CWS variant crashes Avast. Undected by scan.

[Arco]

My machine has become infected what appears to be a CWS variant (Yes, another one) , that prevents me from searching for anything on google, always returning the supposed error message:

"aid=A0002, 419
http://64.21.66.177/xml.php?aff=419&ip=80.5.160.9&q=gd&ref=http://zetta-search.com&n=20&saff=2"

In the browser window.

If avast on-access webshield is running at this time, it promptly crashes. This happens with both IE and Mozilla, though in the case of IE, the browser crashes too.

Avast does not detect anything when I run a system scan.

If anyone can help me remove this,I'd be very greatful.

[Lisandro]

I know it's a generic answer but, can't you scan your system with antispywares and antitrojans applications?
Ad-Aware, Spybot Search and Destroy, A-squared, Ewido or Microsoft AntiSpyware (freewares).
TrojanHunter or TDS-3 (sharewares).

[Arco]

I have scanned with Adaware, which detected and removed a few registry entries that it identified as CWS, but the removal of these only got rid of the explorer toolbar, not the browser hijack.

[Arco]

Well, I have removed it. After sending a nice legal threat to the people at Zetta-Search.com, they seemed more than happy to tell me how to get rid of it.

Their reply was:

Hello.
Please, don't worry, I'll help you to uninstall this thing.

First of all, take a look at list of programs in Add/Remove list.
Open it thru Start->Settings->Control panel->Add/remove programms
If you'll see there names like:
MDS Search Booster
Quick Search Toolbar
Polaris Solutions
- uninstall it.

If there will no programs with names like these - download this
remover: http://zetta-search.com/uninstall/uninstall.exe and run it.

And finally if it will not help - search these files on your hard
disk:
dsmanager.dll
flashplayertb.dll
flashplayerbh.dll

and if any of these files exists on your disk - delete it.

Yours, Alex.

[DavidR]

It is probably worth your while getting CWShredder for the future.