CWS.GonnaSearch BHO

CWS.GonnaSearch malware description and removal detail
Categories:BHO,Hijacker,Toolbar
Visible Symptoms:
Files in system folders:
[%WINDOWS%]\drivers\audio\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\about.html
[%PROGRAM_FILES%]\intern~1\toolbar\autosearch.dll
[%PROGRAM_FILES%]\intern~1\toolbar\autose~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\error.html
[%PROGRAM_FILES%]\intern~1\toolbar\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\mgs_32.dll
[%PROGRAM_FILES%]\intern~1\toolbar\options.html
[%PROGRAM_FILES%]\intern~1\toolbar\searchaddon.dll
[%PROGRAM_FILES%]\intern~1\toolbar\search~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\toolbar.dll
[%PROGRAM_FILES%]\intern~1\toolbar\webinfo.dll
[%SYSTEM%]\mgs_32.dll
[%WINDOWS%]\drivers\video\install.exe
[%WINDOWS%]\drivers\audio\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\about.html
[%PROGRAM_FILES%]\intern~1\toolbar\autosearch.dll
[%PROGRAM_FILES%]\intern~1\toolbar\autose~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\error.html
[%PROGRAM_FILES%]\intern~1\toolbar\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\mgs_32.dll
[%PROGRAM_FILES%]\intern~1\toolbar\options.html
[%PROGRAM_FILES%]\intern~1\toolbar\searchaddon.dll
[%PROGRAM_FILES%]\intern~1\toolbar\search~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\toolbar.dll
[%PROGRAM_FILES%]\intern~1\toolbar\webinfo.dll
[%SYSTEM%]\mgs_32.dll
[%WINDOWS%]\drivers\video\install.exe

In order to ensure that the CWS.GonnaSearch is launched automatically each time the system is booted, the CWS.GonnaSearch adds a link to its executable file in the system registry:
HKLM\Microsoft\Windows\CurrentVersion\Run
[%WINDOWS%]\drivers\audio\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\install.exe
[%WINDOWS%]\drivers\video\install.exe

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Detecting CWS.GonnaSearch:

Files:
[%WINDOWS%]\drivers\audio\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\about.html
[%PROGRAM_FILES%]\intern~1\toolbar\autosearch.dll
[%PROGRAM_FILES%]\intern~1\toolbar\autose~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\error.html
[%PROGRAM_FILES%]\intern~1\toolbar\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\mgs_32.dll
[%PROGRAM_FILES%]\intern~1\toolbar\options.html
[%PROGRAM_FILES%]\intern~1\toolbar\searchaddon.dll
[%PROGRAM_FILES%]\intern~1\toolbar\search~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\toolbar.dll
[%PROGRAM_FILES%]\intern~1\toolbar\webinfo.dll
[%SYSTEM%]\mgs_32.dll
[%WINDOWS%]\drivers\video\install.exe
[%WINDOWS%]\drivers\audio\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\about.html
[%PROGRAM_FILES%]\intern~1\toolbar\autosearch.dll
[%PROGRAM_FILES%]\intern~1\toolbar\autose~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\error.html
[%PROGRAM_FILES%]\intern~1\toolbar\install.exe
[%PROGRAM_FILES%]\intern~1\toolbar\mgs_32.dll
[%PROGRAM_FILES%]\intern~1\toolbar\options.html
[%PROGRAM_FILES%]\intern~1\toolbar\searchaddon.dll
[%PROGRAM_FILES%]\intern~1\toolbar\search~1.dll
[%PROGRAM_FILES%]\intern~1\toolbar\toolbar.dll
[%PROGRAM_FILES%]\intern~1\toolbar\webinfo.dll
[%SYSTEM%]\mgs_32.dll
[%WINDOWS%]\drivers\video\install.exe

Folders:
[%PROGRAM_FILES%]\internet explorer\toolbar

Registry Keys:
HKEY_LOCAL_MACHINE\software\classes\autosearch.autosearchobj
HKEY_LOCAL_MACHINE\software\classes\autosearch.autosearchobj.1
HKEY_LOCAL_MACHINE\software\classes\clsid\{150fa160-130d-451f-b863-b655061432ba}
HKEY_LOCAL_MACHINE\software\classes\clsid\{799a370d-5993-4887-9df7-0a4756a77d00}
HKEY_LOCAL_MACHINE\software\classes\clsid\{92f02779-6d88-4958-8ad3-83c12d86adc7}
HKEY_LOCAL_MACHINE\software\classes\clsid\{a55581dc-2cdb-4089-8878-71a080b22342}
HKEY_LOCAL_MACHINE\software\classes\clsid\{e7afff2a-1b57-49c7-bf6b-e5123394c970}
HKEY_LOCAL_MACHINE\software\classes\interface\{3d11cbe7-1eee-4c8f-ab5c-a4cf7939f1f1}
HKEY_LOCAL_MACHINE\software\classes\interface\{7142c3e1-1fe1-4a2a-b882-681dc7db0d30}
HKEY_LOCAL_MACHINE\software\classes\interface\{a1376d2c-12eb-472b-9c8c-db24448d3c91}
HKEY_LOCAL_MACHINE\software\classes\ml.iehlprobj
HKEY_LOCAL_MACHINE\software\classes\ml.iehlprobj.1
HKEY_LOCAL_MACHINE\software\classes\searchaddon.ieobject
HKEY_LOCAL_MACHINE\software\classes\searchaddon.ieobject.1
HKEY_LOCAL_MACHINE\software\classes\typelib\{7e68f5f3-782c-4bcd-88df-1e3d6350de4c}
HKEY_LOCAL_MACHINE\software\classes\typelib\{a65529dd-4833-4784-a594-205f4a50267a}
HKEY_LOCAL_MACHINE\software\classes\typelib\{c1947e81-7036-4ac8-ac09-906224f6f4fc}
HKEY_LOCAL_MACHINE\software\classes\typelib\{f7825d95-cdd7-4e73-bfdc-846de0f336be}
HKEY_LOCAL_MACHINE\software\classes\webinfo.webinfoobj
HKEY_LOCAL_MACHINE\software\classes\webinfo.webinfoobj.1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{799a370d-5993-4887-9df7-0a4756a77d00}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{a55581dc-2cdb-4089-8878-71a080b22342}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{799a370d-5993-4887-9df7-0a4756a77d00}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{a55581dc-2cdb-4089-8878-71a080b22342}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{e7afff2a-1b57-49c7-bf6b-e5123394c970}

Registry Values:
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser

Removing CWS.GonnaSearch:

An up-to-date copy of ExterminateIt should detect and prevent infection from CWS.GonnaSearch.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove CWS.GonnaSearch manually.

To completely manually remove CWS.GonnaSearch malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with CWS.GonnaSearch.

  1. Use Task Manager to terminate the CWS.GonnaSearch process.
  2. Delete the original CWS.GonnaSearch file and folders.
  3. Delete the system registry key parameters
  4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

ExterminateIt effectively and automatically removes CWS.GonnaSearch from you computer and is a good solution for those who are seeking easy and effective protection for their computer from Trojan Horses, Rootkits, Backdoors, spyware, botnets, keystroke loggers, dialers and other malicious software(malware).

Download ExterminateIt! to instantly get rid of CWS.GonnaSearch!

Also Be Aware of the Following Threats:
SoftWAR.ShadowThieft RAT Cleaner
NetcPlus.BrowseGate.denial.of.Service DoS Symptoms
Removing Pigeon.EJF Trojan

0 comments

NT.Shareme Trojan

NT.Shareme malware description and removal detail
Categories:Trojan
Also known as:

[Kaspersky]JS.ShareNT;
[Panda]AX/EvilNT.Shareme;
[Computer Associates]JScript/HTADropper!Trojan

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing NT.Shareme:

An up-to-date copy of ExterminateIt should detect and prevent infection from NT.Shareme.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove NT.Shareme manually.

To completely manually remove NT.Shareme malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with NT.Shareme.

  1. Use Task Manager to terminate the NT.Shareme process.
  2. Delete the original NT.Shareme file and folders.
  3. Delete the system registry key parameters
  4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

ExterminateIt effectively and automatically removes NT.Shareme from you computer and is a good solution for those who are seeking easy and effective protection for their computer from Trojan Horses, Rootkits, Backdoors, spyware, botnets, keystroke loggers, dialers and other malicious software(malware).

Download ExterminateIt! to instantly get rid of NT.Shareme!

Also Be Aware of the Following Threats:
AI Trojan Information
Small.cy Trojan Symptoms
Puerto.Oculto RAT Cleaner
Random.Text DoS Removal

0 comments

BAT.Code Trojan

BAT.Code malware description and removal detail
Categories:Trojan
Also known as:

[Kaspersky]BAT.Code.a,BAT.Code.b,BAT.Combat.737;
[Eset]Bat.Wavefunc.Code virus,BAT/Code.169.B virus,BAT/Combat.737 virus;
[Panda]BAT/Code.169,BAT/Combat.737;
[Computer Associates]Bat/Code.169.D,Bat/Code.630,Bat/Combat

Platforms / OS: Windows 95, Windows 98, Windows 98 SE, Windows NT, Windows ME, Windows 2000, Windows XP, Windows 2003, Windows Vista

Removing BAT.Code:

An up-to-date copy of ExterminateIt should detect and prevent infection from BAT.Code.

If you do not have ExterminateIt and you are worried that you may have infected computer, you could run trial version of ExterminateIt, or remove BAT.Code manually.

To completely manually remove BAT.Code malware from your computer, you need to delete the Windows registry keys and registry values, the files and folders associated with BAT.Code.

  1. Use Task Manager to terminate the BAT.Code process.
  2. Delete the original BAT.Code file and folders.
  3. Delete the system registry key parameters
  4. Update your antivirus databases or buy antivirus software and perform a full scan of the computer.

We recommends that all Internet users back up any important information on their computers, enable maximum protection from network attacks and malicious code on their computers, refrain from executing suspicious programs received from untrustworthy sources.

ExterminateIt effectively and automatically removes BAT.Code from you computer and is a good solution for those who are seeking easy and effective protection for their computer from Trojan Horses, Rootkits, Backdoors, spyware, botnets, keystroke loggers, dialers and other malicious software(malware).

Download ExterminateIt! to instantly get rid of BAT.Code!

Also Be Aware of the Following Threats:
Pigeon.EYK Trojan Cleaner
W2K.Stream Trojan Cleaner

0 comments

Subscribe to: Posts (Atom)

Blog Archive