CWS.SmartSearch infected my pc..

[crozbone12]

Here is a log file of MBAM that detects the four registry keys

and the CWShredder won't detect the cws.smartsearch already..

How do I completely remove this crap out of my computer?

[Pondus]

CWShredder Tutorial
How to remove CoolWebSearch with CWShredder

http://www.bleepingcomputer.com/tutorials/tutorial47.html

[nmb]

could you upload these files to virustotal.com (vt) and post the links respectively:

E:\WINDOWS\Explore.exe
E:\WINDOWS\winlogon.exe
E:\WINDOWS\system32\drivers\System.exe

nmb

[crozbone12]

E:\WINDOWS\winlogon.exe ->   http://www.virustotal.com/analisis/affd0973cd3128083417d407f62bc4a635fc25b65dbf52e91d3ab4ae2f9c1b4a-1255000535

E:\WINDOWS\Explore.exe -> I can't find the said application in the folder, I used search then IEXPLORER from Internet explorer is just the one that is shown.

E:\WINDOWS\system32\drivers\System.exe -> Nothing also except SYSTEM.EXE-3B0F6ABB (PF File)

[nmb]

mbam log says that it has detected explorer.exe file as virus. but it isn't. go to mbam quarantine and restore explorer.exe. you will get back your explorer.exe.

same thing applies to system.exe . but extract it to some other folder and upload it virustotal.com and post link here. mbam guys have some problem with trojan.agent detection. so first give us the link and will let you know what to do next.

you said that you have to start explorer manually from task manager. how do you do that. which executable will you execute through task manager. in which is folder is it? answer all.

nmb

[crozbone12]

Ok Im gonna restore it..



I'm running explorer thru task manager by clicking new task then typing explorer and enter the command.

[nmb]

you restore explorer. it should then work.

but restore system.exe into other folder. not to the folder where it is found.and upload it to vt.

please do what ever I say. do not do half of the work and post here. do everything I say and post back in detail.(in points). - like me 

nmb

[nmb]

get freefixer from here : http://www.freefixer.com/static/freefixersetup.exe

install, go to settings tab and check show md5 for each file, run a scan and wait for it to finish.

do not fix anything. save the log(in notepad, go to format and untick word wrap - it should not be enabled) and post back here using additional options.

nmb

[crozbone12]

Thanks for the help  I am now scanning my pc using freefixer.. I restored the explore.exe and the other files but I cannot choose where to restore them because it automatically restores to it's original file and the MalwareBytes keep blocking it.. See the file attached..



MalwareBytes ( Pic of MalwareBytes blocking explore.exe not explorer) I can't find that explore.exe crap in my WINDOWS folder T__T.. Only Explorer file in there at WINDOWS that I saw.

and the attached freefixer log file you requested..



thank you so much for your help nmb!! ^__^ Im hoping to fix this problem

[nmb]

Explore.exe ? or is it explorer.exe?

upload these files to vt : E:\logonui.exe    and     E:\WINDOWS\winlogon.exe and post back.

and for what software do you use keygen?

whom am I helping? a person who supports pirates?

nmb

[YoKenny]

whom am I helping? a person who supports pirates?

http://forum.avast.com/index.php?topic=49391.msg417545#msg417545

[nmb]

whom am I helping? a person who supports pirates?

http://forum.avast.com/index.php?topic=49391.msg417545#msg417545

hmmm.. I see that. thanks kenny

[crozbone12]

Ok here are the results from VT and that KEYGEN was from my friend where I borrowed my OS and he said to leave it in my pc first because his pc is being repaired at the moment.  

http://www.virustotal.com/analisis/5d9ccdfcd19515dbd0b0c94e04c2598713ca33f7762da44c76f6eae290adb92f-1255152582 << logonui.exe

http://www.virustotal.com/analisis/affd0973cd3128083417d407f62bc4a635fc25b65dbf52e91d3ab4ae2f9c1b4a-1255152888 << winlogon.exe

attached file on the running process detected by MalwareBytes'

[crozbone12]

Explore.exe ? or is it explorer.exe?

upload these files to vt : E:\logonui.exe    and     E:\WINDOWS\winlogon.exe and post back.

and for what software do you use keygen?

whom am I helping? a person who supports pirates?

nmb

above your post there is a pic where malwarebytes was blocking this explore.exe that I cannot find in the said folder..

[nmb]

I have sent one of my forum friend a message regarding your problem. he might post here any time. his profile : http://forum.avast.com/index.php?action=profile;u=11091

you can wait until he posts.

nmb