CoolWWWSearch BootConf

[LazyBob]

Those losers at CoolWWWSearch seem to have come up with a new variant of their filth which the latest files for SpyBot, SpyWareNuker and MS AntiSpy detected but failed to clean it properly. CWSShredder didn't manage it either.

I found Adaware Away (www.adawareaway.com) does clean it out properly.

Hope that helps someone else.

cheers

 

[guydewdney]

whats the file called and where does it install?

 

[LazyBob]

I'm not sure, it seems that it's normally installed in your windows/system folder but has it's attributes set to readonly/system/hidden and it attaches to other running processes so windows based cleaners can't remove it. Some of them can't even see it.

<editedBit>
I checked the logs and it looks like the file is called rdspclips.exe in the windows/system directory and a BHO called mshufs.dll. A quick hunt on the net doesn't show much for these files at all.
</editedBit>

The first clue you've got coolWWWsearch is that your home page is about:blank and you might have an extra toolbar. Another obvious thing is that in the bottom info bar of explorer, when you go somewhere simple like Google you can see loads of activity like other pages loading but you never see them.

Running SPYBOT tells you you've got it, but it can only clean the registry entries and doesn't remove the file. MS AntiSpy updated my definitions today so perhaps it can kill it now as well.

 

[marc777]

Useful thread thanks. We've got the same "about:blank" hijack on the homepage, and cws has been tidying it up but only temporarily.

Marc

 

[LazyBob]

Useful thread thanks. We've got the same "about:blank" hijack on the homepage, and cws has been tidying it up but only temporarily.

Marc

Yeah - that's what mine was doing. It appeared to be gone and the spy killers claimed it was, reboot and voila there it was again. The adawareaway stuff certainly appears to have killed it completely.

Hope it works for you.