CWS.GoogleMS.3 - Hijacker....(solucionado)

[Lezly]

[b]Por favor alguien ayudenme!!! Escanee mi PC en linea y me aparece que tengo eso instalado :



[color=darkblue]CWS.GoogleMS.3 - Hijacker....[/color]





Alguien puede decirme como lo elimino? Por Favor!!! :( [/b]

[cañera]

descargate spybot y adaware y pasalos en a modo seguro y cuando los hayas pasado pasale el spywareblaster;



los encontraras en ese link.

cuentanos como te fue.

[maura63]

Informacion al respecto



Fuente

Merijn.org



CWS.Googlems

Variant 17: CWS.Googlems - We have a payload!

Approx date first sighted: November 1, 2003

Log reference: http://forums.spywareinfo.com/index.php?showtopic=16643

Symptoms: IE pages changed to http://www.idgsearch.com/, hijack reinstalled on reboot and when running Windows Media Player.

Cleverness: 7/10

Manual removal difficulty: Involves some Registry editing, and reinstalling Windows Media Player

Identifying lines in HijackThis log:



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.idgsearch.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.idgsearch.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.idgsearch.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.idgsearch.com/

O2 - BHO: GoogleMS Search Helper - {79369D5C-2903-4b7a-ADE2-D5E0DEE14D24} - C:\Documents and Settings\[username]\Application Data\GoogleMS.dll





This variant is first of its kind, since an important development was observed here: the Windows Media Player executable was deleted and replaced by the trojan. This file reinstalled the hijack when ran. No other variants modify or delete system files, but this one seems to.

It also installs a BHO that reinstalls hijack on a reboot. Deleting GoogleMS.dll and reinstalling Windows Media Player fixes the hijack.



CWS.Googlems.2: A mutation of this variant exists that hijacks IE to idgsearch.com and 2020search.com, installs a BHO named 'Microsoft SearchWord' using the filename SearchWord.dll in the same location as the first version. It also adds *.xxxtoolbar.com to the Trusted Zone.



[color=red]CWS.Googlems.3: A mutation of this variant exists that hijacks IE to idgsearch.com, installs a BHO named 'Microsoft SearchWord' using the filename Word10.dll in the location C:\Documents And Settings\[username]\Application Data\Microsoft\Office.

This version can also be loaded by a fake Notepad.exe file in the Windows system folder. The fake file has an icon different from the default notepad one. [/color]



CWS.Googlems.4: A mutation of this variant exists that hijacks IE to idgsearch.com, 2020search.com and possibly coundnotfind.com. It installs a hosts file hijack to 69.56.223.196 (idgsearch.com), redirecting from several CWS affiliate domains (!), one Lop.com domain, one misspelled Spywareinfo domains (hehe) and several porn domains. It installs a BHO named 'Microsoft Excel' using the filename Excel10.dll, located at the same place as the third mutation. It also adds *.xxxtoolbar.com and *.teensguru.com to the Trusted Zone.



El Programa CWS te lo soluciona.



Saludos

maura63

[msc hotline sat]

Vas a ser el primero que pueda probar la nueva utilidad ELICWSA.EXE, que vamos a subir a la web cuando termine este post.



Mira en el apartado de Alertas... que vamos a publicar la nueva utilidad



saludos



ms, 25-06-2004



añadido posteriormente: https://foros.zonavirus.com/viewtopic.php?t=1459

[Lezly]

Esperando que esta informacion pueda ser de utilidad para otros que sufren del mismo problema, adjunto encontraran la direccion donde encontre la forma eliminarlo..



http://pestpatrol.com/pestinfo/c/cws.asp





Ademas baje el programa que me recomendaron ustedes y no encontro rastro alguno del virus.





Gracias al Administrador y a Maura63 por su ayuda tan pronta, y ademas efectiva. Reciban un fuerte abrazo y mis mejores deseos de que esta FAMILIA siga creciendo en verdad...Gracias! :wink:

[cañera]

ya sabes donde encontrarnos siempre que nos necesites.

solucionado el problema cerramos el tema.