Re: CoolWebSearch browser hijacker -- PCTECH

Try this utility
(http://www.intermute.com/spysubtract/cwshredder_download.html)
CWShredder is what I had to use to remove the spyware of my work PC.
It works great. This is a newwer updated version.


On Thu, 21 Oct 2004 12:48:37 -0400, Dan Bale <dbale@xxxxxxxxxxxxx> wrote:
> Wow, this one's a real b*tch!  It appears to also be known as the
> "about:blank" hijacker (since that is what the browser forces you to when
> you try to navigate).  My son offered to help a schoolmate with a problem
> with his XP Home box, and it has turned into a major project.  Neither
> SpyBot nor AdAware can fix the problem, although they recognize it and offer
> to fix it, the net result is that the hijacker returns.  The hijacker also
> has the nasty habit of throwing up a popup window warning that malware has
> been detected and "click here to remove".  I can only imagine that my son's
> friend already tried this "solution".
> 
> Googled on this, and got some interesting hits.  It appears to also be known
> as the "about:blank" hijacker (since that is what the browser forces you to
> when you try to navigate).  Is HijackThis legit?  It appears that this group
> uses the HijackThis analysis to determine how to manually delete this
> baddie.  Also found references to a few other downloads that attempt to
> delete it.  From my reading, it appears that this hijacker mutates, with
> file name changes that make it (near-) impossible to automatically delete.
> The manual instructions I found for someone else who posted in their forum
> says that boot into safe mode to run a special program that deletes certain
> files at next boot.
> 
> My son's friend has already indicated that he'd be willing to do an
> install-from-scratch to solve the problem.  Only thing is, is that he was
> unable to quickly locate the install CD that they should have gotten when
> they bought their Dell a few years ago.  Does Dell keep an install image in
> a hidden partition?  If so, anyone know how to reload from that?
> 
> Any other advice or suggestions welcomed.  Note: I have already installed
> SP2 and downloaded Firefox.  But IE is needed to do Windows Update.  Is
> there a link to Windows Update that is accessable from outside of IE?  Maybe
> this would be a way to defeat the hijacker?
> 
> tia,
> db
> 
> --
> This is the PC Technical Discussion for iSeries Users (PcTech) mailing list
> To post a message email: PcTech@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/pctech
> or email: PcTech-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/pctech.
> 


-- 
Mike Wills
Midrange Programmer/Lawson Administrator
koldark@xxxxxxxxx
http://www.koldark.net
Want Gmail? Email koldark+gmail@xxxxxxxxx to get on my waiting list.
<a href="http://www.spreadfirefox.com/?q=affiliates&amp;id=2483&amp;t=1";>Get
Firefox!</a>