Results 1 to 4 of 4

Thread: cws.smartsearch and microsoft -ds

  1. August 17th, 2004, 09:47 PM #1
    airman22
    airman22 is offline
    Junior Member
    Join Date
    Apr 2004
    Posts
    4

    cws.smartsearch and microsoft -ds

    Hi All,
    A friend rang me after getting adsl at his home. Whenever he connected he got masses of pop up and his laptop went crazy. I managed to remove over 15 trojans and mostly w32.spybot and bobax.c viri. After I thought i had cleaned everything down we reconnected to the internet and a few seconds later three windows poped up showing porn and they were titled "pwnage clan and hack". I later identified this to be CWS.smartsearch using cws.shreader. While trying to remove CWS.smartsearch, shreader said that the hijack was trying to block its process and its name would change to a random name? should this have happened? I have used everything to clear cws.smartsearch, but nothing seems to work, any suggestions? I even took the laptop home with me a found that when you connect to the internet ports 4226 to 4428 are listening and then there are over 200 syn_sent to microsoft -ds. Is this a DOS attack? is there something that i cant find? I have used the following tools.
    1 Spybot S&D
    2 Adaware 6.0
    3 Pest patrol
    4 Stinger
    5 NAV corporate
    6 CWS.shreader
    All have been updated

    Hope you can help
    Airman22
    Reply With Quote Reply With Quote
  2. August 17th, 2004, 10:34 PM #2
    bucket
    bucket is offline
    Senior Member
    Join Date
    Feb 2002
    Posts
    253
    airman22,

    Did you disable System Restore (if present) before you made the scans?
    Reply With Quote Reply With Quote
  3. August 17th, 2004, 10:36 PM #3
    Tiger Shark
    Tiger Shark is offline
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    First, you need to run all these tools in safe mode at this point.

    Secondly, before you run them open task manager and stop every process that you don't recognize as valid. Google them if you don't know what they are. When you are done the only thing you should have left is Microsoft products. Then run your tools. Then restart the computer. Then rerun the tools in normal mode. If anything has returned then you still have a dropper process running. Identifying it is a little hard in a post. The final "solution" is to stop every process that isn't essential for the basic function of the machine and then run the tools.

    It isn't easy to get rid of some of this stuff.... It's often try and try again.....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
    Reply With Quote Reply With Quote
  4. August 17th, 2004, 10:40 PM #4
    Und3ertak3r
    Und3ertak3r is offline
    The Doctor Und3ertak3r's Avatar
    Join Date
    Apr 2002
    Posts
    2,744
    Groov had a post in the Spyware/Adware forum about removing a new version of CWS, one of his warnings was that using CWShredder incorrectly will lead to the CWS executables changing their names

    Check out his thread Here


    Cheers
    "Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules