Re: Is this a virus?

From: Mike Burgess (winhelp2002_at_spamthis.com)
Date: 04/10/04


Date: Sat, 10 Apr 2004 17:14:26 -0400

Cassiodorus,
Lately these "ntdll.dll" problems are caused by a Coolwebsearch trojan.

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

Note: be *sure* to follow-up with HijackThis
Post back with the URL where you posted if you want help with your log.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-09-04]
Please post replies to this Newsgroup, email address is invalid

--
"Cassiodorus" <anonymous@discussions.microsoft.com> wrote in message
news:159d101c41d97$babf6870$a001280a@phx.gbl...
> WindowsXP SP1 - Windows Explorer hangs - happens a few
> times a day
>
> Error signature is
>
> Appname iexplorer.exe
> AppVer  6.0.2800.1221
> ModName ntdll.dll
> ModVer  5.1.2600.1217
> Offset  00007d85
>
> Sounds a lot like #313871 Nimda but my Norton AV is
> uptodate and shows no problem.
>


Relevant Pages

  • Re: search-direct.net
    ... search-direct.net = Coolwebsearch trojan ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... > bunch of links for search-direct.net. ...
    (microsoft.public.security.virus)
  • Re: Norton Virus Report - C:WINDOWSFontswin.hta
    ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... > scripts. ...
    (microsoft.public.security.virus)
  • Re: Home Page
    ... real-yellow-page.com = Coolwebsearch trojan ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... >>ShaZaa from inserting itself as my home page. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: PLS HELP!! Think Ive been hacked!!!
    ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file ...
    (microsoft.public.security)
  • Re: i keep getting redirected
    ... this type hijack indicates an unpatched machine, ... Please visit Windows Update to avoid these exploits. ... Please post replies to this Newsgroup, ... I can't download any parasite finder because my ...
    (microsoft.public.windows.inetexplorer.ie6.browser)