coolweb related issue

[ADoozer]

apologies if this is a repeat post (search is down)

a friend has enquired about a new possible coolwebsearch trojan?!?

i suggested the usual CWShredder, spybot, adaware etc but he says they didnt work...

few quotes:
"it keeps regenerating itself"
"it changes it's name after every regeneration"
"first, odbc.ini"
"shows up in the process window)"
"wont let u end process"
"i deleted that file"
"then it became soap bubbles.bmp"
"found a hidden DLL that contained some hijack code"
"a program keeps respawning itself after I delete it (in system32)"
"found it in services.msc once"
"deleted it, then couldnt find it again"

any idea what? (apologise if its vague, im quoting an msn convo)

If somethings hard to do, its not worth doing - Homer Simpson
adoozer.servebeer.com

 

[diogenes10]

I'm thinking it was around June the hidden dll problems started showing up. It's only in the last few weeks better fixes have been emerging.

I have not tried to follow this through carefully, but I think this is a complete fix thread

http://forum.gladiator-antivirus.com/index.php?showtopic=17434&hl=

And this program is now the one recommended to get the service names.
Getservice.zip

http://www.bleepingcomputer.com/files/spyware/getservice.zip

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[ADoozer]

still not heard back from the guy.. so no idea if this cured the problems... thanks all the same

If somethings hard to do, its not worth doing - Homer Simpson
adoozer.servebeer.com