Member Avatar for AvManBob

I've got a spyware virus, probably Winshow K Trojan. Can someone help me to remove it. I have run CWShredder, Hijack This, EZ Antivirus, and Ad Aware, and that cleans it until I restart, then it comes back...Here is latest IE URL line I am getting:

res://aipvb.dll/index.html#37049

Here is my latest Hijack This scan log:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\VetMsgNT.exe
C:\WINDOWS\winsp32.exe
C:\WINDOWS\system32\netma32.exe
C:\WINDOWS\System32\EXSHOW95.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DIGStream\digstream.exe
C:\WINDOWS\System32\EXSHOW.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Palm\HOTSYNC.EXE
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\default\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\aipvb.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://aipvb.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://aipvb.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\aipvb.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://aipvb.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\aipvb.dll/sp.html#37049
F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
O2 - BHO: (no name) - {A1C91D26-6BFE-9DA5-0C53-AC5009FD3DC6} - C:\WINDOWS\system32\apiqv.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EXSHOW95.EXE] EXSHOW95.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [SSK Service] C:\html\details.pif
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [netma32.exe] C:\WINDOWS\system32\netma32.exe
O4 - HKCU\..\Run: [SSK Service] C:\html\details.pif
O4 - HKLM\..\RunOnce: [winsp32.exe] C:\WINDOWS\winsp32.exe
O4 - HKLM\..\RunOnce: [mfcjm.exe] C:\WINDOWS\system32\mfcjm.exe
O4 - HKLM\..\RunOnce: [ntth.exe] C:\WINDOWS\system32\ntth.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) -
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) -
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/mail/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) -

Can someone help me remove this completely.

Thanks in advance,
Bob

  • 2 Contributors
  • 3 Replies
  • 341 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by AvManBob

Dani AI

Generated

A persistent Internet Explorer hijacker often uses a deceptively named “updater” executable plus a browser helper object to force a special IE start/search page and to re-register itself at boot. ’s followup that removing wsaupdater.exe stopped the reinfection fits that common pattern. ’s suggestion to run targeted tools (CWShredder) and install missing Windows updates was on-target — those remove many known CoolWebSearch components, but leftover startup or registry hooks are the usual reason for recurrence.

Recommended cleanup checklist (in roughly the order to try):

  1. Disconnect the machine from the network and boot into Safe Mode.
  2. Run at least one modern anti‑malware full scan (a current engine) and a dedicated CoolWebSearch remover if available; quarantine/delete everything found and reboot into Safe Mode to re‑scan.
  3. Use Autoruns (Sysinternals) or HijackThis only to identify suspicious Run/RunOnce/UserInit entries and BHOs; export a registry backup first and then remove the confirmed malicious entries.
  4. Kill the malware process, delete the malicious files from the Windows folders (use Safe Mode or a rescue disk if locked), and remove any corresponding service or scheduled task entries.
  5. Clear all System Restore points (they can preserve infected files) and then create a fresh restore point after confirming a clean system.
  6. Update Windows, install a reputable realtime AV/anti‑malware, and change passwords used from the infected machine.

Troubleshooting notes: persistent return after reboot usually means something was missed in startup keys, scheduled tasks, or a hidden COM object (BHO). Check for legitimate system names running from the wrong folder (for example, svchost.exe should only run from System32). Use Process Explorer to inspect handles and Autoruns to find obscure startup hooks.

Prevention: keep the OS and browser patched, run with least privilege, avoid unknown downloads/attachments, and keep a current anti‑malware product. This thread’s solution—removal of the bogus updater executable—reflects the typical, correct fix, but complete cleanup requires removing all associated registry/startup traces and clearing restore points.

Recommended Answers

All 3 Replies

Member Avatar for AvManBob

Bump...please help...thanks.

Member Avatar for crunchie

Go here for an on-line scan & set it to autoclean for you.

Try this scan as well.

Download CWShredder from here & run it. Select the fix button & it will get rid of everything related to CoolWebSearch that is stored in it's database. Close ALL windows, including Iinternet Explorer, before running CWShredder. Reboot.

To help prevent this from happening again, install the patches for the vulnerabilities that this hijacker exploits by going here for your critical updates.

Please go here for Wintools removal instructions.

Reboot after doing this & post another log please.

Member Avatar for AvManBob

Thanks Crunchie...turns out the WSAUPDATER.exe file in my log was the culprit. Once I removed that file, everything cleaned up and stayed clean.

Thanks again,
Bob

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.