|...Variant 10: CWS.Ctfmon32|
Approx date first sighted: September 22, 2003
Symptoms: Start page and Search pages changed to www.slawsearch.com, 'Customize Search Assistant' closing after opening it, hijack coming back after a reboot.
Manual removal difficulty: Involves some Registry editing
This variant surfaced after a quiet time. CWShredder could fix it, but it would return after rebooting the computer. Apart from the new filename 'CTFMON32.EXE' (note that 'CTFMON.EXE' is the real Windows system file) it worked pretty much the same way as CWS.Bootconf: the file loads at startup, resetting homepages and search pages, and then closes. Deleting the file and changing everything back to normal fixes it
"...pentathol makes you sing like a canary"
... got brain freeze