CWS combo trojan

[Rockman]

"Hijack This" a Canadian spyware removeal tool has
detected CWS combo trojan on my computer. Spybot,
AdAware and Antispyware beta 1 showed the machine to be
clean.
I suspect that "Hijack This" will always find something
(the scan is free, cleaning is pricy).

Does anyone know if Antispyware will detect and remove
this spyware?

Thanks

 

[Bill Sanderson]

Explain this statement about removal having a cost?

The HijackThis application I'm familiar with is free, and there are many
volunteers, some of whom also frequent these groups, who will help you
remove this for free.

I suspect that HijackThis is probably correct.

I don't know whether Microsoft Antispyware will remove your bug or
not--quite possibly not.

Here's a suggestion for a way to proceed:

Download and install Microsoft Antispyware. Update the definitions via
File, check for updates.

Scan your machine.

If you have Kazaa or another peer-to-peer application installed, please
physically move your music or other shared store before cleaning.

Remove everything Microsoft Antispyware finds.

Restart in Safe mode by pressing the F8 function key before the initial
Windows screen appears, and clean everything found in that mode.

Check through ALL of the system explorers and look for either strangely
named items, or BHO's or toolbars listed as unknown by Microsoft
Antispyware, and which aren't known to you either. Block or remove such
items.

If, once you restart normally, your symptoms aren't gone:

Submit a Tools, suspected spyware report via Microsoft Antispyware.

Go to this third party forum, run by Microsoft MVP James Eshelman:

http://www.aumha.org/a/quickfix.htm

Follow his "recipe" for removal. You will likely reach a point where you
are stuck, and his list will recommend HijackThis and a forum on his board
to post the log for expert help. Do that.

There are folks who can deal with such logs here as well, but you are better
off in a specialized forum--and nobody should ask you for any money,
although Jim does accept contributions, I believe.

I should also mention that there are folks who provide guided cleaning
services for money--entirely reputably--with costs stated up front. The
author of the extremely useful "Silent Runners.VBS" is one such person. You
can use his tool to get your system clean yourself, or you can pay him to
help you out--the choice is entirely yours, and there's nothing under the
table or not clearly stated about this--he provides the tool for free for
anyones use, but if you need his time and expertise, it is available for (as
I recall, a fixed price)

 

[Ron Kinner]

Sounds like you have come across what they call a Rogue
AntiSpyware application that is using a name similar to
the real HijackThis. They give you a free scan and then
tell you you have all sorts of nasties that they will
remove for a price. Report them to the people at:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Get the real HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment. Put Hijack in the subject
so I'll know it's not spam. I'll tell you if you have a
problem or not and what to do about it.

Ron Kinner
Microsoft MVP 2004 & 2005
(e-mail address removed)