About.balnk browser hijacked. HJK log attached. Please help

[NJGUY]

My pc is all screwed up..My browser was hijacked by about.Blank also tons of pop ups. Also when going to certain websites I get kicked off the browser. Please help.. I ran all sorts of anti-virus-spyware. Attached is my HJK logfile, Let me know what I can do to kill it!
Thanks!!

 

[NJGUY]

Fresh Log file

I followed the directions and used cw shredder, adaware,spybot and than hijack this..I cleaned out what I found to be bad and just attached a fresh log file. I am still getting kicked off the browser when accessing certain websites and chat rooms. Any ideas.??

 

[ndparticlebeam]

about blank deletion

you need to get into the windows file - I would expect that you cannot open the control panel - but can use another program such as power desk. Go to the Windows directory and sort by SIZE - then scroll down and you will find a group of dll's, ALL with a size of 64K bites. Block and delete them ALL., then close and restart. ... this is an EVIL program.

 

[RealBlackStuff]

Move HJT to its own PERMANENT directory.
Boot in Safe Mode
Switch off System Restore
Press ctrl/alt/del and in taskmanager try to STOP: nardx32.exe

Next, run HJT on its own and let it fix:
C:\WINDOWS\System32\nardx32.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ag\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [e054RXNqg] nardx32.exe

When done, delete C:\WINDOWS\System32\nardx32.exe
Clean EVERYTHING from C:\DOCUME~1\ag\LOCALS~1\Temp
Boot normal.
When OK, restart System Restore

Maybe you should re-install your Avast?
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

Or was it due to the hijack? run HJT to see if that line is still there.