CWShredder update (for those interested, or infected... )

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

TonyKlein

Thread Starter
Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
Update: CWShredder 1.14

* Fixed a bug in removing domains from the Trusted Zone
* Windows version shows Service Pack now (SP1a systems have no MS Java VM)
* Included check for Q816093 hotfix (ByteVerifier patch)
* Added support for removing the MadFinder BHO + BHO installer (Browserhelper.dll/svc.exe)
* Scrambled EXE headers to prevent unpacking
* 350 affiliate domains on the blacklist!


http://www.spywareinfo.com/~merijn/files/cwshredder.zip

And for those interested, the entire list of CoolWebSearch affiliates now targeted by CWShredder

Items preceded by * yet to be added.

\search.html (local file)
\searchbar.html (local file)
\securityID
008k.com
00hq.com
193.125.201.50
1sexparty.com
1stpagehere.com
36site.com
4corn.net
66.117.14.138
66.250.130.194
8ad.com
adamsupportgroup.org
adasearch.com
adult-friends-finder.net
adulthyperlinks.com
adulttds.com
akril.com
allcybersearch.com
allhyperlinks.com
amandamountains.com
amigeek.com
annaromeo.com
antrocity.com
approvedlinks.com
apsua.com
arizonaweb.org
armitageinn.com
art-func.com
avian-ads.com
ayakawamura.com
ayumitaniguchi.com
bannedhost.net
barbudafarms.com
barnandfence.com
batsearch.com
baygraphicsllc.com
bb-search.com
bbbsearch.com
bediadance.com
bernaolatwin.com
best-hardpics.com
bestcrawler.com
bodaciousbabette.com
boobdoll.com
boobsandtits.com
boobsclub.com
brandiyoung.com
brookeburn.com
bucps.com
bustyrussell.com
canberracricketcoaching.com
candycantaloupes.com
cantfind.com
carsands.com
catsss.da.ru
chriswallace.net
clackamasliteraryreview.com
clickyestoenter.net
cmtapestry.com
cool-web-search.com
coolfreepage.com
coolfreepages.com
coolmoneysearch.com
coolpornsearch.com
coolsearcher.info
coolwebsearch.
coolwebsearsh.com
coolwwwsearch.
couldnotfind.com
crooder.com
curvedspaces.com
* datanotary.com
defaultsearch.net
desarrollocreativo.com
dev.ntcor.com
develip.com
dewis.us
df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
diet*****.com
document-not-found.pornpic.org
domkrat.com
drvvv.com
dutch-sex.com
e-localad.com
e-websitesolutions.com
easy-search.net
ecstasyporn.net
eikokoike.com
epornsex.com
evidence-detector.biz
ewebsearch.net
extremeseek.net
f*cknicepics.com
faithstevens.com
fantasiewelten.com
fastwebfinder.com
faxporn.com
find-uk-health.co.uk
findloss.com
findthesite.com
findwhat.com
fionasteel.com
firstbookmark.net
forsythfire.net
free-f*cking-video.com
free-hit.com
free-sex-movie-clips.net
freebookmark.net
freebookmarks.net
freerbhost.com
freewebs.com
freshseek.com
galpostgirls.com
gay50.com
generalsmeltingofcanada.com
geteens.com
global-finder.com
globesearch.com
gocybersearch.com
goodsexs.com
gratis-porn-movie.com
gratis-pornopics.com
guzzycats.com
gzphoenix.com
hallnetaccolade.com
hardloved.com
hardwareseek.net
harukaigawa.com
hentai4u.net
heyrichy.com
hi-search.com
hotbookmark.com
hotelxxxcams.com
hotpopup.com
hotsearchbox.com
hotstartpage.com
hqsex.biz
hugeporn4u.net
hunacsa.com
hupacasath.com
hzsx.com
ie-search.com
infodigger.net
internetsearch.ru
ionichost.com
* ionomist.com
itseasy.us
iweb-commerce.com
iwebland.com
jeannineoldfield.com
jethomepage.com
jetseeker.com
jmhgallery.org
joannelatham.com
kathisomers.com
kazaa-lite.ws
kimhines.com
kinoru.com
landrape.com
lauraroebuck.com
leannalovelace.com
lisamatthew.com
liveholio.com
louiseleeds.com
love-pix.com
lovelas.com
lunitaweb.net
lustful-porno.com
madfinder.com
madisonmoons.com
madonalive.com
majuozawa.com
makin-do.com
male4free.com
map-quest.org
marilynchamber.com
martfinder.com
mature50.com
mcgeeforlabor.com
megumikanzaki.com
meshalynn.com
meta-casino.com
meta-mobile.com
michiyonakajima.com
miconsultamedica.com
mikasakamoto.com
millennialpeople.org
mommykiss.com
montgomeryhospitalanesthesia.com
morflot.com
moscowwhores.com
mp3-pix.com
msn-info.net
multi*****.com
mundopolar.com
mywebsearch.net
netshastra.net
netyellowpages.info
new-incest.com
newcracks.com
newcracks.net
newlife-lajolla.com
newsexgate.com
niche-tv.com
noblindlinks.com
nocensor.com
nursemania.com
oborot.com
ocalalivestockmarket.com
oharrowsearch.com
ok-search.com
okulta.com
omegabrains.net
online-casino-bonus.info
opsex.com
otrlives.com
ozawamadoka.com
paigesummer.com
pamelacollections.com
panamcup.com
pantyhoserealm.com
pantyplace.com
pastubes.com
paulapage.com
paulhoover.com
payfortraffic.net
pedo.ws
pharmalocator.com
pics-videos.com
pillsmall.com
pixpox.com
polradiologia.com
pooi.net
porn-teacher.com
porncamz.com
pornfree.info
porntetris.com
pribalt.com
privacy-support.biz
prostactive.com
prostol.com
protect-yourself.biz
prsainlandempire.org
ramgo.com
ranafrog.net
robbsproshop.com
runsearch.com
russiansponsor.com
russogay.com
s2.exocrew.com
scarypix.com
schoolforest.com
search-2003.com
search-hawk.com
search.xrenoder.com
searchbutler.org
searchcomplete.com
searchdesire.com
searchexpander.com
searchfastnet.com
searchforge.com
searching-the-net.com
searchmeta.net
searchmeta.ru
searchnow.ws
searchonfly.com
searchv.com
searchxl.com
searchxp.com
securenp.org
security-warning.biz
seehardcore.com
seekwell.net
sex-coach.com
sex-festival.com
sex-video-galleries.com
sexgalleries4all.com
sexmoviesnet.com
sexycat.adult-host.org
sharempeg.com
shopknights.com
sitevictoria.com
sixroads.com
slawsearch.com
slotch.com
smartsumo.com
smutarchive.net
spros.com
staceyowens.com
stacistaxx.com
stacystaxx.com
sterva.com
stevecashdollar.com
stop-tracking.biz
stopxxxpics.com
strekoza.com
* stuffstore.com
summercollins.com
super-spider.com
super-websearch.com
supersexmachine.com
superwebsearch.com
supret.com
suzannebrecht.com
tacil.org
tangounion.com
tastethemusic.com
tech-jobs.ws
the-exit.com
the-huns-yellow-pages.com
thefakejournal.com
therealsearch.com
thornleygroup.com
tinybar.com
tit-x.com
titanvision.com
titsianna.com
tooncomics.com
topsearcher.com
true-counter.com
ufindall.click-now.net
une-autre-france.com
unipages.cc
urlstat.com
utahsweet.com
v61.com
veloventures.com
verzila.com
victoriaadam.com
watersport-specialties.com
web-search.tk
webcoolsearch.com
websearchdot.com
whatsyoursearch.com
white-pages.ws
whittierblvd.com
wiresearch.com
wspzone.sexpornonline.com
x-library.com
xic-bs.com
y-e-l-l-o-w.com
yellow500.com
youfindall.com
youfindall.net
yourbookmarks.info
yourbookmarks.ws
ysa-info.net
yukohamano.com
zapros.com
znext.com
zoneoffreeporn.com
zoomegasite.com
zvimigdal.com
 
Joined
Jun 19, 2003
Messages
1,241
Dittoing Steve,

Cheers, although that does make my favourites folder somewhat thinner.. :D:D

And could I add, to anyone wanting to visit these sites out of curiosity, that the main reason that there are twenty or so people putting in the hours here, is precisely because of people's er.. innocent curiosity. :)

So don't go there, unless you want one of us to be checking your HJT log in a couple of days time!!!!

Cheers

Liam
 
Joined
Mar 9, 2003
Messages
4,699
Liam, did you check your log?? :D :D Just kidding


That list is like, "the sites you have always wondered about, but were afraid to ask" :D
 
Joined
Oct 9, 2001
Messages
9,396
Originally posted by NiteHawk:
Liam, did you check your log?? :D :D Just kidding


That list is like, "the sites you have always wondered about, but were afraid to admit to" :D
 

TonyKlein

Thread Starter
Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
Originally posted by BlueSpruce:
Thanks TonyKlein ,

The CoolWebSearch affiliate list is disturbing to say the least
Yeah, and we already have another 9 brand new ones lined up.... :rolleyes:

BTW, we have another first for you:

Merijn just happened upon an all new CoolWebSearch related file:

O4 - HKLM\..\Run: [CTFMON32.EXE] "C:\WINDOWS\System32\ctfmon32.exe

See this thread:

http://forums.spywareinfo.com/index.php?showtopic=11886&hl=ctfmon32\.exe

Quoting him:

"There seems to be a new variant of CoolWebSearch that comes from affiliate slawsearch (the one that originally had a local webserver). It runs on boot from CTFMON32.EXE and changes a dozen reg values to slawsearch.com links, as well as setting itself up to run at boot, and adding an obscure value that's probably a affiliate ID."

CWShredder will be updated again tomorrow in order to include this one.
 
Joined
Aug 18, 2003
Messages
128
I spend 3 hours with most avalibility tools, but no one helped me. 'CoolWebSearch' was still 'reanimated' as a home page each times I reboot my system.

I downloaded/updated last CWShredder v 1.14. Great!! Help me 100%.

Thank you Tony!
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top