CWS.Msoffice
  • Résumé : CoolWebSearch - Variante CWS.Msoffice - Ensemble de hijackers d'un gang maffieux renvoyant vers le site coolwebsearch ou vers ses affiliés.
 
  • Mots-clés : CoolWebSearch, coolwwwsearch, cws, hijack, hijacker, hijacking, keymgr3.inf, drvupd.inf, svchost32.exe, astctl32.ocx, mswsc10.dll, msinfo.exe, ctfmon.exe, dnsrelay.dll, AddClass, AFF.IEDLL, AFF.MadFinder, AFF.WinShow, AlFaSearch, Bootconf, Ctfmon32, DataNotary, DNSRelay, Dnsrelay.2, Dnsrelay.3, DReplace, GoogleMS, IEFeats, LoadBAT, MSConfd, MSInfo, MSOffice, Msspi, MUpdate, OEMSysPNP, Oemsyspnp.2, Oemsyspnp.3, OSLogo, QTTasks, Svchost32, Svcinit, TapiCFG, TheRealSearch, Vrape, XPlugin, Aff.iedll, Aff.Winshow, Aff.Madfinder, Aff.Tooncomics

    get rid of, uninstall, remove, removal, suppression, effacer, effacement, supprimer, virer, détruire, désinstaller, désinstallation


CWS.Msoffice
 


CoolWebSearch - Variante CWS.Msoffice


De quoi s'agit-il ?
Ce parasite est une variante d'une famille de Hijackers furieux appelée CoolWebSearch et pilotée par un gang maffieux s'introduisant dans tous les ordinateurs.

Discussion générale et éradication des différentes variantes du hijacker CoolWebSearch:


Voir la fiche générale CoolWebSearch


Travaux originaux de Merijn (acquis pas Intermute le 19 Octobre 2004)
Révisions (18.10.2003 - Rév 1; 27.10.2003 - Rév 2; 12.11.2003 - Rév 3; 19.12.2003 - Rev 4; 17.01.2004 - Rev 5; 11.02.2004 - Rev 6; 7.4.2004 - Rev 7; 20.05.2004 - Rev 8)




CWS.Msoffice

Variant 13: CWS.Msoffice - HTA exploit revisited

Approx date first sighted: October 12, 2003
Log reference: http://forums.spywareinfo.com/index.php?showtopic=13362
Symptoms: Homepage changed to searchdot.net, hijack coming back after a reboot, slow scrolling and text typing in IE.
Cleverness: 7/10
Manual removal difficulty: Involves some Registry editing, and using a command prompt to delete the files.
Identifying lines in HijackThis log:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
O4 - HKLM\..\Run: [Msoffice] C:\WINDOWS\Fonts\msoffice.hta
O4 - HKCU\..\Run: [Msoffice] C:\WINDOWS\Fonts\msoffice.hta

This variant uses a .hta script file to reinstall the hijack on a reboot. The msoffice.hta file is hard to find because the Fonts folder is a special folder for Windows, setup to hide all files in it that are not font files. Thus, a command prompt is needed to be able to see and delete the file. Deleting the file and resetting the IE home and search pages fixes the hijack.

CWS.Msoffice.:2 A mutation of this variant exists that hijacks IE to sexpatriot.net and royalsearch.net, installs a hosts file hijack of two porn sites to 64.246.33.179, and reinstalls through a file named fonts.hta using the name AdobeFonts.

CWS.Msoffice.:3 A mutation of this variant exists that hijacks IE to supersearch.com and hugesearch.net, and reinstalls through a file named fonts.hta using the name TrueFonts. It also changes the DefaultPrefix and WWW Prefix to redirect all URLs through hugesearch.net.

Rédigé en écoutant Ecoute