Re: CWS searchx strain won't go away

From: Maggie (cibbarelli_at_hotmail.com)
Date: 05/25/04 

Date: 25 May 2004 13:43:39 -0700

HELP!! I have followed the instructions below and still can't shake
this thing. I'm wondering if I have a new strain/variant.

1. I do have the "homeoldsp=about.blank" present when I run HiJack
this. I keep electing to fix and it keeps coming back.

2. I found the "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Windows\AppInit_DLLs" and deleted it. When I hit F5
it never came back but I still had the same problem (hijacked start
page instead of about:blank). So I did a search while in regedit and
found the AppInit_Dlls hidden elsewhere. This time I followed the
instructions on renaming the folder, deleting, changing the name back,
etc. I then ran AdAware 6, CWShredder, Spybot, and rebooted. My
about:blank start page is still some *** Search Spyware but I
can't find AppInit_DLLs anywhere within regedit now.

3. I have also run PestPatrol and keep getting nailed with "CWS -
Hijacker" hkey_classes_root\protocols\filter\text/html. I delete
repeatedly and it's back withing minutes. I'm assuming the two are
related or the same. Anybody seen this thing as a variant?

Thanks for the help!