VIRUS ALERTS - July 1, 2004

Aliases
TrojanDownloader.Win32.Small.lc, StartPage-CQ.gen trojan

Type
Trojan

Description
Troj/CWS-C is an adware Trojan which changes browser settings and modifies
the HOSTS file, so that when the user attempts to connect to selected
websites they are redirected to an alternative site.
Troj/CWS-C may also launch web pages, including pages containing sexual
content.

When the installation executable for Troj/CWS-C is first run it adds
its pathname to one of the following new registry entries to run itself on
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AddClass
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Host


More: http://www.sophos.com/virusinfo/analyses/trojcwsc.html

Here is an easy one for you experts. Please help me get rid of this thing. I have run, CW Shredder, Ad-aware, Spybot, I also have spy sweeper set up. I get this URL that come up
res://prdyn.dll/index.html#10213

When I run ad-aware:
c:\windows\crno32.exe can not be terminated

When I run Spy sweeper:
cws_ns3 & cws_ns3 hijacker are on the system
cws_ns3 - crno32.exe is the software running

However when I quarantine, delete and reboot, the same CWS w/a different .exe comes up such as...
ntsu32.exe or syshq.exe or ipgy.exe

Long story short, I am probably missing something simple here...expert advice/direction/instruction appreciated!!

Hi Smooth72

there are several variants out at the moment and the "gurus" are working around the clock to analyze these "baddies". The solution which works for one does NOT work on a different computer It all depends on "hidden" or "super hidden" dll's

The best "help" I can offer is :

Please go to

http://www.spywareinfo.com/~merijn/files/HijackThis.exe

and download 'Hijack This!'.
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log as a .txt file, and copy and paste its contents into your next post.

Most of what it lists will be harmless, so do not fix anything yet.

Post here:
http://www.computercops.biz/ or
http://www.wilderssecurity.com/

The Bottom line is that this new trojan is too tricky to remove, it attacks Internet Explorer which has a polethera of security problems the best way to solve this problem is to stop using IE. I installed Firefox as my new browser tonight and I'm having no problems. I am writing a business plan and using the internet as my main source of information and inspiration so the CWS trojan was really stressing me out. Firefox seems to be impurvious to the problem. The trojan is still running but it is only affecting IE. good luck

Aliases
INFECTED TrojanDropper.Win32.Small.hx

Type
Trojan

Description
Troj/StartPa-BM is a simple Trojan that changes default Internet Explorer
settings by modifying related registry entries.
Troj/StartPa-BM may drop the file sp.html in the temp folder along with two
randomly named dll files in the default system folder.

http://www.sophos.com/virusinfo/analyses/trojstartpabm.html

Aliases
Backdoor.Rbot.gen, W32.Spybot.Worm

Type
Win32 worm

Description
W32/Rbot-BZ is a worm which attempts to spread to remote network shares. It
also contains backdoor Trojan functionality, allowing unauthorised remote
access to the infected computer via IRC channels while running in the
background as a service process.
W32/Rbot-BZ spreads to network shares with weak passwords as a result of the
backdoor Trojan element receiving the appropriate command from a remote user.

W32/Rbot-BZ moves copies itself to the Windows system folder as
ZONEALARM.EXE and creates registry entries called 'Microsoft Update Machine'
under the following keys in order to run itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Rbot-BZ may set the following registry entries:

HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"

http://www.sophos.com/virusinfo/analyses/w32rbotbz.html