Cool web search

[Dan Snow]

i have windows XP and IE 6.0 i have coolwebsearch which
keeps chqangin my pages to http:///. i ran the shredder
and did adaware and downloaded hijackthis. i want to know
what to look for when i run hijack this or any other way
to remove this

 

[H Leboeuf]

Quoted from this page. Check it out.
http://www.spywareinfo.com/~merijn/cwschronicles.html

The new version of the shredder tool should find it.

Variant 12: CWS.Svcinit - Sneaky little fellow

Approx date first sighted: September 10, 2003
Log reference: ?
Symptoms: Homepage changed to xwebsearch.biz and 'http:///', hijack
returning on reboot or even sooner.
Cleverness: 9/10
Manual removal difficulty: Involves lots of Registry editing, ini file
editing and a process killer.
Identifying lines in HijackThis log:

Running processes:
C:\WINDOWS\System32\SVCINIT.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:///
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:///
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:////
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://xwebsearch.biz
F1 - win.ini: run=C:\WINDOWS\svcinit.exe
O4 - HKLM\..\RunServices: [SVC Service] C:\WINDOWS\SYSTEM\svcinit.exe
O4 - HKLM\..\Run: [mssys] C:\WINDOWS\mssys.exe

 

[Dan Snow]

i have tried to find all of those listed hijacks but
there is non on my pc what can i do now??

 

[H Leboeuf]

You deleted the content of the thread.
Do not know what you did or what is your problem.

This is the ultimate. Get help from this forum.


Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html