3.4K Posts

April 26th, 2004 23:00

We can try to help...but the about:blank home page hijacker variant is at present without an automated solution. There is a manual fix, but it is very hard.

Let's see what we can do:

Get CW Shredder to repair your CoolWebSearch infestation:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip version 1.57

Follow the directions for running the program at the next link.

http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

At bleepingcomputer.com start reading at the section that says:

You can download this program here: CWShredder

(Note...we have noticed recently some CWS variants are harder to remove unless the shredder is run in Safe Mode...hit F8 while booting to enter Safe Mode and run the shredder.)

After cleaning with the shredder in Safe Mode do this:

Download and run these two programs (Spybot S&D and Adaware). Use Spybot first. (1.3 version)
http://www.majorgeeks.com/download2471.html

Follow the directions completely at:

http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot if asked by either program and let it complete any cleanup. Then reboot a final time after running both and run Windows Disk Cleanup: Start/Run/ type: cleanmgr

I check all the categories to be deleted here.

Then reboot and make a new C:\HJT folder. Your present folder is a bad place to run Hijackthis as backup logs will be in a precarious location for safety. Follow my directions here for relocating your Hijackthis file:

http://russelltexas.com/spywareinfo/createhjtfolder.htm

In Hijackthis do a new scan and check the following items if still present:

C:\WINDOWS\cjlarklc.exe
C:\WINDOWS\Wast.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\djnkp.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\djnkp.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O4 - HKLM\..\Run: [nnqbsnhf] C:\WINDOWS\cjlarklc.exe
O4 - HKLM\..\Run: [Wast] C:\WINDOWS\Wast.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/budicon.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab

With no other browsers or windows open (only Hijackthis) click fix checked.

Reboot to SAFE mode
How to start the computer in Safe mode

Open Windows Explorer: type the word explorer at Start/Run box and click OK:

Drill down and delete the following:

C:\WINDOWS\cjlarklc.exe   file
C:\WINDOWS\Wast.exe     file
C:\WINDOWS\System32\djnkp.dll     file
C:\WINDOWS\Downloaded Program Files\bridge.dll   file

Reboot in normal mode after running the deletions and run Windows Disk Cleanup again: Start/Run/ type: cleanmgr

Post back with a new log as a reply to this message (stay in this message posting thread for continuity). Most of your infections will be addressed with these tools, but you must follow the directions exactly to make final manual cleanup easier.


HTH,

Texruss

No Events found!

Top