Jump to content


Photo

CWS shredder doesn't remove CWS varient


  • Please log in to reply
1 reply to this topic

#1 baps

baps

    Member

  • New Member
  • Pip
  • 1 posts

Posted 14 July 2004 - 06:09 PM

Hi guys,

Had about enough of this particular varient of CWS, I've tied Spybot search and destroy, CWS shredder, Adaware and a couple other smaller apps to try to get rid of it but no joy.

CWS shredder does remove it but then continues to restore 3 web pages (?) which then cause a registry entry to be entered which reinfects IE after opening it. BHOCop can identify a dll in the system32 directory which coincides with this reinfection as well as the registry entry which reappears when CWS shredder restores these pages but after removing these and their corresponding registry entries spybot still recognises a "common hijacker". Removing this cleans IE for a short time but it still reappears.

I've had enough of IE, just completely ditched it now but the ads still appear. Just wondering if anyone could suggest any further actions before I format.

Any suggestions welcomed.

Baps.

Ps. I'm running Windows 2000 Sp4. Please let me know what other info I need to include.

#2 PGPhantom

PGPhantom

    Superman of SWI

  • Emeritus
  • PipPipPipPipPip
  • 3,494 posts

Posted 31 August 2004 - 11:06 AM

  • HijackThis ...
    • Double click on "My Computer" to open it.
    • Double click on the local "C-Drive" to open it.
    • Click on "File" => "New Folder" and name it HJT. i.e. The folder will be C:\HJT.
    • Please download HijackThis from any of the following locations:
    • spywareinfo.com
    • subratam.org
    • tools.zerosrealm.com
  • Install/Unzip it into C:\HJT.
  • Only run HijackThis from C:\HJT\HijackThis.exe. That way we can ensure that we have the backup files available in the event that they are needed.
  • Run HijackThis, click on scan and wait for the scan to finish.
  • The "Scan" button will change to "Save Log", click on it and simply press "Save" on the window that will appear.
  • Notepad will open with a copy of the log.
    • Click on "Edit" => "Select All".
    • Click on "Edit" => "Copy". This will copy the contents of the Notepad instance to the clipboard.
  • Please post your entire log here for analysis.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button