Jump to content


Photo

To everyone suffering CWS hijacking


  • Please log in to reply
6 replies to this topic

#1 Mayhem

Mayhem

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 25 June 2004 - 09:27 AM

It appears there is a S**T load of people getting this at the moment. Almost the posts today have been about it ;)

Anyhow... to save on time, effort and the whatnot, anyone who has successfully succeeded in removing it, please give details about how to do it, so anyone can follow? Maybe make this a sticky so new users can see it too? There seems to be a number of possible solutions based upon the depth of problem, so feel free to contribute any successful method so any can be tried :)

Symptoms: Search page on a blank IE boot.
Running HijackThis lists an sp.html file in the Registry, located somewhere
Running FindnFix locates a dll file that can't be opened, located in windows/system32
Varient of CoolWebSearch, probably CWSearch.X

#2 BobO

BobO

    Member

  • Full Member
  • Pip
  • 54 posts

Posted 25 June 2004 - 09:34 AM

I appear to have successfully removed CWSearchx from my Windows 98 system. Symptons were as you described. Shredder, Adaware, Hijack This, Spybot removed symptoms but not the core. The challenge was to identify and remove the hidden .dll that is activated on bootup.

See here for how it was done.

Good luck -- hope it works for you.

BobO

#3 cnm

cnm

    Mother Lion of SWI

  • Administrators
  • PipPipPipPipPip
  • 25,317 posts

Posted 25 June 2004 - 09:44 AM

Have you followed the fixed threads? The fix is rather complex for most and needs hand tailoring.

There are many threads - here's one picked more or less at random.
http://www.spywarein...wtopic=2986&hl=

Microsoft MVP Windows Security 2005-2006
How camest thou in this pickle? -- William Shakespeare:(1564-1616)
The various helper groups here
UNITE


#4 Mayhem

Mayhem

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 25 June 2004 - 10:08 AM

This is what I am saying... because if you see... just about everyone IS complaining about it... one place to get ALL solutions!

#5 cnm

cnm

    Mother Lion of SWI

  • Administrators
  • PipPipPipPipPip
  • 25,317 posts

Posted 25 June 2004 - 10:19 AM

All solutions will not work for all and there is some danger that damage could be done.

But members have posted "one size fits all" solutions - not guaranteed by SWI -
- Identified - and removed - the hidden startup CWS
- about:blank - information
and I seem to remember others.

Just about everyone who posts their problem here will eventually get helped, and it could be better to wait.

Microsoft MVP Windows Security 2005-2006
How camest thou in this pickle? -- William Shakespeare:(1564-1616)
The various helper groups here
UNITE


#6 cnm

cnm

    Mother Lion of SWI

  • Administrators
  • PipPipPipPipPip
  • 25,317 posts

Posted 25 June 2004 - 10:28 AM

Trustworthy advice can be found in this pinned topic:
All "Hijacked Users" - Please read this.

Microsoft MVP Windows Security 2005-2006
How camest thou in this pickle? -- William Shakespeare:(1564-1616)
The various helper groups here
UNITE


#7 Mayhem

Mayhem

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 26 June 2004 - 08:12 AM

FindNFix package... got rid of it for me so I think that's a good choice for people to use :)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button