CnsMin introduced in by 3721(yahoo assist)?

[Guest]

AntiSpyware detects CnsMin at my computer and always suffers to delete that
spyware. (I checked my installed application and the chinese version yahoo
assist seems to be the most suspicious one. I tried to uninstall and it does
not go through at all.) So I did some search online and it seems that there
is a 3721 assist IE plugin that did all these dirty things.

The 3721 installed a device driver CnsMinkP.sys under system32\drivers and
several files under windows\downloaded Program Files. These helps to make
itself restored each time you reboot your system after you deleted those
registery entries.

Anyone has any clue to delete this rogue software plugin please?

 

[Guest]

Hello Arthur,

Try running;
Ewido and Ccleaner.
http://castlecops.com/t137442-CCSP_Ewido_Install_and_Scan_Instructions.html

www.ccleaner.com

Also read this 2 posts:
Subject: My system
10/23/2005 9:27 PM PST
By: Don Warden
In: microsoft.private.security.spyware.general

Subject: antispyware in CHINA
11/24/2005 1:50 AM PST
By: dhsoft
In: microsoft.private.security.spyware.onlinecommunity

I hope this post is helpful, let us know how it works ºut.
Engel

 

[Guest]

Hi Arthur,

Steps to take if you have spyware that is not removed by Microsoft Windows
AntiSpyware (betª)
1) Open up AntiSpywªre
2) Click Tools at the tºp
3) Click "Submit a Suspected Spyware Repºrt"
4) Fill out the form with as much detail so they can anªlyze quickly.

Engel

 

[Guest]

Hi Arthur

I made a fixtool for CnsMin/Yahoo Assistant yesterday after testing their
program. Ive included the Chinese Yahoo Assistant as they appear to own
CnsMin plus the add/remove screen entry for Yahoo Assistant is useless for
western users as it just shows '????' and links to a chinese website if
pressed. If I run the setup file for CnsMin (Chinese Keywords) it shows
"Beijing Yahoo Consulting and Service Co. Ltd" in the file properties.

CnsMin is probably very usefull to Chinese users but it has so many hooks
onto the system that prevent removal its understandable why it could be
regarded as malware, After installing CnsMin/Yahoo Assistant the pc was
noticeably slower and has also crashed twice with BSOD errors,

It has hidden services which make it also run in safe mode which protect the
other files from removal, an Autoupdater always enabled and a 'Self-Repair'
function to automatically replace missing files, Because most of the CnsMin
files are dll it uses Rundll32.exe to conceal its presence in task manager
and if one of the files are killed its immediatly restarted by another CnsMin
file so this could be causing Microsoft's scanner to enter a loop and keep
removing the same files

It also hides its files from Windows Explorer, If I check the Downloaded
Program Files folder it will not show any CnsMin entries and only lists the
other genuine files in there, If I then use the command prompt and check the
Downloaded Program File directory it shows many Cns and 3721 files stored.

The fixtool should only be used If you do not want CnsMin / Yahoo Assistant
installed on the pc anymore,

Download CnsFix here:

http://downloads.andymanchesta.com/1/CnsFix.zip

Save to Desktop and extract then double click CnsFix.bat to start the
removal, follow the on screen prompts and when its finished it will open a
log showing what files existed and what remains, If its shows files remaining
on the system reboot and run the fixtool again to make sure it then shows
clear. The fixtool will first attempt to run the CnsMin uninstaller then
remove the services, next it checks what files exist and writes the details
to the logfile (files.txt) , it will then unregister the dll files and
removes the CnsMin/Yahoo Assistant files, directories and registry entries
then does a final check for remaining files and writes that into the log.

That should fully remove CnsMin/Yahoo Assistant but let me know if you have
any problems or questions (My email address is displayed on the first screen
of the fixtool)

All The Best

Andy