Hi.

Trying to remove BRAND *NEW* VARIANT of CoolWebSearch Malware from my
75-year old Dad's PC. NOTHING WORKS. Do not suggest *ANYTHING* old. I
REPEAT: DO NOT SUGGEST ANY OLD IDEAS!!! I've tried *EVERYTHING* that
is *OLD*. OK? Don't tell me to use the shredder - it DOES NOT WORK.
Don't tell me to use Ad-Aware or *ANY* of the current spyware removers
-- THEY DO NOT WORK!!! DON'T SUGGEST ANYTHING THAT'S NOT BRAND NEW!!!
So... with that in mind... this is a variant that DOES NOT have a
current fix. Understand??? Could someone please develop one? SOON? And
can we find the bastards that created this BRAND NEW CWS variant and
try and convict and sentence them --- ASAP???!!! Cuz they suck.

Here's the scan that hijackthis created:

Logfile of HijackThis v1.97.7
Scan saved at 2:03:17 PM, on 6/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\winbu.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works
Shared\WkUFind.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\Winampa.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\crkz32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\Works
Shared\wkcalrem.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\PROGRA~1\Netscape\NETSCA~1\Netscp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Documents and Settings\[name]\Local Settings\Temp\Temporary
Directory 6 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
res://C:\WINDOWS\whwwf.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
res://whwwf.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
res://whwwf.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
res://C:\WINDOWS\whwwf.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
res://whwwf.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= res://C:\WINDOWS\whwwf.dll/sp.html#96676
N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://home.netscape.com/"); (C:\Documents and
Settings\[name]\Application
Data\Mozilla\Profiles\default\w0kzwsxi.slt\prefs.j s)
N3 - Netscape 7: user_pref("browser.search.defaultengine",
"http://www.google.com/"); (C:\Documents and
Settings\[name]\Application
Data\Mozilla\Profiles\default\w0kzwsxi.slt\prefs.j s)
O2 - BHO: (no name) -



OK, NOW WHAT???!!!

"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406281127.3bb9c408@posting.google.c om...
Maybe Format & re-install?

"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406281127.3bb9c408@posting.google.c om...

Heres a hijack forum. new things every day.
http://www.lavasoftsupport.com/index.php?showforum=44

"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406281127.3bb9c408@posting.google.c om...
Install Linux.

The Stull Demon came up with this:

Seems to me that the whwwf.dll file is the culprit. Rename it and
restart. If the file re-excists after a reboot, rename it again, create
an empty txt file, rename it to whwwf.dll, make it read-only and reboot.
(you might need to all this in safe mode)
Poast back if the file still comes back to life.

--
-John Holmes-

"It ain't much, if it ain't Dutch..."

The Stull Demon came up with this:

Oh, I also noticed a reference to a file called winbu.exe in your windows
folder. What do the properties of that file say? As it is not a standard
XP file, I'd suggest you rename that as well.

Shouting won't help you much, btw.

--
-John Holmes-

"It ain't much, if it ain't Dutch..."

Why have you posted an *incomplete* HijackThis log,
when you have screamed not to suggest anything
that's not brand new?


On 28 Jun 2004 12:27:32 -0700, in
<c3d7271b.0406281127.3bb9c408@posting.google.com >
The Stull Demon scrawled:

<snip>

--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html

Manual Removal: follow exactly

1) Open My Computer and choose "Tools" in in the menu option, then choose
"Folder Options".
2) Click the "View" tab and under Advanced Settings set it to show "Hidden
files and folders"
3) Next press "Alt Ctrl Del" and choose the "Processes tab" to bring up a
list of running processes.
4) Click the "Image Name" button to get the processes in alphabetical order.
Scroll through the list of processes and end task on any processes that you
are unaware of or do not have anything on google (get an expert to help)
5) Next, go to Start --> Run and type "Services.msc" (without quotes) then
hit OK.
6) Scroll down in the right pane of the screen and find the service called
"Network Security Service". Double click it.
7) In the next window that opens, click the Stop button, then change the
Startup Type to Disabled. Now hit Apply and then OK and close any open
windows.
8) Run HijackThis.exe again do a scan and place a check check in the
following boxes and click on "Fix Checked":
- R1 Entries
- BHO entries
- 04 entries with random exes.
You may want an expert to assist you there.
9) Reboot into safe mode. Once in Safe Mode, delete the following files:
- R1 Entries
- BHO entries
- 04 entries with random exes.
You may want an expert to assist you there.
10) Go to Start, --> Run and type in "regedit" (without quotes) and press
"Enter".
11) In the registry, navigate to the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\ In the left pane if
you see something called "__NS_Service_3" right click on it and choose
delete.
12) Next navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\
In the left pane if you see something called "LEGACY___NS_Service_3" right
click on it and choose delete.
13) Exit regedit and reboot in Normal Mode.
14) Run Hijackthis again, if its clean, you're good to go.

Please note: The fixes above only apply to those who are being hijacked to
webpages such as res://ewfom.dll#2342 and nothing else.


--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
Sharpvision simply the best http://www.seedsv.com



"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406281127.3bb9c408@posting.google.c om...

°Mike° <qp_mike_qp@yahoo.com> wrote in message news:<40e27f47.668578@localhost>...

THE LOG IS (was) COMPLETE. I cut and pasted *EVERYTHING* that was in
the Log File into the post. I SCREAM BECAUSE *NOBODY* HAS FOUND A WAY
TO CLEAN THIS NEWEST CWS VARIANT YET! That's why. That's why I scream.

If you don't have the answers, that's OK. But please - SHUT UP (!!!)
and let someone who does have the answers answer this post. You're not
helping. The guy who wrote the CWS Shredder has *GIVEN UP*. I REPEAT:
He has quit. When the going got REALLY tough, he quit. When my Dad got
infected with the NEWEST variant of the CWS Malware, he quit. Can
someone please pick up the pieces? And can someone set up a
military-style tribunal to TRY AND CONVICT the monsters responsible
for this?

Here's what appear to be the FINAL WORDS from MERIJN THE QUITTER:

June 28, 2004:
Alright, this will be my last update for a while. I have a lot of
things going on that are not spyware-related in the next few months
and frankly I find these more important than the spyware-related
issues. I'm sorry if that offends you, but I simply don't have the
time to do both at the same time. I hope you'll understand.

NOPE. SORRY. I DON'T!!!!!!!!!!!!!!!

July 1 2004, I will be graduating from the University of Utrecht and
receive my Masters Degree in Science (chemistry, specifically).
September 1 2004, I will start a second study at the same university.
I'm not sure what the English name for this study is (in Dutch it's
Informatiekunde) but it's in the Computer Sciences field.

WHO CARES???????????!!!!!!!!!!!!!!

Right now, my email inbox is overflowing with over 2700 emails which I
can't possibly answer all. These 2700 are two-thirds of about 4000,
the remaining one-third being spam and email viruses which I've
already deleted. (For god's sake people, get some decent antivirus
protection, that's nearly 1300 emails from Windows systems infected
with email spewing trojans.)

YOU WONDER WHY?????????????!!!!!!!!!!!!! YOU HAVE LET US DOWN!!!

I will not be able to respond to your email anytime soon! Here are my
answers to the majority of emails I've gotten so far:

Q. Can you look at my HijackThis/StartupList/CWShredder log?
A. No, pick a link from the list of forums that can help you interpret
your log and ask for help there.

Q. CWShredder isn't fixing my problem!
A. While it's been easy and even fun keeping CWShredder up to date,
the recent variants are a living hell. The people who wrote the latest
variants of the trojan surpass the older variants by far.
- Resident DLLs from the about:blank, res://xxxx.dll or invisible
variants cannot be removed by CWShredder or HijackThis.
- Variants like f0r0r that are protected by Hacker Defender cannot be
removed by CWShredder or HijackThis.

Q. When will CWShredder be updated again?
A. It won't be again, probably. I have a few bugs to fix, but after
that there's not much left to do - I simply do not have the tools to
remove the latest variants, they are too agressive or complicated to
allow automated removal by CWShredder.


ARRRRRRRRRRRGGGGGHHHH!!!

QUITTER!!!

OK... let me catch my breath... ok... better now... can someone please
take over where the QUITTER left off and help get us get rid of this
latest variant of CWS? Please?

I told you how but just in case you didn't get it here it is again.

1) Open My Computer and choose "Tools" in in the menu option, then choose
"Folder Options".
2) Click the "View" tab and under Advanced Settings set it to show "Hidden
files and folders"
3) Next press "Alt Ctrl Del" and choose the "Processes tab" to bring up a
list of running processes.
4) Click the "Image Name" button to get the processes in alphabetical order.
Scroll through the list of processes and end task on any processes that you
are unaware of or do not have anything on google (get an expert to help)
5) Next, go to Start --> Run and type "Services.msc" (without quotes) then
hit OK.
6) Scroll down in the right pane of the screen and find the service called
"Network Security Service". Double click it.
7) In the next window that opens, click the Stop button, then change the
Startup Type to Disabled. Now hit Apply and then OK and close any open
windows.
8) Run HijackThis.exe again do a scan and place a check check in the
following boxes and click on "Fix Checked":
- R1 Entries
- BHO entries
- 04 entries with random exes.
You may want an expert to assist you there.
9) Reboot into safe mode. Once in Safe Mode, delete the following files:
- R1 Entries
- BHO entries
- 04 entries with random exes.
You may want an expert to assist you there.
10) Go to Start, --> Run and type in "regedit" (without quotes) and press
"Enter".
11) In the registry, navigate to the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\ In the left pane if
you see something called "__NS_Service_3" right click on it and choose
delete.
12) Next navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\
In the left pane if you see something called "LEGACY___NS_Service_3" right
click on it and choose delete.
13) Exit regedit and reboot in Normal Mode.
14) Run Hijackthis again, if its clean, you're good to go.

Please note: The fixes above only apply to those who are being hijacked to
webpages such as res://ewfom.dll#2342 and nothing else.


--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
Sharpvision simply the best http://www.seedsv.com



"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406282005.23e10dd0@posting.google.c om...

There is also a removal tool called about:Buster get it here.
http://tools.zerosrealm.com/AboutBuster.zip

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
Sharpvision simply the best http://www.seedsv.com



"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406282005.23e10dd0@posting.google.c om...

And how much did you contribute (money) to Merijn's efforts?
--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.aumha.org

What You Should Know About Spyware
http://www.microsoft.com/mscorp/twc/...y/spyware.mspx

The Stull Demon wrote:

I was holding back on replying to you, and this paste which will follow has
been sitting in my drafts folder since right after you posted (cross-posted
actually), but this latest "message" from you is the capper.

Before going any further, this tirade of yours is *completely out of order*.
Why? Well, the program CWShredder (and other great programs Merijn has
authored) are *Freeware*. You have probably not even donated a red cent to
him, yet you insult the person who has provided excellent software (free of
charge) which handled myriad pests effectively. More could be said in
addressing your poor attitude but I won't bother other readers with that.
I'm fairly certain they will have their own opinions.I will assert that you
have so much energy to rant, why not turn it into something positive, and
create a fix for this "new Variant". After you've done so, don't forget to
be as magnanimous as Merijn, and offer it to the entire world...*for free*

Now:
<paste>
1) Post logs to Spyware Info Forums; or, Net-Integration; TomCoyote;
Computer Cops; they are better suited with "personnel" and experience to
deal with HJT logs.
2) What do we know is really "old" for you? Yes, you've hinted at that which
you've tried, but have not listed *every* "old" fix that I've seen.
3) A humble approach, with less "shouting" will get you a more civilized
response.
4) Quoting your post: <paste>... this is a variant that DOES NOT have a
current fix. Understand??? <paste/>

OK...with that in mind... what would you like? If it doesn't have a fix...
why don't you create the fix which will work?

Meanwhile, this "brand new variant" isn't that new... there's a slew of
people that have gotten this for quite a while now. Try searching this
newsgroup. Try the various Spyware, and virus newsgroups; you are not
singular in this "new variant".

http://forums.spywareinfo.com/index.php?showtopic=7447
http://forums.spywareinfo.com/index.php?showtopic=7281
http://forums.spywareinfo.com/index.php?showtopic=7261
http://forums.spywareinfo.com/index.php?showtopic=8847

http://www.computercops.us/postp221606.html

http://snipurl.com/7e0a
<paste/>

And lastly, while I may have sympathy and understanding for your dear 75
year old dad, might it also not be true that many wouldn't care about that
anymore than you not caring about Merijn's "personal life" which he posted
in his Website?
<paste>
"...I will be graduating from the University of Utrecht and receive my
Masters Degree in Science..."
"WHO CARES???????????!!!!!!!!!!!!!!"
<paste/>

--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.co m

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------

This is as of YESTERDAY. You do not deserve to be informed but I'm posting
for the benefits of all others. Get the new version of AdAware and follow
these instructions.
Should be easy.

http://forums.spywareinfo.com/index.php?showtopic=8847

Quote

Ad-Aware should be file : v6.0 Build 6.181 and you should have reference
file: 01R324 22.06.2004 installed. Please update your copy of ad-aware and
boot into safe mode and run it, before posting a request for help. (How do I
boot into "Safe" mode?)

It appears that ad-aware is cleaning the files etc but not deleting the
registry entries associated with the clean so they may still show up in the
HijackThis log. If you still get the entries after booting into normal mode
and are not sure what to delete, post your log in the forum but mention what
version of ad-aware you run as well as the reference file version - This
will help in the resolution.

Also - If you request help, DO NOT reboot your computer until you receive a
response as the files change as soon as you reboot. If you receive no
response and you have rebooted - Post a new HijackThis log into your current
message - DO NOT start a new message again as we cannot keep up with all the
calls.
Unquote.

--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===
"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406282005.23e10dd0@posting.google.c om...

"H Leboeuf" <NoAddress@generation.invalid> wrote in message news:<10e2mpn4kvqbne9@corp.supernews.com>...

Seems to me that my post was not only timely and rather humorous but
it got you pseudo-geeks out there to stop posting the same old DUMB
solutions for the *NEWEST* CWS Variant.

Mission Accomplished.

Ha!!!

At any rate, whether it was one thing or a combination of running
everything on the kitchen shelf PLUS the new update from Ad-aware,
there's no sign of the CWS Malware. And it's been nearly 15 hours. I
don't think it's coming back. My Pop is a happy camper. Again. Now...
what about the Military-style TRIBUNAL for the ratbastards responsible
for the malware???!!! That's what I'm waiting for now. LISTEN UP,
CREEPS: YOUR DAYS ARE NUMBERED!!! Hangin' is too good for 'em!
RATBASTARDS.

In conclusion... all I have to say is... this...

So long, Crabby! (it's a Little Rascals reference --- look it up!)

Sincerely,
The Stull Demon
Stull Road
Stull, KS 666xx

"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406291244.7d1ae53e@posting.google.c om...
follow the money.. go see who advertises on coolweb and organize a boycott.

NewsFlash: It's *not* a "New Solution" over the "same old ones"; the *fact*
is, it is old. I posted that link in
news:emA3RchWEHA.712@TK2MSFTNGP11.phx.gbl> Thursday, June 24, 2004 12:14 PM.
Had you done all of the research you *claimed* you had, you could have
repaired it 5 days ago.

Now... don't you have some corn to plant, or some cows to milk or something,
somewhere?
--
LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.co m

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://home.satx.rr.com/badour/html/post.html
--------------------------------------------------------------------

"The Stull Demon" <kansas_666@hotmail.com> wrote in message
news:c3d7271b.0406291244.7d1ae53e@posting.google.c om...

"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.c om> wrote in message news:<OiCPgSiXEHA.3516@TK2MSFTNGP09.phx.gbl>...

NEWSFLASH (duh) --- You are COMPLETELY predictable! Here's the deal,
DUMBASS. I ran Ad-aware at least 15 times during the (US Central Time)
day on Monday. Just to play it safe, each time I ran it I did a "check
for updates now" first. Listen very carefully: AFTER EACH TIME I RAN
AD-AWARE and chose the remove option, the Cool Web Search malware was
still there the next time!!! GOT THAT? Some time late in the evening
(don't remember when it was) I ran Ad-aware again. AGAIN I chose the
"check for updates now" option. Cool Web Search was still there. But
guess what? NEXT TIME (again, late last night), after I chose "remove"
and ran it again, (AGAIN running "check for updates now") the Cool Web
Search malware WAS GONE! GOT THAT?

Listen punk, I've been running Ad-aware since you were in diapers.
Something changed late in the day yesterday. Something changed that
actually allowed Ad-aware to completely remove the malware. It's as
simple as that. I don't care what you think you know. All I know is
that the version of the Reference File (01R325 27.06.2004) that I ran
last night was, somehow, different than the ones I ran during the day.
The ones during the day, THE LATEST AVAILABLE AT THAT TIME, did NOT
remove the malware.

THIS WAS *NOT* SOMETHING THAT WAS AVAILABLE 5 DAYS AGO, YOU ASS!!! If
you were here, right now, in front of me, I would smear cheesecake all
over your face. Up your nose. IN YOUR EYES. Ya big dummy.

NOW... PISS OFF, FREAK!!!

BTW --- Before you rack your brain for any more "midwest" or "Kansas"
jokes, I'm from NEW JERSEY. You know, THE RICHEST (AND SMARTEST) STATE
IN THE NATION? You know, THE GARDEN STATE? That is my homeland. I AM A
NEW JERSEY NATIVE who happens to be here on an extended stay for work
(you know, DAY JOB) related activities.

Again:

So Long, CRABBY! And this time I really mean it...

OH ...excuse me "Bridge and Tunnel" troll (that's what we New Yorkers refer
to you Joiseyites as). Isn't that near Secaucus, Bayonne and other
odoriferous locales? I see you've stepped up in the world to the scent of a
Hog Farm which you doubtless do nothing to improve...

As for the rest of your rant Ho - ******* - Hum!

PLONK!!!!

<snipped to save useless waste of bandwidth>

"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.c om> wrote in message news:<OX3fwUlXEHA.1356@TK2MSFTNGP09.phx.gbl>...


While it's quite true that I received my MS degree from a very
prestigious engineering school in Hoboken, NJ (and did live there for
several years), MY ROOTS are in the extremely rural Northwestern part
of that tiny, peninsula-like state. I grew up in a small, very wealthy
"township" of about 2000 people (7 acre minimum, in case you were
wondering). About 5 miles from the Appalachian Trail as the crow
flies. Much more rural than probably anything you've ever experienced
and certainly NOT what outsiders would call "Joisey" --- more details
cut and pasted from elsewhere CUZ I JUST KNOW YOU *REALLY* WANT THEM:

I spent most of my 42+ years living in New Jersey (where there are
nearly 1100 people per square mile). And yes, I did live in Sussex
County (the rural, much less crowded NW portion of that tiny state). I
called it Upstate NJ. But my commute always took me down into the
congested, hellish, suburban wasteland areas of The Garden at least 5
days a week. And it wasn't pretty. I have to tell you, being way out
here IN THE MIDDLE of the entire North American continent (where there
are only about 30 people per square mile) certainly does have its
advantages. Far from what most people back east think might be some
kind of boring mid-west "cow town", Lawrence (where I live) functions
as a Cultural Mecca of sorts for the entire state (and, in fact, the
entire mid-west!). I've told people that I don't live in KANSAS - I
live in the hip, happening University Town of Lawrence.

Oh - and last year it was ranked one of the Top 10 "Smartest" towns in
the entire country --- 42.7% of the population 25 years or older have
a 4-year degree or higher.

So there!

The Stull Demon
Stull Road
Stull, KS 666xx

p.s. --- And in closing, please remember who the REAL enemies are, OK?
THE CREATORS OF THE COOL WEB SEARCH (CWS) HIJACKER. And all its
variants. HUNT THEM DOWN, TRY THEM, and CONVICT THEM. Then let us all
decide what the sentence should be...