CoolWWWSearch.CameUP

Who knows more about a variant of CoolWWWSearch, CoolWWWSearch.CameUp?

On the net I can't find any information about this variant.

register key:

CoolWWWSearch.CameUp: Class ID HKEY_CLASSES_ROOT\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}

Ciao,

Smokey​

 

Hi Smokey,

Can you give me some more background info.
That CLSID does not match CWS as far as I know.

Regards,

Pieter

 

Hi P-A!

It was found by Spybot S&D v1.3 RC3, it's my problem too that it does not match CWS....

Log S&D:

CoolWWWSearch.CameUp: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}

--- Spybot - Search && Destroy version: 1.3 rc 3 ---
2004-04-14 Includes\Cookies.sbi
2004-04-14 Includes\Dialer.sbi
2004-04-14 Includes\Hijackers.sbi
2004-04-14 Includes\Keyloggers.sbi
2004-04-14 Includes\LSP.sbi
2004-04-14 Includes\Malware.sbi
2004-04-14 Includes\Revision.sbi
2004-04-14 Includes\Security.sbi
2004-04-14 Includes\Spybots.sbi
2004-04-14 Includes\Tracks.uti
2004-04-14 Includes\Trojans.sbi

With a registry search I found this results:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}\InprocServer32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}\ProgID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}\Programmable]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}\TypeLib]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}\VersionIndependentProgID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DMBar.ToolBandObj.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DMBar.ToolBandObj.1\CLSID]

@="{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DMBar.ToolBandObj\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DMBar.ToolBandObj\CLSID]

@="{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}"="IDA Bar"

OS: Windows XP Professional SP1


Ciao,

Smokey​

 

Hi Smokey,

The entries I quoted explain the legit presence of that CLSID.
I am not sure if Patrick found a liaison to CWS that escaped everyone else or if it is a f/p.


Regards,

Pieter