Possible permanent CWS.Searchx or about:blank removal

CWS.Searchx removal problem

Hi, I'm having a hard time removing this particular hijack variant of CWS. I've tried using updated versions of Ad-ware, CWS shredder, killbox, hijackthis...all with no success...it keeps comming back. I've read a post from Unzy to post my windows key, browser helper object key, filter key and log from pv...well here they are. I will be really grateful if anyone could help me out. Thanks alot.

--FILTER KEY
[HKEY_CLASSES_ROOT\PROTOCOLS\Filter]

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler]
@="AP Class Install Handler filter"
"CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate]
@="AP Deflate Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip]
@="AP GZIP Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml]
@="AP lzdhtml encoding/decoding Filter"
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html]
"CLSID"="{1BAFA782-CD41-45B4-906D-11D2EB8C8EAB}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain]
"CLSID"="{1BAFA782-CD41-45B4-906D-11D2EB8C8EAB}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml]
@="WebView MIME Filter"
"CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/xml]
"CLSID"="{807553E5-5146-11D5-A672-00B0D022E945}"

--WINDOWS KEY
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs1"=""
"AppInit_DLLs"=""

--BROWSER HELPER OBJECT KEY
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
@="NAV Helper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D374F566-545D-4A94-98EB-07630BF96B30}]

--PV LOG.TXT

Module information for 'IEXPLORE.EXE'
MODULE BASE SIZE PATH
IEXPLORE.EXE 400000 102400 C:\Program Files\Internet Explorer\IEXPLORE.EXE
ntdll.dll 77f50000 684032 C:\WINDOWS\System32\ntdll.dll
kernel32.dll 77e60000 942080 C:\WINDOWS\system32\kernel32.dll
msvcrt.dll 77c10000 339968 C:\WINDOWS\system32\msvcrt.dll
USER32.dll 77d40000 573440 C:\WINDOWS\system32\USER32.dll
GDI32.dll 7e090000 266240 C:\WINDOWS\system32\GDI32.dll
ADVAPI32.dll 77dd0000 577536 C:\WINDOWS\system32\ADVAPI32.dll
RPCRT4.dll 78000000 552960 C:\WINDOWS\system32\RPCRT4.dll
SHLWAPI.dll 70a70000 413696 C:\WINDOWS\system32\SHLWAPI.dll
SHDOCVW.dll 71700000 1347584 C:\WINDOWS\System32\SHDOCVW.dll
IMM32.DLL 76390000 114688 C:\WINDOWS\System32\IMM32.DLL
LPK.DLL 629c0000 32768 C:\WINDOWS\System32\LPK.DLL
USP10.dll 72fa0000 368640 C:\WINDOWS\System32\USP10.dll
Secur32.dll 76f90000 65536 C:\WINDOWS\System32\Secur32.dll
iphlpapi.dll 76d60000 90112 C:\WINDOWS\System32\iphlpapi.dll
WS2_32.dll 71ab0000 81920 C:\WINDOWS\System32\WS2_32.dll
WS2HELP.dll 71aa0000 32768 C:\WINDOWS\System32\WS2HELP.dll
comctl32.dll 71950000 933888 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
SHELL32.dll 773d0000 8331264 C:\WINDOWS\system32\SHELL32.dll
comctl32.dll 77340000 569344 C:\WINDOWS\system32\comctl32.dll
ole32.dll 771b0000 1196032 C:\WINDOWS\system32\ole32.dll
uxtheme.dll 5ad70000 212992 C:\WINDOWS\System32\uxtheme.dll
MSCTF.dll 74720000 278528 C:\WINDOWS\System32\MSCTF.dll
BROWSEUI.dll 71500000 1036288 C:\WINDOWS\System32\BROWSEUI.dll
browselc.dll 72430000 73728 C:\WINDOWS\System32\browselc.dll
appHelp.dll 75f40000 126976 C:\WINDOWS\system32\appHelp.dll
CLBCATQ.DLL 7c890000 528384 C:\WINDOWS\System32\CLBCATQ.DLL
OLEAUT32.dll 77120000 569344 C:\WINDOWS\system32\OLEAUT32.dll
COMRes.dll 77050000 806912 C:\WINDOWS\System32\COMRes.dll
VERSION.dll 77c00000 28672 C:\WINDOWS\system32\VERSION.dll
msctfime.ime ac0000 176128 C:\WINDOWS\System32\msctfime.ime
Msimtf.dll 746f0000 155648 C:\WINDOWS\System32\Msimtf.dll
ctagent.dll 10000000 69632 C:\WINDOWS\System32\ctagent.dll
DSOUND.dll 51080000 368640 C:\WINDOWS\System32\DSOUND.dll
WINMM.dll 76b40000 180224 C:\WINDOWS\System32\WINMM.dll
serwvdrv.dll 5cd70000 28672 C:\WINDOWS\System32\serwvdrv.dll
umdmxfrm.dll 5b0a0000 28672 C:\WINDOWS\System32\umdmxfrm.dll
WININET.dll 63000000 614400 C:\WINDOWS\system32\WININET.dll
CRYPT32.dll 762c0000 557056 C:\WINDOWS\system32\CRYPT32.dll
MSASN1.dll 762a0000 65536 C:\WINDOWS\system32\MSASN1.dll
cscui.dll 76620000 319488 C:\WINDOWS\System32\cscui.dll
CSCDLL.dll 76600000 110592 C:\WINDOWS\System32\CSCDLL.dll
SETUPAPI.dll 76670000 946176 C:\WINDOWS\System32\SETUPAPI.dll
USERENV.dll 75a70000 675840 C:\WINDOWS\system32\USERENV.dll
urlmon.dll 1a400000 499712 C:\WINDOWS\system32\urlmon.dll
mshtml.dll 63580000 2818048 C:\WINDOWS\System32\mshtml.dll
shdoclc.dll 76170000 557056 C:\WINDOWS\System32\shdoclc.dll
ekpapg.dll 1c60000 45056 C:\WINDOWS\System32\ekpapg.dll
mlang.dll 74770000 585728 C:\WINDOWS\System32\mlang.dll
msi.dll 2090000 2101248 C:\WINDOWS\System32\msi.dll
SXS.DLL 75e90000 684032 C:\WINDOWS\System32\SXS.DLL
mslbui.dll 605d0000 32768 C:\WINDOWS\System32\mslbui.dll
sptip.dll 5c2c0000 245760 C:\WINDOWS\ime\sptip.dll
OLEACC.dll 74c80000 180224 C:\WINDOWS\System32\OLEACC.dll
MSVCP60.dll 55900000 397312 C:\WINDOWS\System32\MSVCP60.dll
SPGRMR.DLL 2820000 69632 C:\WINDOWS\IME\SPGRMR.DLL
MSLS31.DLL 746c0000 159744 C:\WINDOWS\System32\MSLS31.DLL
msohev.dll 325c0000 73728 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
scrauth.dll 2880000 110592 C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll
ScrBlock.dll 29b0000 122880 C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll
wintrust.dll 76c30000 176128 C:\WINDOWS\System32\wintrust.dll
IMAGEHLP.dll 76c90000 139264 C:\WINDOWS\system32\IMAGEHLP.dll
rsaenh.dll ffd0000 143360 C:\WINDOWS\System32\rsaenh.dll
netapi32.dll 71c20000 319488 C:\WINDOWS\System32\netapi32.dll
cryptnet.dll 73d50000 65536 C:\WINDOWS\System32\cryptnet.dll
WLDAP32.dll 76f60000 180224 C:\WINDOWS\system32\WLDAP32.dll
jscript.dll 6b700000 589824 c:\windows\system32\jscript.dll
Amhooker.dll 3220000 53248 C:\WINDOWS\System32\Amhooker.dll
RASAPI32.dll 76ee0000 225280 C:\WINDOWS\System32\RASAPI32.dll
rasman.dll 76e90000 69632 C:\WINDOWS\System32\rasman.dll
TAPI32.dll 76eb0000 176128 C:\WINDOWS\System32\TAPI32.dll
rtutils.dll 76e80000 53248 C:\WINDOWS\System32\rtutils.dll
wsock32.dll 71ad0000 32768 C:\WINDOWS\System32\wsock32.dll
sensapi.dll 722b0000 20480 C:\WINDOWS\System32\sensapi.dll
mswsock.dll 71a50000 241664 C:\WINDOWS\system32\mswsock.dll
wshtcpip.dll 71a90000 32768 C:\WINDOWS\System32\wshtcpip.dll
DNSAPI.dll 76f20000 151552 C:\WINDOWS\System32\DNSAPI.dll
winrnr.dll 76fb0000 28672 C:\WINDOWS\System32\winrnr.dll
rasadhlp.dll 76fc0000 20480 C:\WINDOWS\System32\rasadhlp.dll
actxprxy.dll 71d40000 110592 C:\WINDOWS\System32\actxprxy.dll
dispex.dll 3ca0000 45056 C:\WINDOWS\System32\dispex.dll
wdmaud.drv 72d20000 36864 C:\WINDOWS\System32\wdmaud.drv
msacm32.drv 72d10000 32768 C:\WINDOWS\System32\msacm32.drv
MSACM32.dll 77be0000 81920 C:\WINDOWS\System32\MSACM32.dll
midimap.dll 77bd0000 28672 C:\WINDOWS\System32\midimap.dll
mshtmled.dll 74cb0000 454656 C:\WINDOWS\System32\mshtmled.dll
webcheck.dll 74b30000 266240 C:\WINDOWS\System32\webcheck.dll
zipfldr.dll 73380000 335872 C:\WINDOWS\System32\zipfldr.dll
LINKINFO.dll 76980000 28672 C:\WINDOWS\System32\LINKINFO.dll
ntshrui.dll 76990000 147456 C:\WINDOWS\System32\ntshrui.dll
ATL.DLL 76b20000 86016 C:\WINDOWS\System32\ATL.DLL
sendmail.dll 5cdc0000 65536 C:\WINDOWS\System32\sendmail.dll
mydocs.dll 72410000 102400 C:\WINDOWS\System32\mydocs.dll
PqiIcon.dll 4050000 106496 C:\Program Files\applications\Palm\PqiIcon.dll
MFC42.DLL 73dd0000 991232 C:\WINDOWS\System32\MFC42.DLL
UserData.dll 4070000 131072 C:\Program Files\applications\Palm\UserData.dll
MFC42LOC.DLL 5fd00000 53248 C:\WINDOWS\System32\MFC42LOC.DLL
WINSPOOL.DRV 73000000 143360 C:\WINDOWS\System32\WINSPOOL.DRV
MPR.dll 71b20000 69632 C:\WINDOWS\system32\MPR.dll
drprov.dll 75f60000 24576 C:\WINDOWS\System32\drprov.dll
ntlanman.dll 71c10000 53248 C:\WINDOWS\System32\ntlanman.dll
NETUI0.dll 71cd0000 90112 C:\WINDOWS\System32\NETUI0.dll
NETUI1.dll 71c90000 245760 C:\WINDOWS\System32\NETUI1.dll
NETRAP.dll 71c80000 24576 C:\WINDOWS\System32\NETRAP.dll
SAMLIB.dll 71bf0000 69632 C:\WINDOWS\System32\SAMLIB.dll
davclnt.dll 75f70000 36864 C:\WINDOWS\System32\davclnt.dll
shgina.dll 73d70000 73728 C:\WINDOWS\System32\shgina.dll
MSGINA.dll 75970000 991232 C:\WINDOWS\System32\MSGINA.dll
WINSTA.dll 76360000 61440 C:\WINDOWS\System32\WINSTA.dll
ODBC32.dll 5e20000 204800 C:\WINDOWS\System32\ODBC32.dll
comdlg32.dll 763b0000 282624 C:\WINDOWS\system32\comdlg32.dll
odbcint.dll 1f850000 90112 C:\WINDOWS\System32\odbcint.dll
wiashext.dll 5a500000 577536 C:\WINDOWS\System32\wiashext.dll
gdiplus.dll 70d00000 1708032 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.10.0_x-ww_712befd8\gdiplus.dll
sti.dll 73ba0000 73728 C:\WINDOWS\System32\sti.dll
CFGMGR32.dll 74ae0000 28672 C:\WINDOWS\System32\CFGMGR32.dll
MSRATING.DLL 5ff20000 143360 C:\WINDOWS\System32\MSRATING.DLL
msratelc.dll 30000000 69632 C:\WINDOWS\System32\msratelc.dll
Module information for 'IEXPLORE.EXE'
MODULE BASE SIZE PATH
IEXPLORE.EXE 400000 102400 C:\Program Files\Internet Explorer\IEXPLORE.EXE
ntdll.dll 77f50000 684032 C:\WINDOWS\System32\ntdll.dll
kernel32.dll 77e60000 942080 C:\WINDOWS\system32\kernel32.dll
msvcrt.dll 77c10000 339968 C:\WINDOWS\system32\msvcrt.dll
USER32.dll 77d40000 573440 C:\WINDOWS\system32\USER32.dll
GDI32.dll 7e090000 266240 C:\WINDOWS\system32\GDI32.dll
ADVAPI32.dll 77dd0000 577536 C:\WINDOWS\system32\ADVAPI32.dll
RPCRT4.dll 78000000 552960 C:\WINDOWS\system32\RPCRT4.dll
SHLWAPI.dll 70a70000 413696 C:\WINDOWS\system32\SHLWAPI.dll
SHDOCVW.dll 71700000 1347584 C:\WINDOWS\System32\SHDOCVW.dll
IMM32.DLL 76390000 114688 C:\WINDOWS\System32\IMM32.DLL
LPK.DLL 629c0000 32768 C:\WINDOWS\System32\LPK.DLL
USP10.dll 72fa0000 368640 C:\WINDOWS\System32\USP10.dll
Secur32.dll 76f90000 65536 C:\WINDOWS\System32\Secur32.dll
iphlpapi.dll 76d60000 90112 C:\WINDOWS\System32\iphlpapi.dll
WS2_32.dll 71ab0000 81920 C:\WINDOWS\System32\WS2_32.dll
WS2HELP.dll 71aa0000 32768 C:\WINDOWS\System32\WS2HELP.dll
comctl32.dll 71950000 933888 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
SHELL32.dll 773d0000 8331264 C:\WINDOWS\system32\SHELL32.dll
comctl32.dll 77340000 569344 C:\WINDOWS\system32\comctl32.dll
ole32.dll 771b0000 1196032 C:\WINDOWS\system32\ole32.dll
uxtheme.dll 5ad70000 212992 C:\WINDOWS\System32\uxtheme.dll
MSCTF.dll 74720000 278528 C:\WINDOWS\System32\MSCTF.dll
BROWSEUI.dll 71500000 1036288 C:\WINDOWS\System32\BROWSEUI.dll
browselc.dll 72430000 73728 C:\WINDOWS\System32\browselc.dll
appHelp.dll 75f40000 126976 C:\WINDOWS\system32\appHelp.dll
CLBCATQ.DLL 7c890000 528384 C:\WINDOWS\System32\CLBCATQ.DLL
OLEAUT32.dll 77120000 569344 C:\WINDOWS\system32\OLEAUT32.dll
COMRes.dll 77050000 806912 C:\WINDOWS\System32\COMRes.dll
VERSION.dll 77c00000 28672 C:\WINDOWS\system32\VERSION.dll
msctfime.ime ac0000 176128 C:\WINDOWS\System32\msctfime.ime
Msimtf.dll 746f0000 155648 C:\WINDOWS\System32\Msimtf.dll
ctagent.dll 10000000 69632 C:\WINDOWS\System32\ctagent.dll
DSOUND.dll 51080000 368640 C:\WINDOWS\System32\DSOUND.dll
WINMM.dll 76b40000 180224 C:\WINDOWS\System32\WINMM.dll
serwvdrv.dll 5cd70000 28672 C:\WINDOWS\System32\serwvdrv.dll
umdmxfrm.dll 5b0a0000 28672 C:\WINDOWS\System32\umdmxfrm.dll
WININET.dll 63000000 614400 C:\WINDOWS\system32\WININET.dll
CRYPT32.dll 762c0000 557056 C:\WINDOWS\system32\CRYPT32.dll
MSASN1.dll 762a0000 65536 C:\WINDOWS\system32\MSASN1.dll
cscui.dll 76620000 319488 C:\WINDOWS\System32\cscui.dll
CSCDLL.dll 76600000 110592 C:\WINDOWS\System32\CSCDLL.dll
SETUPAPI.dll 76670000 946176 C:\WINDOWS\System32\SETUPAPI.dll
USERENV.dll 75a70000 675840 C:\WINDOWS\system32\USERENV.dll
urlmon.dll 1a400000 499712 C:\WINDOWS\system32\urlmon.dll
mshtml.dll 63580000 2818048 C:\WINDOWS\System32\mshtml.dll
shdoclc.dll 76170000 557056 C:\WINDOWS\System32\shdoclc.dll
ekpapg.dll 1c60000 45056 C:\WINDOWS\System32\ekpapg.dll
mlang.dll 74770000 585728 C:\WINDOWS\System32\mlang.dll
msi.dll 2090000 2101248 C:\WINDOWS\System32\msi.dll
SXS.DLL 75e90000 684032 C:\WINDOWS\System32\SXS.DLL
mslbui.dll 605d0000 32768 C:\WINDOWS\System32\mslbui.dll
sptip.dll 5c2c0000 245760 C:\WINDOWS\ime\sptip.dll
OLEACC.dll 74c80000 180224 C:\WINDOWS\System32\OLEACC.dll
MSVCP60.dll 55900000 397312 C:\WINDOWS\System32\MSVCP60.dll
SPGRMR.DLL 2720000 69632 C:\WINDOWS\IME\SPGRMR.DLL
MSLS31.DLL 746c0000 159744 C:\WINDOWS\System32\MSLS31.DLL
msohev.dll 325c0000 73728 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
scrauth.dll 2780000 110592 C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll
ScrBlock.dll 28b0000 122880 C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll
wintrust.dll 76c30000 176128 C:\WINDOWS\System32\wintrust.dll
IMAGEHLP.dll 76c90000 139264 C:\WINDOWS\system32\IMAGEHLP.dll
rsaenh.dll ffd0000 143360 C:\WINDOWS\System32\rsaenh.dll
netapi32.dll 71c20000 319488 C:\WINDOWS\System32\netapi32.dll
cryptnet.dll 73d50000 65536 C:\WINDOWS\System32\cryptnet.dll
WLDAP32.dll 76f60000 180224 C:\WINDOWS\system32\WLDAP32.dll
jscript.dll 6b700000 589824 c:\windows\system32\jscript.dll
Amhooker.dll 3120000 53248 C:\WINDOWS\System32\Amhooker.dll
RASAPI32.dll 76ee0000 225280 C:\WINDOWS\System32\RASAPI32.dll
rasman.dll 76e90000 69632 C:\WINDOWS\System32\rasman.dll
TAPI32.dll 76eb0000 176128 C:\WINDOWS\System32\TAPI32.dll
rtutils.dll 76e80000 53248 C:\WINDOWS\System32\rtutils.dll
wsock32.dll 71ad0000 32768 C:\WINDOWS\System32\wsock32.dll
sensapi.dll 722b0000 20480 C:\WINDOWS\System32\sensapi.dll
mswsock.dll 71a50000 241664 C:\WINDOWS\system32\mswsock.dll
wshtcpip.dll 71a90000 32768 C:\WINDOWS\System32\wshtcpip.dll
DNSAPI.dll 76f20000 151552 C:\WINDOWS\System32\DNSAPI.dll
winrnr.dll 76fb0000 28672 C:\WINDOWS\System32\winrnr.dll
rasadhlp.dll 76fc0000 20480 C:\WINDOWS\System32\rasadhlp.dll
actxprxy.dll 71d40000 110592 C:\WINDOWS\System32\actxprxy.dll
dispex.dll 4440000 45056 C:\WINDOWS\System32\dispex.dll
wdmaud.drv 72d20000 36864 C:\WINDOWS\System32\wdmaud.drv
msacm32.drv 72d10000 32768 C:\WINDOWS\System32\msacm32.drv
MSACM32.dll 77be0000 81920 C:\WINDOWS\System32\MSACM32.dll
midimap.dll 77bd0000 28672 C:\WINDOWS\System32\midimap.dll

 

Hi all, I've been dealing with the CWS.Searchx hijack for some time now and was not successful in removing it permanently. However, recently, I've stumbled upon a forum which recommended downloading of the following software, http://www10.brinkster.com/expl0iter/freeatlast/Find-All.zip. So I tried out the software, by running "find all.bat". A few moments later, a mysterious library file was reported by the software, c:\windows\system32\winmefg.dll. I tried in vain looking for that particular file under explorer, dos mode and even safe mode...even tried to use killbox to get rid of it but all could not find that file. As a last resort, I boot-up my windows xp CD and ran the recovery console. I searched the directory and there it was...the mysterious file. After disabling its read-only attribute, I have managed to delete. Is this file the mastermind of CWS.Searchx Did I managed to get rid of it permanently Well only time will tell...but in the mean time, anyone who is struggling with this annoying trojan/hijack thing could try out what I have done and fingers crossed, the irritating about:blank page will disappear forever!

 

Congrats! That was very wise of you.

That is indeed the culprit of a new CWS hijack that is spreading fast now.

The tricky part is being able to delete it. You succeeded, credits to you and well done!

Using the RC is indeed the option we advised to other peeps as well, suffering from this hijack.

Unfortunately, you would be surprised how many people do not have an original XP cd ( ahum )

Cheers,