CW Shredder problem

Hi,

I'm having a problem opening CWShredder and was wondering if you could help. I'm sure it said the first time that i have a variant of Coolwebsearch but now it doesn't come up and the thing won't load. It said that it was opening under another name but that failed and now all i get is :

Hosts file not present
Found Win.ini file: C:\WINDOWS\win.ini (8029 bytes, A)
Found line in Win.ini: load=
Found line in Win.ini: run=
Found System.ini file: C:\WINDOWS\system.ini (2165 bytes, A)
Found line in System.ini: shell=Explorer.exe

Anyway i thought i'd run Hiijack this and it would be ok, but i can't find anything. My PC is seriously slow and i think i've already deleted everything i can so there's hardly anything there, this is what i've got : (is there anything that looks wierd here? I can't see anything. Oh, i've ran AVG, Spybot and Ad-Aware too but they don't get anything apart from a DSO exploit now and then in Spybot, maybe that's it actually, because it keeps returning.)

Logfile of HijackThis v1.97.7
Scan saved at 07:33:54, on 26/06/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\CNXDSLTB.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\MIXER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Karoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.karoo.co.uk:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} - C:\PROGRAM FILES\CLEANMYPC POPUP BLOCKER\CLEANBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - C:\PROGRAM FILES\CLEANMYPC POPUP BLOCKER\CLEANBAR.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\WINDOWS\SYSTEM\CnxDslTb.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O14 - IERESET.INF: START_PAGE_URL=http://www.karoo.co.uk/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/...sh/swflash.cab



I've already searched through some threads here but the problem seems to be different, or a variation/mutation of the same thing. Just one thing i don't get :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

Why is this running twice all the time?

Any help with these two things would be brilliant, and sorry if this is something that's already been dealt with here before, i guess i'm just looking for a few places in the registry that i can search for this thing.

edit >>> sorry, i forgot to add : i've downloaded smartkiller aswell but when i open the folder and click on it a box comes up and says that it can't be found on my system.

Hopefully this will help if you can't see anything from the first post. I ran a program called StartupList and here's the results :

StartupList report, 26/06/2004, 08:30:24
StartupList version: 1.52
Started from : C:\MY DOCUMENTS\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\CNXDSLTB.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\MIXER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\MY DOCUMENTS\STARTUPLIST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
CnxDslTaskBar = C:\WINDOWS\SYSTEM\CnxDslTb.exe
SmcService = C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
LoadQM = loadqm.exe
C-Media Mixer = Mixer.exe /startup

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
Avgserv9.exe = C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
SmcService = C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SpySweeper = C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 26/6/2004, 7:46:46)

[rename]
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL - {53707962-6F74-2D53-2644-206D7942484F}
CleanMyPC Popup Blocker - C:\PROGRAM FILES\CLEANMYPC POPUP BLOCKER\CLEANBHO.DLL - {7A9BC6B1-7F27-47c6-A66D-13582E81E537}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = https://download.macromedia.com/pub/...sh/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL



There seems to be some wierd stuff there. Also, my computer keeps freezing for a few seconds every so often and i can hear something running, then it just goes back to normal, it's strange.

I would suggest that you go to http://www.spywareinfo.com/~merijn/cwschronicles.html and download the latest copy of CWShredder. Also read the notes on the various varients of CWS that are listed down the page. They also give you the Hijackthis entries that need to be removed.

Quote:

---

We are pretty sure now CoolWebSearch is part of a new strain of trojans that have recently been identified that all have one thing in common: they install through the ByteVerify exploit in the MS Java VM and change the IE homepage, search page, search bar, etc. Take a look at this snippet from the description of the Java.Shinwow trojan:

This is a growing family of trojans that exploits the ByteCodeVerifier vulnerability in the Microsoft Virtual Machine to execute unauthorized code on an affected machine.
The variants of this trojan that we have seen in the wild have been functionally diverse; the common factor amongst them has been the use of the ByteVerify exploit to achieve their goals. Some variants may do little more than change the user's default Internet Explorer home page and/or search page via modifications to the registry.

We strongly recommend you install the patch, available from this MS security bulletin. If you have Windows XP with Service Pack 1a, your system has no MS Java VM. Information on removing the MS Java VM completely and replacing it with the newer, safer Sun Java VM can be found here.

An a side note, some of the affiliates (Search-Meta has been verified) use another Java exploit to install their malware. It's classified as the JS.Exception.Exploit, and a patch can be downloaded from this MS security bulletin.

In general, it's a good idea to keep your system up-to-date from WindowsUpdate!!

It has also been confirmed that 'Index.dat Viewer' changes your IE search pages to superwebsearch.com, a CWS affiliate page, after installing it. Uninstalling Index.Dat Viewer will not restore your search pages.

---

Also:

Quote:

---

Normal form, will work for most people:
Download http://www.merijn.org/files/CWShredder.exe

If you get a message saying 'A required dll, MSVBVM60.DLL, was not found', install this first:
Visual Basic 6 runtime libraries from Microsoft

If you can't or won't download bare executables for some reason, try this link to the zipped version:
Zipped version of CWShredder

If you get a virus warning for W32/Generic.worm!p2p, try this link instead:
Unpacked version of CWShredder

---

Hi

First Regarding that DSO Exploit.......It shouldn't be much of a Worry...if your OS is Patched up....DSO exploit Patch was avaliable i think way back in 2002.....I too get that DSO Exploit everytime i ran Spybot....until i set Spybot to ignore it...

If all your critical updates are installed you are protected against DSO Exploit and you can eliminate the annoyance of DSO Exploit reappearing each time you scan this way:

1. Open Spybot and select 'advanced' mode.
2. Select 'settings' in the left column.
3. Select 'ignore products' in the left column.
4. Select 'security' tab.
5. Place a check mark in the box beside 'DSO Exploit'.
6. Exit Spybot.
7. Restart Spybot and run a scan.

For More Information on this Read this

If CWShredder is not running ..it might be bossible something have corrupted or stopping it from running...try Running you computer in safe more and then run the CWShredder.....you can also download the new verson of the CWShredder the latest verson v1.59.0.. and then run it in the safe mode...


and i am not good at reading these Hijackthis logs :(..

--Good Luck--

Thanks for your help but i've already tried downloading CWSredder a few times and i get the same problem. Also tried safe mode and it didn't make any difference. I'm on windows me, don't know if that makes any difference but i'll keep trying with it anyway. Maybe if i disable the JVM that will help but i'm not sure about what it will do to other things in the OS.

Quote:

---

CWShredder or HijackThis closes immediately after opening?
There is a variant of the Coolwebsearch trojan spreading that closes several anti-spyware apps when you try to open them.
If this is happening to you, download PepiMK's CoolWWWSearch.SmartKiller removal tool first and run it. After it does its job, CWShredder and HijackThis will run properly (as well Spybot S&D, Ad-aware and several anti-spyware forums).

---

Try this solution. Go get the file here: http://www.safer-networking.org/files/delcwssk.zip

Thanks, i just did though and when i tried to open it it said :

CoolWWWSearch.SmartKiller (v1/v2) has not been found on your system.


Whatever spyware/hiijacker/virus this is it's good at doing it's job!

interesting. How much do you know about your system? Try rebooting in safe mode, logging in as Administrator, and go through your directories. Delete any folders/files that shouldn't be there. You'll also find VB files in your Windows directory that are booting up with windows. Delete those. go to Start>RUN> msconfig and check whats starting up with windows, I think its the last tab on the top. There you'll find a list of stuff that is starting up...the spyware might be there as well, and it will tell you where its located. Go to its location and try to manually delete it. If it doesn't let you delete because its write protected, try renaming it compoletely to something stupid "asdsadfasf.txt" reboot in safe mode again and then go back to delete it.

Hope it helps.

I don't really know much about computers, i've only had one about 10 months but i'm trying to learn more all the time. I just don't know where to start sometimes, especially when the registry is as big as it is. One thing i have noticed is that when i go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft in the registry, there's a few things there that look odd. You got me thinking about it when you mentioned Visual Basic, i saw that on the Merijn page it says that you need Visual Basic 6 for CWShredder to work and after installing it three times there still no key for it. I get Visual Basic, Visual Basic 4.0 and Visual Basic 5.0.

I don't know whats booting up with windows though because it doesn't say Visual Basic anything in any startup stuff i have, unless i've missed it.

With MSConfig, when i go to startup i get :

SpySweeper
TaskMonitor
SystemTray
LoadPowerProfile
CnxDslTaskBar (Modem)
SmcService (Sygate Firewall)
LoadQM
C-Media Mixer
LoadPowerProfile (again for some reason)
Scheduling Agent
Avgserv9.exe
Smcservice (Sygate again too)


I don't know what some of those are especially LoadQM, but anyway i'm about stuck now and am wondering where Visual Basic 6 is to actually run CWShredder, which was running fine for weeks and then just stopped working. If anyone really knows about this stuff i've got something called PV by Shadowwar that finds loads of stuff that's running with IE, i just left it for the moment because i don't want to be posting list after list if it isn't going to help.

Here you can get the runtime libraries: http://www.softwarepatch.com/windows/vbrun6.html

You do not need Visual Basics 6, just some dll files from it pretty much. If the required DLL is not in the SP6 package, which is the one mentioned in the link above, google for the rest of them.


in MSconfig, if you expand the directory path, you can see where the file is located. If its not something you installed or you use, just delete it. Disable anything that you are not using...such as the scheduling agent, loadpowerprofile, loadqm, media mixer....just get rid of all the **** you dont need. You don't need a program you've installed to search for updates every single day.

Nah i've still got nothing here, i'll probably just reinstall. Cheers for the help though, i've deleted some of the stuff that was there, i thought i needed it running for the computer to work!

Anyway i loaded the Dll files and nothing happened, it still says that the host file isn't present. If it means anything it was installing it in Windows Temp, i haven't got a clue whether or not thats the right place.

How do you people learn this stuff anyway? I'm just wondering because if i knew where to start i'd probably be able to work some of it out myself. (eventually)

well i've broken my computer about 30 times and attempted to fix it each time. Didn't break it intentionally...but learned from my mistakes. Spend a lot of time reading in AO really helps too :). Pretty much talking to IT guys, making calls to Tech Support for someone else teaches you a lot as well :). I've done that for a few of my friends...if they needed to call Tech support for anything, i'd ask them to let me do the call from their house and have them walk me through the fixing procedures...taking notes as well :). Remembering what belongs on my computer and noticing any folders that shouldn't be there also helps when it comes to spyware/adware.

Back to your problem:

Download all the runtime libraries just to be safe. Are you planning on reinstalling windows completely? You will still need to install the runtime libraries and learn to keep yourself safe from spyware. Installing a router and a firewall will also help out...I.E. If you install Bargain Buddy by accident, it will not connect to the internet to download more spyware.

Peace.

In addition to all the good help you are getting I here, I would like to point out that you have absoulutely no sign of a CWS infection anywhere.

Quote:

---

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
Why is this running twice all the time?

---

Those are just orphaned registry entries...they are not doing anything.

When you say your system is running slow, do you mean in general, or on bootup?? I may have missed it somewhere, but I didn't see any system specs anywhere. It might be helpful.

Also, some of the tools you are trying to use are for XP and higher...ME has it's own special procedures. I would also caution you against removing things from your registry until you have Googled for each entry, and are absolutely sure you know what you are dealing with. It sounds like you may have removed something that you shouldn't have.

It would also be helpful to note that when you are getting help with logs, stick to the advice of one person, even though others may be trying to help. If you hop from one bit of advice to another, you are going to get confused.

Also, if you did anything before posting that log above, you may have masked any symptoms that were present. Your best bet is to post a log when the infection is fully evident, then ask someone to help guide you through.

Good luck. :D

EDIT: One last note..everything in the registry looks odd to me. That's why I mess with it as little as possible.

Quote:

---

Your best bet is to post a log when the infection is fully evident, then ask someone to help guide you through.

---

Thats probably a good idea, i'll leave it next time and remember to post here if/when it happens. I remember the Merijn page saying something about one of the cws problems not showing up in the hiijack this logs, maybe it's one of those, but i'll reinstall and if it happens again i'll post here before messing around with stuff. ;)

Thanks for the help with trying to find it anyway, and if i find out what it was i'll post back.

later

IIRC, they all show up in the logs, one way or another, but there are quite a few variants that CWS shredder won't fix, nor can they be fixed with HJT. They involve hidden files that can only be found with tools like dllfix (which was just pulled), or FindFix, or a variety of others.

FYI, the about:blank version seems to be fixed by Pandasoft's online scan.
*PandaSoft

The newest update of Adaware targets some variants of CWS, but only if run in safe mode.:D