We can try to help...but the about:blank home page hijacker variant is at present without an automated solution. There is a manual fix, but it is very hard.
At bleepingcomputer.com start reading at the section that says:
You can download this program here: CWShredder
(Note...we have noticed recently some CWS variants are harder to remove unless the shredder is run in Safe Mode...hit F8 while booting to enter Safe Mode and run the shredder.)
After cleaning with the shredder in Safe Mode do this:
Reboot if asked by either program and let it complete any cleanup. Then reboot a final time after running both and run Windows Disk Cleanup: Start/Run/ type: cleanmgr
I check all the categories to be deleted here.
Then reboot and make a new C:\HJT folder. Your present folder is a bad place to run Hijackthis as backup logs will be in a precarious location for safety. Follow my directions here for relocating your Hijackthis file:
Open Windows Explorer: type the word explorer at Start/Run box and click OK:
Drill down and delete the following:
C:\WINDOWS\cjlarklc.exe file C:\WINDOWS\Wast.exe file C:\WINDOWS\System32\djnkp.dll file C:\WINDOWS\Downloaded Program Files\bridge.dll file
Reboot in normal mode after running the deletions and run Windows Disk Cleanup again: Start/Run/ type: cleanmgr
Post back with a new log as a reply to this message (stay in this message posting thread for continuity). Most of your infections will be addressed with these tools, but you must follow the directions exactly to make final manual cleanup easier.
Texruss
3.4K Posts
0
April 26th, 2004 23:00
We can try to help...but the about:blank home page hijacker variant is at present without an automated solution. There is a manual fix, but it is very hard.
Let's see what we can do:
Get CW Shredder to repair your CoolWebSearch infestation:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip version 1.57
Follow the directions for running the program at the next link.
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47
At bleepingcomputer.com start reading at the section that says:
You can download this program here: CWShredder
(Note...we have noticed recently some CWS variants are harder to remove unless the shredder is run in Safe Mode...hit F8 while booting to enter Safe Mode and run the shredder.)
After cleaning with the shredder in Safe Mode do this:
Download and run these two programs (Spybot S&D and Adaware). Use Spybot first. (1.3 version)
http://www.majorgeeks.com/download2471.html
Follow the directions completely at:
http://www.cjwd.demon.co.uk/spybot-adaware.html
Reboot if asked by either program and let it complete any cleanup. Then reboot a final time after running both and run Windows Disk Cleanup: Start/Run/ type: cleanmgr
I check all the categories to be deleted here.
Then reboot and make a new C:\HJT folder. Your present folder is a bad place to run Hijackthis as backup logs will be in a precarious location for safety. Follow my directions here for relocating your Hijackthis file:
http://russelltexas.com/spywareinfo/createhjtfolder.htm
In Hijackthis do a new scan and check the following items if still present:
C:\WINDOWS\cjlarklc.exe
C:\WINDOWS\Wast.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\djnkp.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\djnkp.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [nnqbsnhf] C:\WINDOWS\cjlarklc.exe
O4 - HKLM\..\Run: [Wast] C:\WINDOWS\Wast.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/budicon.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
With no other browsers or windows open (only Hijackthis) click fix checked.
Reboot to SAFE mode
How to start the computer in Safe mode
Open Windows Explorer: type the word explorer at Start/Run box and click OK:
Drill down and delete the following:
C:\WINDOWS\cjlarklc.exe file
C:\WINDOWS\Wast.exe file
C:\WINDOWS\System32\djnkp.dll file
C:\WINDOWS\Downloaded Program Files\bridge.dll file
Reboot in normal mode after running the deletions and run Windows Disk Cleanup again: Start/Run/ type: cleanmgr
Post back with a new log as a reply to this message (stay in this message posting thread for continuity). Most of your infections will be addressed with these tools, but you must follow the directions exactly to make final manual cleanup easier.
HTH,
Texruss