1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

CWShredder update (for those interested, or infected... )

Discussion in 'Virus & Other Malware Removal' started by TonyKlein, Sep 22, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. TonyKlein

    TonyKlein Malware Specialist Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Update: CWShredder 1.14

    * Fixed a bug in removing domains from the Trusted Zone
    * Windows version shows Service Pack now (SP1a systems have no MS Java VM)
    * Included check for Q816093 hotfix (ByteVerifier patch)
    * Added support for removing the MadFinder BHO + BHO installer (Browserhelper.dll/svc.exe)
    * Scrambled EXE headers to prevent unpacking
    * 350 affiliate domains on the blacklist!


    http://www.spywareinfo.com/~merijn/files/cwshredder.zip

    And for those interested, the entire list of CoolWebSearch affiliates now targeted by CWShredder

    Items preceded by * yet to be added.

    \search.html (local file)
    \searchbar.html (local file)
    \securityID
    008k.com
    00hq.com
    193.125.201.50
    1sexparty.com
    1stpagehere.com
    36site.com
    4corn.net
    66.117.14.138
    66.250.130.194
    8ad.com
    adamsupportgroup.org
    adasearch.com
    adult-friends-finder.net
    adulthyperlinks.com
    adulttds.com
    akril.com
    allcybersearch.com
    allhyperlinks.com
    amandamountains.com
    amigeek.com
    annaromeo.com
    antrocity.com
    approvedlinks.com
    apsua.com
    arizonaweb.org
    armitageinn.com
    art-func.com
    avian-ads.com
    ayakawamura.com
    ayumitaniguchi.com
    bannedhost.net
    barbudafarms.com
    barnandfence.com
    batsearch.com
    baygraphicsllc.com
    bb-search.com
    bbbsearch.com
    bediadance.com
    bernaolatwin.com
    best-hardpics.com
    bestcrawler.com
    bodaciousbabette.com
    boobdoll.com
    boobsandtits.com
    boobsclub.com
    brandiyoung.com
    brookeburn.com
    bucps.com
    bustyrussell.com
    canberracricketcoaching.com
    candycantaloupes.com
    cantfind.com
    carsands.com
    catsss.da.ru
    chriswallace.net
    clackamasliteraryreview.com
    clickyestoenter.net
    cmtapestry.com
    cool-web-search.com
    coolfreepage.com
    coolfreepages.com
    coolmoneysearch.com
    coolpornsearch.com
    coolsearcher.info
    coolwebsearch.
    coolwebsearsh.com
    coolwwwsearch.
    couldnotfind.com
    crooder.com
    curvedspaces.com
    * datanotary.com
    defaultsearch.net
    desarrollocreativo.com
    dev.ntcor.com
    develip.com
    dewis.us
    df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
    diet*****.com
    document-not-found.pornpic.org
    domkrat.com
    drvvv.com
    dutch-sex.com
    e-localad.com
    e-websitesolutions.com
    easy-search.net
    ecstasyporn.net
    eikokoike.com
    epornsex.com
    evidence-detector.biz
    ewebsearch.net
    extremeseek.net
    f*cknicepics.com
    faithstevens.com
    fantasiewelten.com
    fastwebfinder.com
    faxporn.com
    find-uk-health.co.uk
    findloss.com
    findthesite.com
    findwhat.com
    fionasteel.com
    firstbookmark.net
    forsythfire.net
    free-f*cking-video.com
    free-hit.com
    free-sex-movie-clips.net
    freebookmark.net
    freebookmarks.net
    freerbhost.com
    freewebs.com
    freshseek.com
    galpostgirls.com
    gay50.com
    generalsmeltingofcanada.com
    geteens.com
    global-finder.com
    globesearch.com
    gocybersearch.com
    goodsexs.com
    gratis-porn-movie.com
    gratis-pornopics.com
    guzzycats.com
    gzphoenix.com
    hallnetaccolade.com
    hardloved.com
    hardwareseek.net
    harukaigawa.com
    hentai4u.net
    heyrichy.com
    hi-search.com
    hotbookmark.com
    hotelxxxcams.com
    hotpopup.com
    hotsearchbox.com
    hotstartpage.com
    hqsex.biz
    hugeporn4u.net
    hunacsa.com
    hupacasath.com
    hzsx.com
    ie-search.com
    infodigger.net
    internetsearch.ru
    ionichost.com
    * ionomist.com
    itseasy.us
    iweb-commerce.com
    iwebland.com
    jeannineoldfield.com
    jethomepage.com
    jetseeker.com
    jmhgallery.org
    joannelatham.com
    kathisomers.com
    kazaa-lite.ws
    kimhines.com
    kinoru.com
    landrape.com
    lauraroebuck.com
    leannalovelace.com
    lisamatthew.com
    liveholio.com
    louiseleeds.com
    love-pix.com
    lovelas.com
    lunitaweb.net
    lustful-porno.com
    madfinder.com
    madisonmoons.com
    madonalive.com
    majuozawa.com
    makin-do.com
    male4free.com
    map-quest.org
    marilynchamber.com
    martfinder.com
    mature50.com
    mcgeeforlabor.com
    megumikanzaki.com
    meshalynn.com
    meta-casino.com
    meta-mobile.com
    michiyonakajima.com
    miconsultamedica.com
    mikasakamoto.com
    millennialpeople.org
    mommykiss.com
    montgomeryhospitalanesthesia.com
    morflot.com
    moscowwhores.com
    mp3-pix.com
    msn-info.net
    multi*****.com
    mundopolar.com
    mywebsearch.net
    netshastra.net
    netyellowpages.info
    new-incest.com
    newcracks.com
    newcracks.net
    newlife-lajolla.com
    newsexgate.com
    niche-tv.com
    noblindlinks.com
    nocensor.com
    nursemania.com
    oborot.com
    ocalalivestockmarket.com
    oharrowsearch.com
    ok-search.com
    okulta.com
    omegabrains.net
    online-casino-bonus.info
    opsex.com
    otrlives.com
    ozawamadoka.com
    paigesummer.com
    pamelacollections.com
    panamcup.com
    pantyhoserealm.com
    pantyplace.com
    pastubes.com
    paulapage.com
    paulhoover.com
    payfortraffic.net
    pedo.ws
    pharmalocator.com
    pics-videos.com
    pillsmall.com
    pixpox.com
    polradiologia.com
    pooi.net
    porn-teacher.com
    porncamz.com
    pornfree.info
    porntetris.com
    pribalt.com
    privacy-support.biz
    prostactive.com
    prostol.com
    protect-yourself.biz
    prsainlandempire.org
    ramgo.com
    ranafrog.net
    robbsproshop.com
    runsearch.com
    russiansponsor.com
    russogay.com
    s2.exocrew.com
    scarypix.com
    schoolforest.com
    search-2003.com
    search-hawk.com
    search.xrenoder.com
    searchbutler.org
    searchcomplete.com
    searchdesire.com
    searchexpander.com
    searchfastnet.com
    searchforge.com
    searching-the-net.com
    searchmeta.net
    searchmeta.ru
    searchnow.ws
    searchonfly.com
    searchv.com
    searchxl.com
    searchxp.com
    securenp.org
    security-warning.biz
    seehardcore.com
    seekwell.net
    sex-coach.com
    sex-festival.com
    sex-video-galleries.com
    sexgalleries4all.com
    sexmoviesnet.com
    sexycat.adult-host.org
    sharempeg.com
    shopknights.com
    sitevictoria.com
    sixroads.com
    slawsearch.com
    slotch.com
    smartsumo.com
    smutarchive.net
    spros.com
    staceyowens.com
    stacistaxx.com
    stacystaxx.com
    sterva.com
    stevecashdollar.com
    stop-tracking.biz
    stopxxxpics.com
    strekoza.com
    * stuffstore.com
    summercollins.com
    super-spider.com
    super-websearch.com
    supersexmachine.com
    superwebsearch.com
    supret.com
    suzannebrecht.com
    tacil.org
    tangounion.com
    tastethemusic.com
    tech-jobs.ws
    the-exit.com
    the-huns-yellow-pages.com
    thefakejournal.com
    therealsearch.com
    thornleygroup.com
    tinybar.com
    tit-x.com
    titanvision.com
    titsianna.com
    tooncomics.com
    topsearcher.com
    true-counter.com
    ufindall.click-now.net
    une-autre-france.com
    unipages.cc
    urlstat.com
    utahsweet.com
    v61.com
    veloventures.com
    verzila.com
    victoriaadam.com
    watersport-specialties.com
    web-search.tk
    webcoolsearch.com
    websearchdot.com
    whatsyoursearch.com
    white-pages.ws
    whittierblvd.com
    wiresearch.com
    wspzone.sexpornonline.com
    x-library.com
    xic-bs.com
    y-e-l-l-o-w.com
    yellow500.com
    youfindall.com
    youfindall.net
    yourbookmarks.info
    yourbookmarks.ws
    ysa-info.net
    yukohamano.com
    zapros.com
    znext.com
    zoneoffreeporn.com
    zoomegasite.com
    zvimigdal.com
     
  2. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
    thanx for the info tony
    (y)
     
  3. e-liam

    e-liam

    Joined:
    Jun 19, 2003
    Messages:
    1,242
    Dittoing Steve,

    Cheers, although that does make my favourites folder somewhat thinner.. :D:D

    And could I add, to anyone wanting to visit these sites out of curiosity, that the main reason that there are twenty or so people putting in the hours here, is precisely because of people's er.. innocent curiosity. :)

    So don't go there, unless you want one of us to be checking your HJT log in a couple of days time!!!!

    Cheers

    Liam
     
  4. NiteHawk

    NiteHawk

    Joined:
    Mar 9, 2003
    Messages:
    4,699
    Liam, did you check your log?? :D :D Just kidding


    That list is like, "the sites you have always wondered about, but were afraid to ask" :D
     
  5. NiteHawk

    NiteHawk

    Joined:
    Mar 9, 2003
    Messages:
    4,699
    Tony, thanks once again for sharing your knowledge and wisdom. (y) (y)
     
  6. bassetman

    bassetman Moderator (deceased) - Gone but never forgotten

    Joined:
    Jun 7, 2001
    Messages:
    47,973
    Thanks Tony! :D
     
  7. BlueSpruce

    BlueSpruce

    Joined:
    Jul 24, 2003
    Messages:
    420
    Thanks TonyKlein ,

    The CoolWebSearch affiliate list is disturbing to say the least
     
  8. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
     
  9. TonyKlein

    TonyKlein Malware Specialist Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Yeah, and we already have another 9 brand new ones lined up.... :rolleyes:

    BTW, we have another first for you:

    Merijn just happened upon an all new CoolWebSearch related file:

    O4 - HKLM\..\Run: [CTFMON32.EXE] "C:\WINDOWS\System32\ctfmon32.exe

    See this thread:

    http://forums.spywareinfo.com/index.php?showtopic=11886&hl=ctfmon32\.exe

    Quoting him:

    "There seems to be a new variant of CoolWebSearch that comes from affiliate slawsearch (the one that originally had a local webserver). It runs on boot from CTFMON32.EXE and changes a dozen reg values to slawsearch.com links, as well as setting itself up to run at boot, and adding an obscure value that's probably a affiliate ID."

    CWShredder will be updated again tomorrow in order to include this one.
     
  10. Ksiaze

    Ksiaze

    Joined:
    Aug 18, 2003
    Messages:
    128
    I spend 3 hours with most avalibility tools, but no one helped me. 'CoolWebSearch' was still 'reanimated' as a home page each times I reboot my system.

    I downloaded/updated last CWShredder v 1.14. Great!! Help me 100%.

    Thank you Tony!
     
  11. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/166603

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice