Security Incidents mailing list archives

Re: IE default Page


From: Jeff Garrett <jgarrett () home highvision net>
Date: Fri, 16 Jul 2004 12:15:05 -0400 (EDT)

cwshredder's home page is the fix for it. cw stands for coolwebsearch.
nasty little bug. i used cwshredder on it in february and it worked fine.

but apparently there is a mini-war going on between the coolwebsearch
creators and the guy making the cwshredder fix--as fast as one makes the
bug, the other makes a fix, and vica-versa

check the latest happenings at http://www.spywareinfo.com/~merijn/ or
http://209.133.47.200/~merijn/index.html in case your spyware blocks it



On Thu, 15 Jul 2004, wnorth wrote:

Interesting bug going around, coolwebsearch, has anyone been successful in
removing this virus from a system? It looks like it recreates the DLL under
c:\windows\system32 and renames it after a few reboots. It's pretty annoying
and I haven't been able to fully contain it.

Thoughts? Suggestions? I've used highjackthis, cwshredder and a few spyware
detectors, but nothing is really fixing the problem.

Thanks,

-Wes



Current thread: