Re: Spyware Removal

From: Touch Base (animals_at_thezoo.com)
Date: 08/29/04 

Date: Sun, 29 Aug 2004 20:31:06 +1000

Your infection could be a new CoolWebSearch (CWS) hijack infection and is
hard to remove.

Note: Every time you reboot the files multiply and change names. This
process is like exterminating cockroaches.

Please download the tool called about:buster from:
http://www.downloads.subratam.org/AboutBuster.zip
or
http://www.majorgeeks.com/download4289.html

Unzip it to your desktop.
In WinME/XP turn off System Restore.
http://www.arnoldco.com/help/html/disable_restore.html

Important steps to getting this tool to work properly:

First unzip all files from the zip folder to a folder or your desktop. Run
AboutBuster.exe.
Then hit Ok, note that there is now an update button. Hit update and 'Check
for Update'.
If there is a newer version hit 'Download Update'. Wait while it downloads
then hit Start.

Then reboot into Safe Mode by tapping F8 key repeatedly during bootup.
Enable System Restore after the infection is removed.

Now for the scanning part. Run AboutBuster.exe Hit start and then Ok. The
program should start scanning.
This will scan your computer for the bad files and delete them. Then hit
exit and reboot into safe mode.

Run about:Buster again in safe mode to check that no remaining files remain.

The database will be updated very frequently so check your versions once a
day.

Install the prevention protection below:

Download and install WinPatrol.
http://www.winpatrol.com

Browser settings for increased security:
http://bshagnasty.home.att.net/browsersettings.htm

Install IE-SPYAD then run the install.bat in the ie-spyad folder and
download SpywareBlaster
https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD
http://www.javacoolsoftware.com/spywareblaster.html

"Newsgroup" <hrk_@hotmail.com> wrote in message
news:eyPcVaZjEHA.3972@tk2msftngp13.phx.gbl...
>I have a virus/Trojan 'type' of software that I can not get rid
> off --CWS.Yexe
>
> I have all the software, CWShredder (latest version), Norton's, Ad-ware,
> Zone Alarm etc.. but I can not get rid off this virus!!!
>
> This virus starts an iexplorer page by itself, that one can not see,
> therefore it works in the back ground without anyone knowing. In the task
> manager though you can see it under applications; therefore, now I control
> it by not allowing iexplorer to connect through zone alarm. But this is
> only a temp solution.
>
> I have booted in safe mode, used CWShredder and removed the virus but it
> keeps coming back every-time the machine is rebooted. Why are not the
> above
> programs working to mitigate this threat on my PC and what other method
> can
> I apply?
>
> Thanks in advance for the help.
>
>