Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
If you find this one, get the removal tool.
CoolWebSearch - CWS
http://www.spywareinfo.com/articles/cws/
More: Where a removal program is available.
http://www.spywareinfo.com/~merijn/cwschronicles.html
Direct Download: If the site is not available.
http://216.180.252.218/~spywareinfo.com/downloads/tools/cwshredder.zip
Problems: Google/Yahoo/MSN redirections. Massive IE slowdown, especially
when typing text into forms.
Redirected any URLs starting without ‘
http://’ or 'www'.
This virus will play havoc with Yahoo and others.
http://www.f-secure.com/v-descs/delude.shtml
NAME: Delude
ALIAS: Trojan.BAT.Startpage.a
Delude is a trojan that is available on a web page. The web page contains a
code that uses a vulnerability in the Internet Explorer (MS03-032) to
execute.
More information about the vulnerability, including a fix, is available from
Microsoft at:
http://www.microsoft.com/security/security_bulletins/ms03-032.asp
VARIANT: Delude.A
The HTA code available on a web page downloads a file "partyboy.exe" from an
ftp site and runs it. This file is is packed with UPX. It is a batch file
which was compiled to executable binary (".exe") using a BatToExe tool.
When executed, it changes the Internet Explorer start page to find-now.info.
It prevents access to the most major search engines such as Google, Yahoo,
Lycos, MSN and AltaVista. To do this it replaces the following file:
