Fucking spyware...

[coyoteden.livejournal.com]

Do you have any idea how hard it is to get CoolWebSearch*spit* to go away for good?

Ad-aware won't do it,
Spybot won't do it,
SpywareBlaster will block it but it already got in, so forget it.
CWShredder will get rid of it but it just keeps coming back with every reboot.

Why won't you die???

FIXED: My train of thought wasn't evil enough to think on their level. A little research turned up the sordid truth: a rare variant of VX2 was hooking into explorer, which launched a NicTech/Look2Me .dll hidden behind Rundll32, which a) hijacked the homepage, b) generated the popups, and c) dropped CWS.

And this was on a customer's machine that came in for NAV not working right. I Wonder why? Ad-aware hit 1033 on the first run.

Gah. Smoke Break NOW.

Comments

[said-by-me.livejournal.com]

have you tried Hijack this? Its pretty thorough but, you've gotta know what you are looking for

Yup.

[coyoteden.livejournal.com]

HijackThis would only show www.zestyfind.com or the like AFTER CWS had done its dirty work.

This wasn't a browserjacking, BHO, running process, ActiveX, or anything that simple. This was a .dll loaded by Rundll32 at startup due to an CLSID entry created in HKLM/Software/Microsoft/Shell Extensions/Approved (approved by who exactly...) Because of this it's impossible to get rid of once explorer.exe and rundll32.exe have loaded. I needed PV to find it.

it usually shows up as msg11*.dll or a .dll that's almost the same name as a system file, e.g. idfrared.dll. The guilty file will show in properties... to be digitally signed by NicTech Networks.

Re: Yup.

[jedisamui.livejournal.com]

PV?? I'm sorry, I don't know this title. Could you enlighten me please? Our shop uses Pest Patrol to scan for spyware, however, hijackers are another story. We usually wind up doing a handful of things for the users. I wish there was a multi use tool that good do a thorough scan and rid PCs of this crap easily. Know of any that I haven't found?

As for keeping it from returning, I have been informed this will work. I haven't tried it yet, but from what I hear it's pretty decent.

Spyware Blaster
http://www.javacoolsoftware.com/spywareblaster.html

And Spyware Guard
http://www.javacoolsoftware.com/spywareguard.html

Re: Yup.

[coyoteden.livejournal.com]

PV is short for Process Viewer, a generic but very useful colleciton of scripts that can show you not only what processes are running but also what .DLLs they are loading... as in, what exactly DOES explorer, iexplore and rundll32 load? Sometimes it's the only way to find and get rid of modules you don't want.

I don't think it has an official site, but I found it here: http://www.zerosrealm.com/downloads.php (http://www.zerosrealm.com/downloads.php)

[boredevilperson.livejournal.com]

Man the worst I've ever encountered on an adaware scan was 360 or so.

The people I support must not be as bad as I thought.

[dmsalem00.livejournal.com]

Just what is NAV good at finding/fixing these days anyway?

Compared to the stuff you can get for free, that is.

[tjernobyl.livejournal.com]

Just the "real" virii, which these days are the least of one's problems.

[dmsalem00.livejournal.com]

Remember the good ole' days when viruses were an actual threat, they were written by pro techies, and they actually did something?

Now we've got worms and spyware up the wahoo, but when was the last time we had a *real* V I R U S virus?

Nobody's h@x0r3d my @$$ in forever =(

[tjernobyl.livejournal.com]

Why 0wn one machine when you can 0wn ten million unpatched xp boxen? :P