaa.com O1 - Hosts: 216.40.230.4 alpha.kazaa.com O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) Clear out your browser cache and other temp files. Also, go to Start - Find - Files or folders - in the named box, type: *.tmp and choose Edit - select all - File - delete. Empty Recycle bin. Download this .reg file to your Desktop. Double-click on it and answer Yes, to merge into your registry. It will restore all the default Search settings for IE. IEFIX.reg I recommend installing SpywareBlaster to block bad ActiveX Control installs, in addition to other features included. Be sure to check for and download updates after installing it, and frequently thereafter. SpywareGuard is available here also: SpywareBlaster Carol [Reply or follow-up to this message] re: i need help removing about:blank homepage Sunday, April 25, 2004 at 11:50 am Posted by Ms. Eagle (33507 messages posted) FYI, I hadn't noticed you had another thread directly below this one. There was no need to start a new thread to repost your message with correct formatting. You should have reposted it in previous thread. Carol [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 11:54 am Posted by Webtrooper (3 messages posted) I use kazza lite, np. On Sunday, April 25, 2004 at 4:13 am, Jazz wrote: > > >http://annoyances.org/exec/forum/winxp/1082849458 > >And people wonder why they have problems when they use KaZaA! > > >size=+2 color=#990000> > > [Reply or follow-up to this message] re: i need help removing about:blank homepage (ignore other post) Sunday, April 25, 2004 at 12:02 pm Posted by Jazz (2029 messages posted) Oh, how many times have I heard that one before and then helped to remove the mess it had created. Do you not realize, as well as the bundled software, the applications, movies, music, etcetera, that you dl, are prone to virii, spyware, adware, trojans and goodness knows what else. As per Michael McMillan, http://users.sisna.com/mjmcmillan/myweb2/P2P.htm. Read and absorb. Your choice at the end of the day. On Sunday, April 25, 2004 at 11:54 am, Webtrooper wrote: >I use kazza lite, np. > > > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows XP Discussion Forum