Tom's Guide | Tom's Hardware | Tom's Games

Computing.Net > Forums > Windows XP > CWS is unbeatable :|

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

CWS is unbeatable :|

Reply to Message Icon

Name: Pleo
Date: December 1, 2003 at 15:16:18 Pacific
OS: XP home
CPU/Ram: 1500Mhz/256mbs
Comment:

Alright. I have searchdot.net as well, including times that it changes to search.com and allneedsearch and others.
I have done all the stuff listed above, dug through registry, changed stuff and deleted MSoffice.hta, to the dot. However i still have this damn bug. Unfortanitly now, not sure if it is from this, when i am online i am auto forwarded to various porn sites.
Can anyone offer sum help on removing this?

This is my hijack this log:

Logfile of HijackThis v1.97.3
Scan saved at 5:11:10 PM, on 01/12/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PestPatrol\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Internet Explorer\IEXPLORE.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Jonathon\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allneedsearch.com/spm.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allneedsearch.com/spm.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allneedsearch.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://allneedsearch.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allneedsearch.com/spm.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://allneedsearch.com/spm.htm
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37955.7448611111
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

i really need this cleared up, all help will be greatly appreciated




Sponsored Link
Ads by Google

Response Number 1
Name: gabep
Date: December 1, 2003 at 15:20:33 Pacific
Reply:

Go google and get CWSHREDDER. Rgds


0

Response Number 2
Name: iceblue
Date: December 1, 2003 at 15:25:23 Pacific
Reply:

heh heh I know what you mean !

OK, follow the prompts, (am out of office and don't have full access.

Download and run Spybot Search & Destroy.
Download and run CWS Shredder.
http://www.spywareinfo.com/~merijn/
Scan with HJT again and repost the log here.



0

Response Number 3
Name: fredf
Date: December 1, 2003 at 15:29:33 Pacific
Reply:

http://www.mvps.org/inetexplorer/Darnit.htm#datanotary


0

Response Number 4
Name: iceblue
Date: December 1, 2003 at 15:32:26 Pacific
Reply:

(by the guy that wrote it/who is also good mates with team spybot)

CoolWebShredder
A small utility for removing CoolWebSearch (aka CoolWwwSearch, YouFindAll, White-Pages.ws and a dozen other names). Spybot S&D tends to forget essential parts of the hijack, so until it updates, you can just this to completely remove the hijack. Updated to remove the new variants once they come out.
Currently changing versions at the speed of light>>>

http://www.spywareinfo.com/~merijn/files/cwshredder.zip


0

Response Number 5
Name: Pleo
Date: December 1, 2003 at 15:54:45 Pacific
Reply:

ok. Forgot to say this:
i have used:

Spybot search and destroy
Adaware
SpySweeper
Hyjackthis
Pestpatrol
AND the CWShredder

None have worked as of yet. Almost like i am forgeting something. After running them and cleaning out hyjack this, here is my new log:

Logfile of HijackThis v1.97.3
Scan saved at 5:52:36 PM, on 01/12/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PestPatrol\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\PestPatrol\PestPatrol.exe
C:\Program Files\Internet Explorer\IEXPLORE.exe
C:\Documents and Settings\Jonathon\My Documents\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\PestPatrol\ppclean.exe" " clean lop 2"
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37955.7448611111
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab


0

Related Posts

See More



Response Number 6
Name: iceblue
Date: December 1, 2003 at 16:06:56 Pacific
Reply:

Is the CWShredder version a very recent download...it needs to be...
(still looking at log)


0

Response Number 7
Name: Pleo
Date: December 1, 2003 at 16:10:53 Pacific
Reply:

Just got it 2 days ago


0

Response Number 8
Name: Pleo
Date: December 1, 2003 at 16:11:44 Pacific
Reply:

Just got it 2 days ago


0

Response Number 9
Name: Iceblue
Date: December 1, 2003 at 16:21:42 Pacific
Reply:

Let us know what symptoms are still showing up on your PC, as that is important to know.....

and then again; could you possibly be getting re-infected?
I would be checking this and fixing:
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

This is a resource hog:
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe
tbc


0

Response Number 10
Name: iceblue
Date: December 1, 2003 at 16:28:51 Pacific
Reply:

HijackThis version is currently 1.97.7 or was last ime I looked.... needs a new download and rescan....

wrt re-infection:

I notice your OS is not SP1.
Pls make sure you have all patches updated.

CoolWebSearch is part of a new strain of trojans that have recently been identified that all have one thing in common: they install through the ByteVerify <http://www.microsoft.com/technet/security/bulletin/MS03-011.asp> exploit in the MS Java VM and change the IE homepage, search page, search bar, etc.
If you have Windows XP with Service Pack 1a, your system has no MS Java VM.
Java removal
http://www.winnetmag.com/Article/ArticleID/38206/38206.html
some of the affiliates (Search-Meta has been verified) use another Java exploit to install their malware. It's classified as the JS.Exception.Exploit <http://www.symantec.com/avcenter/venc/data/js.exception.exploit.html>, and a patch can be downloaded from this MS security bulletin <http://www.microsoft.com/technet/security/bulletin/ms00-075.asp>.

ie. get patched, ok....this sucker is beatable, you know..


0

Response Number 11
Name: tinner666
Date: December 1, 2003 at 17:22:27 Pacific
Reply:

I'm a newbie, but I know that some of %$#%%% have to be gotten at by turning restore off, and even going into safemode to eradicate them. Also get spywareblaster. Also delete file before closing IE.Closing IE before clearing files acts like a restart to some of them waiting in temp folders.Frank


0

Response Number 12
Name: iceblue
Date: December 1, 2003 at 18:29:52 Pacific
Reply:

Good points Frank - love spywareblaster & spywareguard...

but slaps forehead !
Can't see any NVidia programs running (video card) - why is nvsvc.exe there??? It's rated as problematic anyway...(by Answers That Work)

next step:
Delete C:\WINDOWS\System32\nvsvc32.exe
Close all browsers;
turn off system restore;
reboot;
rescan with Hjt 1.97.7
and repost log.



0

Response Number 13
Name: blender
Date: December 2, 2003 at 11:20:31 Pacific
Reply:

Pleo

I notice you also have 2 antivirus programs running which will cause conflicts. I can't see any problem having 2 av programs...just have one of them running at a time.


0

Response Number 14
Name: Pleo
Date: December 3, 2003 at 15:15:02 Pacific
Reply:

Ok. after like 3 months of this bug, it is gone, all i had to do was update windows to keep it from getting in again. thanks to everyones help, this buggar is finaly gone :D


0

Response Number 15
Name: iceblue
Date: December 3, 2003 at 15:33:07 Pacific
Reply:

Final Score:

Pleo 1 ; CWS zip

Pleo wins by persistence!
:D

remember to get spywareblaster & spywareguard......


0

Sponsored Link
Ads by Google
Reply to Message Icon



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows XP Forum Home


Sponsored links
Ads by Google


Results for: CWS is unbeatable :|
Norton Personal Firewall www.computing.net/answers/windows-xp/norton-personal-firewall/52271.html

ClarisWorks compatability www.computing.net/answers/windows-xp/clarisworks-compatability/18644.html

getting a new laptop! www.computing.net/answers/windows-xp/getting-a-new-laptop/109178.html