http://smartsearch.ws

This must be most anoying thing I have experienced in computing:
HomePage for IE is always set to http://smartsearch.ws
Sick bustard(s) from China have written this IE virus so
it becomes unusable and it always points to this useless URL
.....
I have tried spyware - but it did not help.
Please any advice is welcome

Regards


BoBa

 

hey boba,

lets start with this... and wait for experts over here to review ur log and help u out
thx

 

Damn, I got the same problem today. This smartsearch.ws is bloody annoying.

I've downloaded the latest version of the CWShredder and it says that has removed the smartsearch trojan, but when I open IE again it's all the same.

Please, someone help me!!

 

Hi Boltz,

Please start a thread of your own, following these instructions: http://www.wilderssecurity.com/showthread.php?t=15913

Regards,

Pieter

 

In the HJT logs I have seen with this infection there is program C:\WINDOWS\explore.exe that must be stopped by the Task Manager first.
Then the latest CWShredder will get rid of the remnants.
NOTE: It is explore.exe and not explorer.exe which is a critical Windows file.

 

Hi yokenny,

There are an estimated 20 possible filenames involved. Three of them are covered by CWShredder, so we really need to see some logs if CWShredder does not work.
If only to harvest more files so detection and removal can be added.

Regards,

Pieter

 

Hi All,

My son also got this v e r y annoying spyware on his XP machine. We tried everything to remove it, nothing worked.

When we tried to delete the explore.exe file his system would not let us. I assume this is because it considered it a running program at the time, even with all browsers closed. So, we decided to rename the explore.exe file ( c:\windows\explore.exe ) Renaming it but leaving the extension to .exe.

Then one the program was renamed, we rebooted his machine and ran the CWShredder again. IT WORKED, successfully! Lastly, we trashed the renamed .exe file.

Maybe this will help some who still struggle with this annoying thing.

D

 

i am using windows 2000. there's no file called
explore.exe.
the cwsshredder doesn't work.

any way i can find out the exe that's causing the problem.

i'm just stuck

 

Hi sourav

Can you follow the procedures as explained here and start a topic of your own after doing so please? :

http://www.wilderssecurity.com/showthread.php?t=15913

Thanks!

Cheers,

 

For Windows 2000 system, You should stop the SYSTEEM.EXE process first in Task Manager and then use CWShredder tools to remove it! At last,don't forget manually removing the SYSTEEM.EXE entry in \HLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN.


JAMES