1. CWS.Datanotary
2. CWS.Bootconf
3. CWS.Oslogo
4. CWS.Msspi
5. CWS.Vrape
6. CWS.Oemsyspnp
7. CWS.Svchost32
8. CWS.Dnsrelay
9. CWS.Msinfo
10. CWS.Ctfmon32
11. CWS.Tapicfg
12. CWS.Svcinit
13. CWS.Msoffice
14. CWS.Dreplace
15. CWS.Mupdate
16. CWS.Addclass
17. CWS.Googlems
18. CWS.Xplugin
19. CWS.Alfasearch
20. CWS.Loadbat
21. CWS.Qttasks
22. CWS.Msconfd
23. CWS.Therealsearch
24. CWS.Control
25. CWS.Olehelp

26. CWS.Smartsearch
27. CWS.Yexe
28. CWS.Gonnasearch
29. CWS.Smartfinder
30. CWS.Winproc32
31. CWS.Msconfig
32. CWS.Xxxvideo
33. CWS.Winres
34. CWS.Xmlmimefilter
35. CWS.Aboutblank
36. CWS.Systeminit
37. CWS.Sounddrv
38. CWS.Searchx
39. CWS.Realyellowpage

• CWS.Aff.iedll
• CWS.Aff.Winshow
• CWS.Aff.Madfinder
• CWS.Aff.Tooncomics

How do I get rid of this?

How did it get onto my system?

How do I prevent it from happening again?

Variant 1: CWS.Datanotary - Introduction to Destruction

O19 - User stylesheet: c:\windows\my.css

The solution to this problem took a while to surface, but after a few weeks (which is pretty long) someone reported the problem going away when going into IE Options, Accessability and disabling the 'Use My Stylesheet' option. After that, the fake stylesheet file could be deleted.

The hijack installed a stylesheet that used a flaw in Internet Explorer and allowed a .css stylesheet file to execute Javascript code. The code in the file was encrypted, and spawned a popup off-screen that did the redirecting. However, this file was called on almost every action taken in IE, slowing it down - this was the most obvious when typing text.

Variant 2: CWS.Bootconf - Evolution

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://%77%77%77%2e %63%6f%6f%6c%77%77%77%73%65%61%72%63%68%2e%63%6f%6d/%7a/%62/%78%31%2e %63%67%69?%36%35%36%33%38%37 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://%77%77%77%2e%63 %6f%6f%6c%77%77%77%73%65%61%72%63%68%2e%63%6f%6d/%7a/%63/%78%31%2e %63%67%69?%36%35%36%33%38%37 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://%77%77%77%2e% 63%6f%6f%6c%77%77%77%73%65%61%72%63%68%2e%63%6f%6d/%7a/%62/%78%31%2e %63%67%69?%36%35%36%33%38%37 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://%77%77%77%2e %63%6f%6f%6c%77%77%77%73%65%61%72%63%68%2e%63%6f%6d/%7a/%61/%78%31%2e %63%67%69?%36%35%36%33%38%37 about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://yourbookmarks.ws/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default)=http://www.searchxp.com/search.php?qq=%s O1 - Hosts: 1123694712 auto.search.msn.com O4 - HKLM\..\Run: [sysPnP] C:\WINNT\System32\bootconf.exe O19 - User stylesheet: C:\WINNT\default.css

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.coolwwwsearch.com/z/b/x1.cgi?100 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.jetseeker.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.coolwwwsearch.com/z/c/x1.cgi?100 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.coolwwwsearch.com/z/a/x1.cgi?100 (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.jetseeker.com/ffeed.php?term=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://search.xrenoder.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://search.xrenoder.com

Only when this code was decyphered it became clear that CoolWebSearch was behind this all. It almost seemed as if they let Datanotary take the stylesheet exploit hijack for a test ride, before using it themselves.

The hijack further involved redirecting the default 'server not found' page to the CoolWebSearch portal homepage by editing the Hosts file, and reloading the entire hijack when the machine was rebooted using a bootconf.exe file that was started with Windows. We also started to see some pages which seemed affiliates of CWS since almost all their links led to www.coolwebsearch.com.

Variant 3: CWS.OSLogo.bmp - Send in the affiliates

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.coolwwwsearch.com/z/b/x1.cgi?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/ redir?lang={S...201058341631385 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.coolwwwsearch.com/z/a/ x1.cgi?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.coolwwwsearch.com/z/b/ x1.cgi?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.allhyperlinks.com/ redir?lang={S...201058341631385 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/ redir?lang={S...201058341631385 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://stopxxxpics.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.allhyperlinks.com/ redir?lang={S...201058341631385 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/ redir?lang={S...201058341631385 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.allhyperlinks.com/ redir?lang={S...201058341631385 R1 - HKCU\Software\Microsoft\Internet Explorer\Main\,HomeOldSP = http://www.coolwwwsearch.com/z/a/ x1.cgi?656387 (obfuscated) O1 - Hosts: 1123694712 auto.search.msn.com O4 - HKLM\..\Run: [sysPnP] C:\WINNT\System32\bootconf.exe O15 - Trusted Zone: *.coolwwwsearch.com O15 - Trusted Zone: *.msn.com O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp

But most of all, IE start and search pages started getting changed to several dozen different sites that were all affiliated to CWS. There didn't seem to be an end to the flow of different domains users were hijacked to. When I write this, over 80 domains are known CWS affiliates - and all appeared in users' logs.

Variant 4: CWS.Msspi - Let's get dangerous

O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msspi.dll

After looking over the log, it was quickly concluded the msspi.dll file was to blame. One expert took the file apart and found several key URLs that were monitored, and when he changed them to bogus URLs the popups were gone.

However, the file hooked into the Winsock LSP chain, which lies very deep into the bowels of Windows and is one of the hardest parts of Windows to manipulate. Only a very small selection of spyware used this method of infection, and incorrect removal left a computer with a broken Internet connection that could not be fixed even by reinstalling Windows.

Luckily there were one or two tools that could fix a broken Internet connection due to this problem. LSPFix was the one used most since it allowed direct editing of the LSP chain.

Variant 5: CWS.Vrape - Mix and mangle

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://vrape.hardloved.com/ top/search.php?id=2&s= R1 - HKCU\Software\Microsoft\Internet Explorer,Search Page = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http:// vrape.hardloved.com/top/search.php?id=2&s= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http:// vrape.hardloved.com/top/search.php?id=2&s= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http:// vrape.hardloved.com/top/search.php?id=2&s= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http:// vrape.hardloved.com/top/search.php?id=2&s= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http:// vrape.hardloved.com/top/search.php?id=2&s= O1 - Hosts: 65.77.83.222 thehun.com O1 - Hosts: 65.77.83.222 thehun.net O1 - Hosts: 65.77.83.222 madthumbs.com O1 - Hosts: 65.77.83.222 worldsex.com O1 - Hosts: 65.77.83.222 teeniefiles.com O1 - Hosts: 65.77.83.222 al4a.com O1 - Hosts: 65.77.83.222 sublimedirectory.com O1 - Hosts: 65.77.83.222 thumbzilla.com O1 - Hosts: 65.77.83.222 sexocean.com O1 - Hosts: 65.77.83.222 easypic.com O1 - Hosts: 65.77.83.222 absolut-series.com O1 - Hosts: 65.77.83.222 jpeg4free.com O1 - Hosts: 65.77.83.222 thumbnailpost.com O13 - DefaultPrefix: http://vrape.hardloved.com/top/search.php?id=2&s= O13 - WWW Prefix: http://vrape.hardloved.com/top/search.php?id=2&s=

The hijack covered most of IE, and a user was left to sit helplessly and watch as almost his every move was redirected to vrape.hardloved.com. One strange thing about this hijack though, is that it operated alone: it didn't use any affiliates and even redirected other adult sites to its own site. It has only been connected with CWS since it appeared together with it in a few logs.

The only good thing about this variant is that the domain hardloved.com has been offline for more than half a week at the time of writing. It is unknown whether this is because of the sheer amount of users being routed to their site, DoS attacks by irate users, account termination because of violation of their host's user agreement, or something else.

Variant 6: CWS.Oemsyspnp - Pure genius

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adulthyperlinks.com/favorites/8 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.allhyperlinks.com/redir?lang={SUB_RFC1766} O4 - HKLM\..\Run: [SysPnP] rundll32 setupapi,InstallHinfSection OemVideoPnP 128 oemsyspnp.inf

However, once the hijack was identified, it was easy to stop: only the autostarting oemsyspnp.inf file had to be disabled using MSConfig, and then it could be safely deleted.

CWS.Oemsyspnp.2: A mutation of this variant exists that uses the filename keymgr3.inf, and the Registry value keymgrldr instead.

CWS.Oemsyspnp.3: A mutation of this variant exists that uses the filename drvupd.inf, and the Regustry value drvupd instead. It hijacks to searchforge.com.

Variant 7: CWS.Svchost32 - Evading detection

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.slawsearch.com O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\SYSTEM\svchost32.exe"

Fixing this hijack involved using a process killer to stop the webserver process, and editing the Hosts file to remove the Google/Yahoo/MSN redirections.

Variant 8: CWS.DNSRelay - Hey, that wasn't here before!

R3 - URLSearchHook: MailTo Class - {01A9EB7D-69BC-11D2-AB2F-204C4F4F5020} - C:\WINDOWS\System32\dnsrelay.dll

CWS.Dnsrelay.2: A mutation of this variant exists which uses the filename ASTCTL32.OCX instead.

CWS.Dnsrelay.3: A mutation of this variant exists which uses the filename mswsc10.dll instead, which is located in C:\Program Files\Common Files\Web Folders. It hijacks IE to payfortraffic.net. It also adds a custom stylesheet (like CWS.Bootconf) located at C:\Program Files\Internet Explorer\Readme.txt. (This file is not present on uninfected systems.) It uses a Registry value named nvstart to re-register the main mswsc10.dll file on startup.

CWS.Dnsrelay.4: A mutation of this variant exists that is like CWS.Dnsrelay.3, but uses the filename mswsc20.dll instead, located at the same place. It hijacks IE to gofreegalleries.com, adds the same custom stylesheet, and uses the hosts file to hijack numerous sites to allhyperlinks.com.

Variant 9: CWS.Msinfo - running out of ideas

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://out.true-counter.com/b/?101 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://out.true-counter.com/a/?101 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://out.true-counter.com/b/?101 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://out.true-counter.com/c/?101 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://out.true-counter.com/b/?101 (obfuscated) F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\msinfo.exe F1 - win.ini: run=msinfo.exe O4 - HKLM\..\Run: [Internat Conf] \bootconf.exe

The MSINFO.EXE is installed in a Windows folder where also the legitimate MSINFO32.EXE file resides. It is ran from win.ini, a method rarely used by programs nowadays. It sets nearly all Start and Search pages from IE to URLs at out.true-counter.com, and reinstates these whenever the system is restarted. Fixing this variant involves resetting all the Registry values changed for IE, editing the autorun values in win.ini and the Registry, and deleting the two files.

Variant 10: CWS.Ctfmon32 - SlawSearch part II

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.slawsearch.com/autosearch.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.slawsearch.com/autosearch.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.slawsearch.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.slawsearch.com/autosearch.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = javascript:window.close() O4 - HKLM\..\Run: [CTFMON32.EXE] "C:\WINDOWS\System32\ctfmon32.exe"

Variant 11: CWS.Tapicfg - Msinfo part 2

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://acc.count-all.com/--/?oaoca (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://acc.count-all.com/--- /?oaoca (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://acc.count-all.com/-- /?oaoca (obfuscated) F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\info32.exe O1 - Hosts: 3510794918 auto.search.msn.com O4 - HKLM\..\Run: [Tapicfg.exe] C:\WINDOWS\SYSTEM\tapicfg.exe O19 - User stylesheet: C:\WINDOWS\Web\win.def O19 - User stylesheet: C:\WINDOWS\default.css

CWS.Tapicfg.2: A mutation of this variant exists that uses the filename soundmx.exe, and hijacks IE to globe-finder through a redirection page at in.webcounter.cc. Possibly the same file is loaded as fntldr.exe from WIN.INI. A hosts file redirection of auto.search.msn.com to globe-finder is installed. Two custom stylesheets named tips.ini and hh.htt are installed.

Variant 12: CWS.Svcinit - Sneaky little fellow

Running processes: C:\WINDOWS\System32\SVCINIT.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/// R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:/// R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://// R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://xwebsearch.biz F1 - win.ini: run=C:\WINDOWS\svcinit.exe O4 - HKLM\..\RunServices: [SVC Service] C:\WINDOWS\SYSTEM\svcinit.exe O4 - HKLM\..\Run: [mssys] C:\WINDOWS\mssys.exe

Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon] UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcinit.exe

CWS.Svcinit.2: A mutation of this variant exists, which uses the filename svcpack.exe instead. It hijacks to http:/// (sic) and uses the same autostarting methods as the first version. Possibly it also drops the file SVCHOST.OLD for unknown purposes.

CWS.Svcinit.3: Possibly, a mutation of this variant exists, which hijacks to xwebsearch.biz and http:/// (sic), as well as installing a hosts file redirection of several dialer sites to searchmeup.com.

CWS.Svcinit.4: A mutation of this variant exists, that hijacks IE to sex.free4porno.net, and adds porn bookmarks to the IE Favorites and on the desktop. It reinstalls from a file c:\windows\svchost.exe (not a valid Windows system file, which is in the system32 folder), running at startup using the name Online Service. It also uses the trojan file msin32.dll for unknown reasons.

Variant 13: CWS.Msoffice - HTA exploit revisited

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net O4 - HKLM\..\Run: [Msoffice] C:\WINDOWS\Fonts\msoffice.hta O4 - HKCU\..\Run: [Msoffice] C:\WINDOWS\Fonts\msoffice.hta

CWS.Msoffice.:2 A mutation of this variant exists that hijacks IE to sexpatriot.net and royalsearch.net, installs a hosts file hijack of two porn sites to 64.246.33.179, and reinstalls through a file named fonts.hta using the name AdobeFonts.

CWS.Msoffice.:3 A mutation of this variant exists that hijacks IE to supersearch.com and hugesearch.net, and reinstalls through a file named fonts.hta using the name TrueFonts. It also changes the DefaultPrefix and WWW Prefix to redirect all URLs through hugesearch.net.

Variant 14: Dreplace - Just a BHO... OR IS IT?

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http:/// R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/// R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:/// R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://xwebsearch.biz/ O1 - Hosts: 213.159.117.233 sitefinder.verisign.com O2 - BHO: HTML Source Editor - {086AE192-23A6-48D6-96EC-715F53797E85} - C:\WINDOWS\System32\DReplace.dll

CWS.Dreplace.2: There is a second version of this variant that used the most dastardly trick I have ever seen in a piece of malware. It changed the dreplace.dll so fixing it with either HijackThis or CWShredder will cause your entire system to fail on Windows 98, 98SE and ME! The hijack is the same as the first version for almost all other aspects, and both HijackThis and CWShredder have been updated to circumvent the problem.

Variant 15: Mupdate - Turning up everywhere

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.searchv.com/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.searchv.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.searchv.com/search.html F0 - system.ini: Shell=explorer.exe mupdate.exe F1 - win.ini: run=mupdate.exe F2 - REG:system.ini: Shell=explorer.exe mupdate.exe O1 - Hosts: 209.66.114.130 sitefinder.verisign.com O4 - HKLM\..\Run: [sys] regedit -s sys.reg O15 - Trusted Zone: *.masspass.com

Variant 16: CWS.Addclass - Halloween edition

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.rightfinder.net/search/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rightfinder.net/hp/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.rightfinder.net/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.rightfinder.net/search/ O4 - HKCU\..\Run: [AddClass] C:\WINDOWS\TEMP\ADDCLASS.EXE O13 - DefaultPrefix: http://ehttp.cc/? O13 - WWW Prefix: http://ehttp.cc/?

Variant 17: CWS.Googlems - We have a payload!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.idgsearch.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.idgsearch.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.idgsearch.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.idgsearch.com/ O2 - BHO: GoogleMS Search Helper - {79369D5C-2903-4b7a-ADE2-D5E0DEE14D24} - C:\Documents and Settings\[username]\Application Data\GoogleMS.dll

CWS.Googlems.2: A mutation of this variant exists that hijacks IE to idgsearch.com and 2020search.com, installs a BHO named 'Microsoft SearchWord' using the filename SearchWord.dll in the same location as the first version. It also adds *.xxxtoolbar.com to the Trusted Zone.

CWS.Googlems.3: A mutation of this variant exists that hijacks IE to idgsearch.com, installs a BHO named 'Microsoft SearchWord' using the filename Word10.dll in the location C:\Documents And Settings\[username]\Application Data\Microsoft\Office.
This version can also be loaded by a fake Notepad.exe file in the Windows system folder. The fake file has an icon different from the default notepad one.

CWS.Googlems.4: A mutation of this variant exists that hijacks IE to idgsearch.com, 2020search.com and possibly coundnotfind.com. It installs a hosts file hijack to 69.56.223.196 (idgsearch.com), redirecting from several CWS affiliate domains (!), one Lop.com domain, one misspelled Spywareinfo domains (hehe) and several porn domains. It installs a BHO named 'Microsoft Excel' using the filename Excel10.dll, located at the same place as the third mutation. It also adds *.xxxtoolbar.com and *.teensguru.com to the Trusted Zone.

Variant 18: CWS.Xplugin - 'Helping' you search the web

Not visible in HijackThis log!

Variant 19: CWS.Alfasearch - Child's Play

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.alfa-search.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.alfa-search.com/home.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alfa-search.com/home.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.alfa-search.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.alfa-search.com/search.html O4 - Global Startup: MSupdate.exe

CWS.Alfasearch.2: A mutation of this variant exists, that hijacks IE to www.find-itnow.com, drops 7 porn bookmarks in the IE Favorites, and causes error messages concerning 'Win Min' at system shutdown, as well as bogus runtime errors at system startup. It drops a fake Winlogon.exe file in the 'All Users' Startup group of the Start Menu, or in the Startup group of the current user. The file is always running, and hard to remove. If CWShredder repeatedly reports removing this variant, it cannot remove winlogon.exe. To remove this file manually, move it out of the Startup folder, restart, and then delete the file.

CWS.Alfasearch.3: A mutation of this variant exists, that hijacks IE to www.alfa-search.com, and reinstalls by running an encryped VBS script from three places in the Registry, named rundll32.vbe using the name Windows Security Assistant. It also installs a custom stylesheet named readme.txt in the Windows sytem folder, drops 9 porn bookmarks in the IE Favorites and 6 on the desktop, and installs a hosts file hijack of 8 major search engines and one porn site to 64.124.222.169 (alfa-search.com).

Variant 20: CWS.Loadbat - Dastardly

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie-search.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie-search.com/home.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\windows\hp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie-search.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie-search.com/srchasst.html (obfuscated) O1 - Hosts: 206.161.200.105 auto.search.msn.com O1 - Hosts: 206.161.200.105 sitefinder.verisign.com O1 - Hosts: 206.161.200.105 sitefinder-idn.verisign.com O1 - Hosts: 206.161.200.103 www.smutserver.com O1 - Hosts: 206.161.200.103 www1.smutserver.com O1 - Hosts: 206.161.200.103 www2.smutserver.com [...] O1 - Hosts: 206.161.200.103 www29.smutserver.com O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell.dll /c /set -- by windows setup -- O4 - HKLM\..\Run: [Win64 Compatibility Check] load win64.drv /c /set -- by windows setup --

The second variant added a hosts file hijack of auto.search.msn.com and the Verisign Sitefinder to something called 'FLS' that linked to Umaxsearch, as well as hijacking smutserver.com domains to another porn site.

To remove this manually, killing the autostarts and removing hp.htm , load.bat and srch.reg from the Windows folder along with resetting the IE homepage/search page is enough.

Variant 21: CWS.Qttasks - Even more simple than CWS.Alfasearch

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start-space.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start-space.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.start-space.com/ O4 - HKCU\..\Run: [QuickTime Task] c:\windows\qttasks.exe

Variant 22: CWS.Msconfd - Finally using rundll32

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://webcoolsearch.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://webcoolsearch.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://webcoolsearch.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://webcoolsearch.com/ O4 - HKLM\..\RunServices: [Desktop] rundll32.exe msconfd,Restore ControlPanel

Load/Run keys from Registry: HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=msconfd.dll

Deleting the autorun entry, resetting IE and deleting the porn bookmarks fixes most of the hijack. Removing msconfd.dll involves renaming the file, restarting the system and deleting the renamed file.

CWS.Msconfd.2: A mutation of this variant exists, that uses the filename avpcc.dll or ctrlpan.dll that hooks into Windows in the same way as the first version. This version also deletes all the bookmarks in the IE Favorites folder, before replacing them with porn bookmarks.

CWS.Msconfd.3: A mutation of this variant exists, that uses the filename cpan.dll.

Variant 23: CWS.Therealsearch - Misery travels in pairs

Running processes: C:\WINDOWS\quicken.exe C:\WINDOWS\editpad.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.therealsearch.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.therealsearch.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.therealsearch.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.therealsearch.com/hp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.therealsearch.com/sp.php O4 - HKCU\..\Run: [quicken] C:\WINDOWS\quicken.exe O4 - HKCU\..\Run: [editpad] C:\WINDOWS\editpad.exe

To remove this variant a process killer is needed to kill editpad.exe and quicken.exe and deleting the files, as well as resetting the IE homepage/search pages and possibly removing CWS.Aff.Tooncomics.2 which can be downloaded by this variant.

CWS.Therealsearch.2: There is a mutation of this variant that hijacks to my.search (sic), that also the filenames c:\windows\winrar.exe and c:\windows\waol.exe.

Variant 24: CWS.Control - Dude, where's my Control Panel?

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.windowws.cc/ sp.htm?id=9 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.windowws.cc/ sp.htm?id=9 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowws.cc/ hp.htm?id=9 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://super-spider.com O4 - HKCU\..\Run: [Windows Control] C:\WINDOWS\CONTROL.EXE O4 - HKCU\..\RunServices: [Windows Control] C:\WINDOWS\CONTROL.EXE

CWS.Control.2: A mutation of this variant exists that is identical in every way, but where control.exe always stays in memory.

CWS.Control.3: A mutation of this variant exists that uses random filenames and random startups.

Variant 25: CWS.Olehelp - Who wants some bookmarks?

Running processes: C:\WINDOWS\OLEHELP.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.omega-search.com/go/panel_search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.omega-search.com/go panel_search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.omega-search.com/go/panel_search.html O4 - HKCU\..\Run: [olehelp] C:\WINDOWS\olehelp.exe O4 - HKCU\..\Run: [svchost] C:\WINDOWS\olehelp.exe

Killing the autostart and deleting the file + bookmarks fixes this.

Variant 26: CWS.Smartsearch - Counter-counter-actions

Running processes: C:\Program Files\directx\directx.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://smartsearch.ws/?q= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://smartsearch.ws/?q= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://smartsearch.ws/?q= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://smartsearch.ws R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smartsearch.ws R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://smartsearch.ws/?q= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://smartsearch.ws/?q= O4 - HKLM\..\Run: [SystemEmergency] C:\Program Files\directx\directx.exe O4 - HKLM\..\RunServices: [SystemEmergency] C:\Program Files\directx\directx.exe O4 - HKCU\..\Run: [SystemEmergency] C:\Program Files\directx\directx.exe O4 - HKLM\..\Run: [UserSystem] C:\Windows\iexplorer.exe O4 - HKLM\..\RunServices: [UserSystem] C:\Windows\iexplorer.exe O4 - HKCU\..\Run: [UserSystem] C:\Windows\iexplorer.exe O13 - DefaultPrefix: http://smartsearch.ws/?q= O13 - WWW Prefix: http://smartsearch.ws/?q=

CWS.Smartsearch.2: A mutation of this variant exists that attempts to close CWShredder, HijackThis, Ad-Aware, Spybot S&D and the SpywareInfo forums when they are opened. It uses the filename IEXPLORER.EXE (note the extra 'R') and a different Registry value. It drops a hosts file that blocks over two dozen anti-spyware sites. CWShredder has been updated to circumvent this.

CWS.Smartsearch.3: A mutation of this variant exists that uses the startup 'coolwebprogram', and attempts to close CWShredder, HijackThis, Ad-Aware, Spybot S&D and the SpywareInfo forums when they are opened. It also drops notepad32.exe and hijacks the .txt and .log filetypes to open with this file (before showing it in the real Notepad), reinstalling the hijack.

CWS.Smartsearch.4: A mutation of this variant exists that hijacks to magicsearch.ws instead of smartsearch.ws, uses the startup 'MicrosoftWindows' and also drops the notepad32.exe Notepad hijacker like CWS.Smartsearch.3. It also hijacks the DefaultPrefix and WWW Prefix to magicsearch.ws like CWS.Vrape and attempts to kill several firewalls, including (but not limited to) ZoneAlarm and Kerio Personal Firewall.

Known filenames used by this variant:
C:\Program Files\directx\directx.exe
C:\Program Files\Common Files\System\systeem.exe
C:\Windows\explore.exe (note the missing 'r')
C:\Windows\System\internet.exe
C:\Windows\Media\wmplayer.exe
C:\Windows\Help\helpcvs.exe
C:\Program Files\Accessories\accesss.exe
C:\Games\systemcritical.exe
C:\Documents Settings\sistem.exe
C:\Program Files\Common Files\Windows Media Player\wmplayer.exe
C:\Windows\Start Menu\Programs\Accessories\Game.exe
C:\Windows\sistem.exe
C:\Windows\System\RunDll16.exe
C:\Windows\iexplorer.exe (note the extra 'i' or the extra 'r')
C:\y.exe
C:\x.exe

c:\funny.exe
c:\funniest.exe
c:\Windows\notepad32.exe
C:\Windows\system\kazaa.exe
C:\Windows\system32\kazaa.exe
C:\Program Files\Common Files\Services\iexplorer.exe
C:\Program Files\Common Files\Services\explore.exe
C:\Program Files\Common Files\Services\exploreer.exe
C:\Program Files\Common Files\Services\sistem.exe
C:\Program Files\Common Files\Services\critical.exe
C:\Program Files\Common Files\Services\directx.exe
C:\Program Files\Common Files\Services\internet.exe
C:\Program Files\Common Files\Services\window.exe
C:\Program Files\Common Files\Services\winmgnt.exe
C:\Program Files\Common Files\Services\clrssn.exe
C:\Program Files\Common Files\Services\explorer32.exe
C:\Program Files\Common Files\Services\win32e.exe
C:\Program Files\Common Files\Services\directx32.exe
C:\Program Files\Common Files\Services\uninstall.exe
C:\Program Files\Common Files\Services\volume.exe
C:\Program Files\Common Files\Services\autorun.exe
C:\Program Files\Common Files\Services\users32.exe
C:\Program Files\Common Files\Services\notepad.exe
C:\Program Files\Common Files\Services\win64.exe
C:\Program Files\Common Files\Services\inetinf.exe
C:\Program Files\Common Files\Services\time.exe
C:\Program Files\Common Files\Services\systeem.exe

c:\Windows\system32\iexplorer.exe
c:\Windows\system32\explore.exe
c:\Windows\system32\exploreer.exe
c:\Windows\system32\sistem.exe
c:\Windows\system32\critical.exe
c:\Windows\system32\directx.exe
c:\Windows\system32\internet.exe
c:\Windows\system32\window.exe
c:\Windows\system32\winmgnt.exe
c:\Windows\system32\clrssn.exe
c:\Windows\system32\explorer32.exe
c:\Windows\system32\win32e.exe
c:\Windows\system32\directx32.exe
c:\Windows\system32\uninstall.exe
c:\Windows\system32\volume.exe
c:\Windows\system32\autorun.exe
c:\Windows\system32\users32.exe
c:\Windows\system32\win64.exe
c:\Windows\system32\inetinf.exe
c:\Windows\system32\time.exe
c:\Windows\system32\systeem.exe

Variant 27: CWS.Yexe - Whatever

F1 - win.ini: run=C:\WINNT\system32\services\y.exe O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\System\services\1.00.07.dll O4 - HKLM\..\Run: [xpsystem] C:\WINNT\system32\services\y.exe O4 - HKCU\..\Run: [xpsystem] C:\WINNT\system32\services\y.exe

CWS.Yexe.2: Possibly a mutation of this variant exists that uses the filename services.exe instead of y.exe.

Variant 28: CWS.Gonnasearch - Three for the price of one

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gonnasearch.com/ iesearch.php?ref=sb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gonnasearch.com/?ref=sp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gonnasearch.com/ iesearch.php?ref=sb R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gonnasearch.com/?ref=sp R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.gonnasearch.com/ iesearch.php?ref=sb O2 - BHO: SearchAddon - {799A370D-5993-4887-9DF7-0A4756A77D00} - C:\PROGRA~1\INTERN~1\Toolbar\SEARCH~1.DLL O2 - BHO: AutoSearch - {A55581DC-2CDB-4089-8878-71A080B22342} - C:\PROGRA~1\INTERN~1\Toolbar\AUTOSE~1.DLL O2 - BHO: (no name) - {E7AFFF2A-1B57-49C7-BF6B-E5123394C970} - C:\PROGRA~1\INTERN~1\Toolbar\webinfo.dll

Variant 29: CWS.Smartfinder - Turning over new stones

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nkvd.us/s.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nkvd.us/s.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nkvd.us/s.htm O13 - DefaultPrefix: http://www.nkvd.us/1507/ O13 - WWW Prefix: http://www.nkvd.us/1507/ O13 - Home Prefix: http://www.nkvd.us/1507/ O13 - Mosaic Prefix: http://www.nkvd.us/1507/

Enumerating ShellServiceObjectDelayLoad items: DDE Control Module: C:\WINDOWS\SYSTEM\mtwirl32.dll

CWS.Smartfinder.2: a second version of this variant exists, that is harder to remove but basically uses the same method of loading, as well as the same CLSID. In addition, it uses a BHO to restore any of the autostarting regkeys you delete to remove this. The BHO looks like this in a HijackThis log:

O2 - BHO: OsbornTech Popup Blocker - {FF1BF4C7-4E08-4A28-A43F- 9D60A9F7A880} - C:\WINDOWS\System32\mshelper.dll

Variant 30: CWS.Winproc32 - I can't think of anything snappy to say here

Running processes: C:\WINDOWS\SYSTEM32\WINPROC32.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://4-counter.com/?a=2 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://4-counter.com/?a=2 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://4- counter.com/?a=2 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://4-counter.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://4- counter.com/?a=2 O4 - HKCU\..\Run: [Windows Internet Protocol] C:\WINDOWS\SYSTEM32\WINPROC32.EXE

Variant 31: - CWS.Msconfig - Payload plus one

Running processes: C:\WINDOWS\SYSTEM\MSCONFIG.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.31234.com/www/homepage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.31234.com/www/homepage.html O4 - HKLM\..\Run: [msconfig] C:\WINDOWS\SYSTEM\msconfig.exe O4 - HKCU\..\Run: [msconfig] C:\WINDOWS\SYSTEM\msconfig.exe O8 - Extra context menu item: ?????? - C:\WINDOWS\system32\openme.htm

The real Windows file msconfig.exe can be download here, if you can't restore it from your Windows Setup CD for some reason.

Variant 32: CWS.Xxxvideo - What, you mean it's not an xxx video?

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http:// www.enjoysearch.info/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:// www.enjoysearch.info/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:// www.enjoysearch.info/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http:// www.enjoysearch.info/ O4 - HKLM\..\Run: [xxxvid] C:\WINDOWS\system32\xxxvideo.hta O4 - HKCU\..\Run: [xxxvid] C:\Documents and Settings\<username>\My Documents\xxxvideo.hta

Variant 33: CWS.Winres - About:blank hacked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:// www.2020search.com/search/9884/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank O2 - BHO: Windows Resources - {2D38A51A-23C9-48a1-A33C-48675AA2B494} - C:\WINDOWS\winres.dll O15 - Trusted Zone: *.i-lookup.com O15 - Trusted Zone: *.offshoreclicks.com O15 - Trusted Zone: *.teensguru.com

Variant 34: CWS.Xmlmimefilter - About:blank hacked v2.0

O1 - Hosts: 213.159.117.235 auto.search.msn.com O18 - Protocol: about - {53B95211-7D77-11D2-9F80-00104B107C96} - C:\WINDOWS\System32\msxmlpp.dll

Variant 35: CWS.Aboutblank - It's just a fad

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.ws/page/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://about-blank.ws/page/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://about-blank.ws/page/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.ws/ O1 - Hosts: 213.159.118.226 1-se.com O1 - Hosts: 213.159.118.226 58q.com O1 - Hosts: 213.159.118.226 aifind.cc O1 - Hosts: 213.159.118.226 aifind.info O1 - Hosts: 213.159.118.226 allneedsearch.com O1 - Hosts: 213.159.118.226 approvedlinks.com [..] O1 - Hosts: 213.159.118.226 www.wazzupnet.com O1 - Hosts: 213.159.118.226 www.websearch.com O1 - Hosts: 213.159.118.226 www.windowws.cc O1 - Hosts: 213.159.118.226 www.xgmm.com O1 - Hosts: 213.159.118.226 xwebsearch.biz O1 - Hosts: 213.159.118.226 yourbookmarks.ws O4 - HKLM\..\Run: [Network Service] C:\WINNT\svchost.exe-sr -0 O4 - HKCU\..\Run: [Network Service] C:\WINNT\svchost.exe-sr -0 O19 - User stylesheet: C:\WINNT\system32\xea2108l.9zt

Variant 35: CWS.Systeminit - Actual size

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.your- search.info/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.your- search.info/start.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:// www.your-search.info/start.html O4 - HKLM\..\Run: [system32.dll] C:\WINDOWS\system\systeminit.exe O4 - Global Startup: sytem32.exe O19 - User stylesheet: C:\WINDOWS\sstyle.css O19 - User stylesheet: C:\WINDOWS\sstyle.css (HKLM)

Variant 36: CWS.Sounddrv - Boring, yet sneaky

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://defaultsearching.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://defaultsearching.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://defaultsearching.com O4 - HKCU\..\RunOnce: [sounddrv] C:\WINDOWS\SYSTEM\SNDBDRV3104.EXE

Variant 38: CWS.Searchx - About:blank seems popular lately

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\gfmnaaa.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\gfmnaaa.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res:// C:\WINDOWS\System32\gfmnaaa.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: (no name) - {48918FB4-1FD5-4DF3-87F0- 12C36350039D} - C:\WINDOWS\System32\gfmnaaa.dll

Note: The CWS.Realyellowpage has been sighted together with this variant sometimes, causing CWShredder to not be able to remove this one. Refer to the manual removal method for that variant to delete the offending dll, then run CWShredder again to remove CWS.Searchx.

Variant 39: CWS.Realyellowpage - Inducing homocidal tendencies

(not visible in HijackThis)

* MANUAL REMOVAL INSTRUCTIONS *

• Download PrcView here: http://www.spywareinfo.com/~merijn/files/pv.zip, unzip it to the desktop.
  
• Be sure to have at least 1 Internet Explorer window open, then double click on the runme.bat.
  
• Select option '2' from the menu.
  
• Notepad will open with a log in it. Look for a line with this file, size and beginning to it.
• The filename will always be different:
  winajbm.dll 61c00000 61440 c:\windows\system32\winajbm.dll

  This part indicates the bad file:
  61c00000 61440
  It will always start with that header.
  

• Write down the filename behind it.
  
• Now download KillBox:
  http://download.broadbandmedic.com/VbStuff/KillBox.zip
  
• Unzip and run it.
  
• Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot".
  
• On the next screen, click on the File menu and choose "Add File". The file you copied earlier should now show up in the window. If that's successful, choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.
  
• After rebooting, make sure the file is gone.
  

Right now [17/04/04], CWShredder does not remove this variant. As soon as I figure out how to do it, I will update CWShredder for it.