CWS, CoolWebSearch removal procedure...

[Dexter]

Got this off of a mailing list... don't know if it really works or is just a scam but figured I might as well post it here incase anyone needs help.

----------------------------------------
Hello,

CWS, CoolWebSearch, is a particularly nasty incarnation of ad-ware.
Rossano Ferraris ([email protected]) and I have
collaborated to develop a simple procedure to remove it from an
NT4-W2K-WXP box.

CWS is widely discussed on the web, but it's poorly understood and
procedures to remove it are often lengthy, cumbersome and ineffective.
Users are sometimes forced to reformat the hard disk to remove it. CWS
comes in a variety of flavors. This post will only consider the most
insidious, which involves two components: a shield-DLL and a BHO
(Browser Helper Object).

Shield-DLL
----------

The shield-DLL installs itself to the following registry value in
NT4-type systems:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls

Per MSKB 197571, a .DLL listed there is "loaded by each Windows-based
application running within the current logon session." IOW, any
ad-ware found here runs concurrently with _every_ program launched. It
is truly astonishing that such a registry location exists.

Here's what the CWS shield-DLL manages to do:

1. It prevents almost all registry editors from displaying it as an
  AppInit_Dlls value. This list includes, but is not limited to:
  Regedit.exe (even if renamed), Regedt32.exe, Reg.exe, Autoruns,
  HijackThis, and, my favorite (because I wrote it), the "Silent
  Runners.vbs" script. The _only_ program known to display it, for
  unknown reasons, is the freeware Registrar Lite 2.0, available
  here: http://www.resplendence.com/reglite/

2. It prevents all GUI and command line tools from listing it or
  deleting it. This list includes, but is not limited to: Windows
  Explorer, DIR, ATTRIB, CACLS, and DEL.

3. The .DLL file has eccentric security permissions (SYNCHRONIZE
  and FILE_EXECUTE) and is READ-ONLY. Once the shield-DLL is removed
  from memory, an Admin must reset security to delete the file.

4. It has a unique name on every system it infects.

5. It ensures that a BHO starts up with IE at every boot.

6. If the BHO is deleted, it restores the BHO under a new name at
  the next boot.

This combination of features makes it a formidable adversary.

BHO
---

This is a .DLL that installs itself as a subkey of the following key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

The BHO is responsible for the ad-ware symptoms: change of home page,
profusion of popups, and anything else that foments the users' wrath.
The BHO registry key and the file are not protected; both can be
deleted. The BHO will simply be reloaded under a new name at the next
boot.

To eliminate CWS, we have developed a relatively simple procedure
(compared to everything else that's out there) that involves using
Registrar Lite 2.0 to record the name of the shield-DLL, a VBS script
to remove it from AppInit_Dlls, the "Silent Runners" script to
identify the BHO, and, after reboot, a second VBS script to delete the
shield-DLL and BHO files. The procedure and scripts can be found here:
http://www.silentrunners.org/sr_cwsremoval.html

MS please take note:

AppInit_Dlls is a gaping security hole. Unfettered access to this
value should be removed ASAP from NT4/W2K/WXP.

regards, Andrew Aronoff & Rossano Ferraris

                               *****
Want to know every program (well, almost every program -- CWS being
            the exception) that starts up with Windows?
                   Download "Silent Runners.vbs":
                   http://www.silentrunners.org/
                               *****

--
NTBugtraq Editor's Note:

Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
----------------------------------------

[guestolo]

That seems like an interesting procedure

There's also FAL's FindnFix method
There is also another script you can use do show the offending .dll
written by Mosaic

There is also a little program called DLLCompare that will show the offending .dll
which, if it is the newer variant will be about 56kb in size
the older variant will be roughly 26kb in size

After the hidden .dll is identified, Mosaic has written a script that will expose it on reboot and delete it.
Always good to run CWShredder and Ad-Aware afterwards

That is for this variant of About:blank and CoolWeb

Another variant will add an extra service in services.msc
RubberDucky has written a little program that may help at most times
to disinfect the offending files and service called About:Buster
This may not always rid you of it, sometimes the execution of About:buster
and a simple registry deletion will help.....
Some files may be deleted or altered from the infection

The HOSTS file
Control.exe
Shell.dll
Active X settings may be altered
If Spybot is installed on a machine--SDHelper.dll may be missing

[Jayant]

Hi,
     This is my first post here.

CWS hijack is a typical problem. It basically hijacks your browser. CWS Trojan hijacks Internet Explorer start and search settings of several websites. These websites have an affiliate relationship with coolwebsearch.com in which coolwebsearch pays them for every visitor they refer.

If you want more information, please visit

http://www.cheapest-computer-hardware-soft...ws-removal.html


with best regards



Jayant

[zeroc]

Here I found a website where Users discusses removal of various Coolwebsearch variants.

[jrtech1]

I'm curious about something here. Given the incredible cost of the effects of these malicious programs, (it must be in the millions or higher anually) why isn't someone working on destroying the source of these programs? If there's money to be made writing this crap there must be money in eradicating the source. Lets make these wayward boyscouts real criminals that we can put behind a rock wall for 50 years or so. this should include the entities that contract such people to write this crap for their profit. Remove the motivation (profit) and the problem goes away or at least becomes managable. As long as this problem remains a cat and mouse game of who is smarter, the writer or the detector, it will continue to escalate. You can't get rid of a hornet's nest by treating the stings.

[Dragan]

Hello!

I have a big problem with CoolWebSearch... I remember having the same problem, maybe one year ago, I just had to download and run that CWShredder and the problems were over. This time the same thing doesnt help. I used CWS, didnt work. I tried to use the new version, the same. It would find and delete some .dll but after I restart, or even without restarting, it would find it again. So it doesnt solve the problem. Then I tried Spybot search and destroy, didnt help. I think I tried one more program, but dont remember the name. In the beginning I would have the start page set to CWS, and couldnt change it, also some pop-up windows offering some stupid downloads. Now somehow, I dont know why, maybe because of some of these programs that I used, I dont have this startpage set to CWS, even after many restartings. But I still get pop-ups, even if IE is not open at all. I also found some instructions by someone how to remove CWS in 4 easy steps with the help of some registry program, which can list the critical .dll file, but it doesnt help with windows millenium, that is installed on my computer. The last thing, that I just did is scanning with HijackThis, and now I am including the log in my post here, hoping someone will help. Here it is:

Logfile of HijackThis v1.99.1
Scan saved at 10:08:26 PM, on 4/16/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\THOTKEY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\TPWRTRAY.EXE
C:\WINDOWS\SYSTEM\ALISNDMG.EXE
C:\PROGRAM FILES\APOINT\APOINT.EXE
C:\WINDOWS\SYSTEM\TFNCKY.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\DRAGAN\SVASTARA\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] irmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [ALiSndMgr] ALiSndMg.exe
O4 - HKLM\..\Run: [AlpsPoint] C:\Progra~1\Apoint\Apoint.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [THotkey] C:\WINDOWS\SYSTEM\THotkey.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {10101010-1010-1111-1010-101010101011} - mhtml:C:\\WIN.MHT!http://216.240.137.41/webtraffic/countx/g.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

Please help me, I am desperate,  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/sad.gif\' class=\'bbc_emoticon\' alt=\'\' />

Dragan

[Guest]

Dragan copy and paste the hijackthis log here: http://www.help2go.com
this will give this result
These entries have been positively identified as malicious programs. In the HijackThis program, place a check mark next to the following entries.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
(Description: Home page or search page hijacker (running from temp folder))

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
(Description: Home page or search page hijacker (running from temp folder))

O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
(Description: Program running on startup from a temporary folder.)

[guestolo]

Dragan, if you need a hand with your log
Please, Read This

[Guest]

Try this Spyware Guide Database - Spyware, Malware and Adware. Seems to work very well for most. Regards

[Guest]

Easy parasite removal instructions:

Remove CWS
Remove CoolWebSearch

[PearShaped]

Even better prevent the Malware from loading in the first place.
Regdefend www.ghostdecurity.com
ProcessGuard: www.diamondcs.com.au

[Guest]

newest coolwebsearch removal instructions can be found here.

[amanda]

hi all,

im on the verge of tears because i'm so frustrated with a virus that was sent through msn messenger.

it's on C: drive as g.exe and I can't seem to remove it.

caused my norton to be disabled and my computer is now left unprotected.

really at my wits end and i really want to avoid a system reformat.

please help! i'm really horrible with computers and stuff, don't even know what virus this is.

please please please email me at acjm86Email Removed

thank you.