[CWShredder Service]

I'm sorry to crosspost, but I'm trying to avoid an entire system restore.

Please see this thread http://www.broadbandreports.com/forum/remark,12926682~mode=flat for it appears CWShredder has installed itself as a service on my machine!

Thanks,
Mike

 

Hi flinchlok,

From reading your post at dslr (though I am having some trouble refreshing the page over there at the moment) it does appear you've downloaded CWShredder from the correct location: http://www.intermute.com/spysubtract/cwshredder_download.html

It maybe that you have ran the program (pressed *fix) and it requires a reboot to finish cleaning your system? Have you tried a reboot yet?

 

Doing another quick search from other logs that show CWShredder.exe running as a service, they also have the program from Intermute, SpySubtract Pro that includes CWShredder. Do you have SpySubtract Pro installed and running? It does look like CWShredder runs as a service under the SpySubtract app, though I am not that familiar with SpySubtract since I don't have that program installed myself. I just use the standalone CWShredder file.

 

flinchlok - I have moved your thread over into the Privacy Software forum as this seems more like a 'service' (CWShredder) that is installed and runs under the program SpySubtract Pro.

Services that install as part of a software package are sometimes set up by default to run at system startup. These services will show up in the 023 line of a hijackthis log. Yes, many malware 'services' also put themselves into the windows startup group, but many legitimate services run there too.

If you indeed do have SpySubtract Pro installed and set to startup when you start your computer, then I would look at the startup options in SpySubtract Pro and see if that sheds anymore light on it. It may be that CWShredder starts up as a service to check for updates and you may be able to turn that option off within the SpySubtract program.

Definitely do examine it in more detail, and let us know what you find.

Regards,

snap

 

Sorry for the late reply... geez, the kids need the phone to call friends! )

The only security programs I have at the moment (I'm in the middle of a rebuild), are Symantec Corp Anti-Virus 9.0.3, HiJackThis 1.99.1, and CWShredder 2.13.

I don't have SpySubtract anything. Also, evertime I reboot, I "hear" Dr Watson crash before I login.

Does your CWS program have the same md5sum ( http://etree.org/md5com.html ) as i do? ( d6a1efc99c7908c1f8092ee5ac8e0b3b )

Is it possible InterMute has links or programs crossed between their products?

I just DL Microsoft AntiSpyware Beta, and it found nothing.

Mike

 

Hey Mike,

I have been following your episode here and at BBR. The CWS file I have matches yours md5 wise.

 

I just ran Spybot S&D 1.3 (newest updates 2005-03-03 )... no problems.

Do you guys/gals/whatever have this registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CWShredder Service ?

Mike

 

No registry key like that for me....and my testing\md5 was done via the file you downloaded from cwshredder.net/bin/CWShredder.exe

 

I just ran Sysinternals RootkitRevealer 1.20 (with Scan Registry check)... no problems.

 

I just ran Symantec Corp AntiVirus 9.0.3.1000 (with defs 3/16/05 rev. 9) and got this error message (but the defs updated OK)...

It's late... I give up... I'll just reload XP/SP2 tomorrow... time for popcorn and dark beer...

THANKS for everone's help.

Mike

 

Hi flinchlok,

I just checked my CWShredder.exe (version 2.13 downloaded on Feb 8/05) with PepiMK's FileAlyser:

File: CWShredder.exe
Size: 465040
Version: 2.13.0.0
CRC-32: FEB2A784
MD5: D6A1EFC99C7908C1F8092EE5AC8E0B3B

So mine is the same as your's and Bubba's. I do not have that entry in the registry that you have. I am not sure why you have CWShredder running as a service though. I will keep checking and hopefully we'll come up with some answers. Meanwhile...go have that beer.

Regards,

snap

 

I just remember something, the FIRST time I ran CWShredder, there is that long list of threats that scroll by... we'll I *think* I remember seeing the last line say, "CWS.Look2Me Present". I then checked Fix... and I didn't see the CWS.Look2Me as Present... hmmm.

According to Symantec http://securityresponse.symantec.com/avcenter/venc/data/adware.look2me.html, the registry key starts with "DDFFA75A"... my regedit can't find that.

See, I've NEVER EVER have had any virus/crapware/trojans/..., so I'm not really familiar with the "Fix" button... hmmmm.... (I've been surfing since some college in Illinois was programing a GUI thing for the Internet... look live Gopher!)

Wouldn't you know it, I was 99.99999% done with my rebuild, when I decided to add IE-SPYAD, HiJackThis, and CWShredder! I was within about 5 minutes of doing my GHOST image!!

Later,
Mike

 

At least they are quick to respond

I sent the following to InterMute support...

And this is their "answer"...

I guess I was expecting some sort of technical detail about why it might be setup as a service, and if there is a bug in the program, a new version posted. Oh well, I'll just finish my rebuild and make a Ghost image this weekend.

Thanks for everone's help, and even though I/family do "Practice Safe Hex!", I'm sure I'll need help again sometime in the future! !

Mike

 

I have encountered the same problem with CWShredder version 2.13 and now with 2.14. CWShredder 2.14 also produces false positives for Vx2.look2me and after every time I run it I need to reinstall Symantec AV as it corrupts the definition files.

Do you know which registry keys I need to delete to get rid of CWShredder Service?

 

A most unusual case I've read about so far, CWShredder runs as a service!?

Some things I've thought of:
1) You don't have Spysubtract at all.
2) There is a bug in CWShredder.
3) A hidden/stealth variant of CWS is pretending to run as a service with the name CWShredder.
4) Mysterious Dr. Watson crashes happening...

 

Well, I think there is still a false positive bug in CWShredder.exe (2.13 & 2.14).

After I did a total/format rebuild of my system (XP/SP2 slip-stream), CWShredder "Scan Only", again, said it found VX2.Look2Me!

When I re-ran CWShredder, it didn't find VX2.Look2Me! I also have "Move CWS files found to the Recycle Bin instead of deleting them", but, there was no deleted files listed in the Recycle Bin.

During the first stages of my rebuild, I ONLY connected the network cable during the Windows Update and loading new Symantec Corp Anti-Virus 9.0.3 updates.

After those updates, again, I only connected when absolutly necessary.

Last nite I installed the demo/trial of CounterSpy, and it fould ZERO things on my system.

Autoruns from SysInternals shows no odd/weird stuff (image attached).

I DO NOT ever surf to "bad" sites.

Here is my HijackThis log...

Mike

 

See the 7th post in this thread.

 

Aahhh, what do I win?

Yes, I do not have Spysubtract.

Probably.

Not likely.

Nope.

I *think* CWShredder installs itself as a service IF it does find a problem, and you click "Fix"?

Mike

 

To Delete A Service
Start | Run and type cmd in the Open: line. Click OK.
Type: sc delete <service name>
Reboot the system


If you prefer to work in the registry rather than through the command prompt to delete services;

Click Start | Run and type regedit in the Open: line. Click OK.

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Scroll down the left pane, locate the service name, right click it and select Delete.

Reboot the system

 

I think ad-aware SE Personal has a vx2 add on tool that you can run frm the program, you have to obtain it from there website... have you tried to run that? It might work. Really it sounds like some other program is causing this.
you should see what hijack this finds and submit it to a help forum.

 

or try this program adware away. www.adwareaway.com

 

Technical Support at InterMute confirmed that CWShredder install itself as a service to "fix" a problem. However, there is a bug in version 2.13 & 2.14 of CWShredder (which they did not confirm) as it issues a false positive for Vx2.Look2me and then runs as service to fix a non-existing problem even under a "Scan Only" mode. To remove CWShredder Service you should disable it first (In WinXP type services.msc in the Run Command window, locate the service, right click the service and select properties and change the startup type to disabled in the widow that opens up.), and then try to let CWShredder Service start again. You will get a failure message and the entry would disappear from the Services window as well as the related registry keys.

 

actually i was told by another person on another forum that since i was doing hjt log training that i needed the version before it sold out and it would allow me to run cwshredder in debug mode. either waya, debug or normal it has never found anything and thus never gave me a problem as of yet.