CWS.Svchost32
  • Résumé : CoolWebSearch - Variante CWS.Svchost32 - Ensemble de hijackers d'un gang maffieux renvoyant vers le site coolwebsearch ou vers ses affiliés.
  
  • Mots-clés : CoolWebSearch, coolwwwsearch, cws, hijack, hijacker, hijacking, keymgr3.inf, drvupd.inf, svchost32.exe, astctl32.ocx, mswsc10.dll, msinfo.exe, ctfmon.exe, dnsrelay.dll, AddClass, AFF.IEDLL, AFF.MadFinder, AFF.WinShow, AlFaSearch, Bootconf, Ctfmon32, DataNotary, DNSRelay, Dnsrelay.2, Dnsrelay.3, DReplace, GoogleMS, IEFeats, LoadBAT, MSConfd, MSInfo, MSOffice, Msspi, MUpdate, OEMSysPNP, Oemsyspnp.2, Oemsyspnp.3, OSLogo, QTTasks, Svchost32, Svcinit, TapiCFG, TheRealSearch, Vrape, XPlugin, Aff.iedll, Aff.Winshow, Aff.Madfinder, Aff.Tooncomics

    get rid of, uninstall, remove, removal, suppression, effacer, effacement, supprimer, virer, détruire, désinstaller, désinstallation


CWS.Svchost32
 


CoolWebSearch - Variante CWS.Svchost32


De quoi s'agit-il ?
Ce parasite est une variante d'une famille de Hijackers furieux appelée CoolWebSearch et pilotée par un gang maffieux s'introduisant dans tous les ordinateurs.

Discussion générale et éradication des différentes variantes du hijacker CoolWebSearch:


Voir la fiche générale CoolWebSearch


Travaux originaux de Merijn (acquis pas Intermute le 19 Octobre 2004)
Révisions (18.10.2003 - Rév 1; 27.10.2003 - Rév 2; 12.11.2003 - Rév 3; 19.12.2003 - Rev 4; 17.01.2004 - Rev 5; 11.02.2004 - Rev 6; 7.4.2004 - Rev 7; 20.05.2004 - Rev 8)




CWS.Svchost32

Variant 7: CWS.Svchost32 - Evading detection

Approx date first sighted: August 3, 2003
Log reference: http://boards.cexx.org/viewtopic.php?t=1027
Symptoms: Redirections to slawsearch.com when accessing Google, searching on Yahoo or mistyping an URL
Cleverness: 10/10
Manual removal difficulty: Involves a process killer
Identifying lines in HijackThis log:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.slawsearch.com
O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\SYSTEM\svchost32.exe"

This variant of CWS was focused on only evading existing detection tools. What was visible in a HijackThis log wasn't nearly all of it. The hijack installed dozens of redirections from international Google domains, MSN and Yahoo search engines to a webserver running at the user's own machine. The webserver even had the seemingly unsuspicious filename of 'svchost32.exe' to look like the Windows system file 'svchost.exe'. Anytime a user accessed Google, searched with Yahoo or mistyped an URL, he was redirected to slawsearch.com.

Fixing this hijack involved using a process killer to stop the webserver process, and editing the Hosts file to remove the Google/Yahoo/MSN redirections.

Rédigé en écoutant Ecoute