winshow.dll and third party setting

[Tudor]

Hi,

i'm experiencing a problem with IE6 on Win XP.
I red some useful articles on where this may come from.
It's about SpyWare but I don't understand the meaning and the
difference betwen
- "disable third party extensions" in the IE advanced settings (what
does it do? what is this setting). This worked OK (i can launch IE
now) but what is its role?

- some say (good advice) to unisatlle some dll s and some registers,
everything is well explained and PestPatrol explains it ok.

In principal, there is this "winshow.dll" or "winlink.dll" that
should be installed and also somme registers.

But, I DON'T FIND anywhere on my computer these dll s.
Neither in system, nor in windows, or in syst32. Not does the
"regsvr32 /u" command works, it doesn't find these dll s to "load"
them.

Can somebody explain me how the setting works and secondly, where are
these dlls hidden (if they exist on my computer. I assume they are
since I have this problem like many others: unable to launch IE, or
any pop-up (error message))


I would prefere to do a register clean up than to unckek that setting.
But then again, I cannot judge what option is the best.

Thanks

 

[Ramesh [MVP]]

Tudor,

By disabling third-party browser extensions, you're telling Internet Explorer not to load any of the third-party plugins, Browser Helper Objects and Toolbars. But, they are still in the system.

See if the DLL file exists in the system by doing a file search. Type the Regsvr32 /u <filename> with the exact path. Open a Command Prompt window and unregister the COM object.

If not, post the error-report LOG and Mod Name as displayed in the screen. To pinpoint the malware Browser Helper Object, you may use ToolbarCop available here: http://www.mvps.org/sramesh2k/toolbarcop.htm
[Using ToolbarCop to remove the unwanted Toolband, Toolbar Icons and BHO]. Disable the Browser Helper Objects one by one and see if you are able to load Internet Explorer [*With the third-party extensions enabled*]

WinShow.dll malware can be removed by CWShredder utility available from www.majorgeeks.com. It kills all the CoolWebSearch variants.

To prevent spyware from being installed:
-----------------------------------------
How to guard against CoolWebSearch spyware:
http://www.mvps.org/sramesh2k/Defend_CWS.htm

Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines:
http://mvps.org/winhelp2002/unwanted.htm

Prevent malware from being installed
http://www.mvps.org/sramesh2k/Malware_Defence.htm

--
Ramesh - Microsoft MVP
www.mvps.org/sramesh2k
----------------------------------------
Free Online Virus Scanners and Security Tests:
http://www.mvps.org/sramesh2k/Scanners.htm
----------------------------------------


Hi,

i'm experiencing a problem with IE6 on Win XP.
I red some useful articles on where this may come from.
It's about SpyWare but I don't understand the meaning and the
difference betwen
- "disable third party extensions" in the IE advanced settings (what
does it do? what is this setting). This worked OK (i can launch IE
now) but what is its role?

- some say (good advice) to unisatlle some dll s and some registers,
everything is well explained and PestPatrol explains it ok.

In principal, there is this "winshow.dll" or "winlink.dll" that
should be installed and also somme registers.

But, I DON'T FIND anywhere on my computer these dll s.
Neither in system, nor in windows, or in syst32. Not does the
"regsvr32 /u" command works, it doesn't find these dll s to "load"
them.

Can somebody explain me how the setting works and secondly, where are
these dlls hidden (if they exist on my computer. I assume they are
since I have this problem like many others: unable to launch IE, or
any pop-up (error message))


I would prefere to do a register clean up than to unckek that setting.
But then again, I cannot judge what option is the best.

Thanks

 

[Mike Burgess]

Tudor,
You should NOT attempt to remove these files and Registry entries manually.
There are tools for this ....... "winshow.dll" and "winlink.dll" =
Coolwebsearch

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
[more info]
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_WINSHOW.A&VSect=T
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-24-04]
Please post replies to this Newsgroup, email address is invalid