PDA

View Full Version : CoolWebSearch removal tool

Pieter_Arntz
July 12th, 2003, 05:28 PM
Written by Merijn (creator of HijackThis):
http://www.spywareinfoforum.com/~merijn/files/beta/cwshredder.zip

Regards,

Pieter
Pieter_Arntz
July 13th, 2003, 04:53 AM
New URL: http://www.spywareinfoforum.com/~merijn/files/cwshredder.zip

People that use a cascading style sheet of their own should make a backup.

Regards,

Pieter
spy1
July 13th, 2003, 11:06 AM
?

Not Found
The requested URL /~merijn/files/beta/cwshredder.zip was not found on this server.


--------------------------------------------------------------------------------

Apache/1.3.27 Server at www.spywareinfoforum.com Port 80
Pieter_Arntz
July 13th, 2003, 11:52 AM
Hi Pete,

That´s why I posted the second link, when it was no longer a beta. ;)

Regards,

Pieter
spy1
July 13th, 2003, 12:45 PM
Heck, I never even saw the second link, Pieter. Thanks. Pete
Pieter_Arntz
July 30th, 2003, 02:42 PM
There has been an update:

-{ Quote: "CWShredder 1.03:
* Kills the oemsyspnp.inf and new registry values installed by the new variant.
* Now targets 38 registry values, checked against a blacklist of 56 domains belonging to CWS affiliates.

http://www.spywareinfoforum.com/~merijn/files/c.../cwshredder.zip (http://www.spywareinfoforum.com/~merijn/files/cwshredder.zip)


Note: If anyone can get their hands on any software that installs the variant that uses msspi.dll to popup ads at Google and Yahoo, I can add support for removing that as well. Reward for the first finder ;D" }-
Douglas
July 30th, 2003, 03:06 PM
FYI, our own Pieter is responsible for the naming of this tool. :D

He's too humble to have mentioned it yet. ;D

Douglas
Pieter_Arntz
August 9th, 2003, 05:01 PM
Version 1.06 already.

This tool will find and destroy all traces of the
CoolWebSearch (CWS) hijacker on your system. This
includes:

* Safe removal of msspi.dll
* Removes the new dnsrelay.dll variant
* Now targets 81 blacklisted domains


* Redirections to CoolWebSearch related pages
* Redirections when mistyping URLs
* Enormous IE slowdowns when typing
* IE start page/search page changing on reboot
* Sites in the IE Trusted Zone you didn't add

This (not yet) includes:
* Popups in Google and Yahoo when searching
Pieter_Arntz
August 13th, 2003, 06:26 AM
A nice write-up by Merijn on CWS can be found here: http://www.spywareinfoforum.com/~merijn/cwschronicles.html

Regards,

Pieter