Finally Found the Problem........

Have had about 10 PCs where Spyware Blaster either will not run, or if it does, hangs on the updates. Thought the PCs were clean via HijackThis, Ad-Aware & Spybot, there was still something killing it, or at least preventing it from running properly. At first, I thought it was hosed sys files, so I ran SFC /SCANNOW (should do this anyway, regardless), no dice, tried netsh int ip reset - while it cleaned up lots, no dice. I tried MSISTORE start.chm fix by Shadowwar, and although it did not find anything to fix, it did produce an interesting file ctla.dll. Google turned up very little on ctla.dll, though I got enuf from one site to realize that it is part of the oldhome.sp blank infection. I found a neat utility call SPHjFix.exe from www.Trojaner-info.de (www.rokop-security.de) coded by Seeker, that fixed the problem right up. After using this utility on 9 PCs where SpywareBlaster would not run or would hang, it ran just fine.

It is interesting that the file resides in the registry.

I realize that the SPHijack comes in many, many flavors, and what these PCs had may not be what others have - usually Ad-Aware, HijackThis & SpyBot do the trick.

Not sure if this is of help to anyone, but hey - it has solved a big headache for me.

If you want the various registry hacks to manually remove this beastie, send an e-mail to colonelcr(remove this!)@yahoo.com

Thanks to javacoolsoftware for an excellent product.

 

I'm happy to know it worked for you. I am still unable to download updates to SpywareBlaster and all I get is the same error message when trying to connect to the update server. I tried to run SPHjFix.exe and it found no infection on my computer. Others here have also posted to ask why the updater won't work anymore. I believe there is another problem - maybe limited bandwidth on the download server? or a bug in SB?
It cannot be the recent XP security update because I haven't downloaded it yet (not yet available in my language version of XP). Nor can it be running the application from a limited user account because mine has admin rights (possible cause suggested by javacool himself in another thread).

 

It's not the server or a bug in SWB - it's working fine on all 3 of my machines - 2 XP and one Win2k.