Welcome to chofc.comSite searchPowered by Google LinksWindows FilesSeveral variants of the CoolWebSearch trojan are overwriting Windows system files with copies of the trojan itself, reinstalling it whenever this infected file is called by Windows. CWShredder detects and removes these infected copies. You can download the files replaced by the trojan here, if the version for your Windows version is available. Note that these are all for US-English Windows versions. If the file is not available for your Windows version, you can always restore it from your Windows Setup CD! A mirror of the files on this page is available at: OfficeFive.org.uk Note: The files available for download on this page are taken from US English versions of Windows (unless noted otherwise). If you have a Windows version in any other language, you should not use these files. Contents
Files available here:
Note: if you have a version of the file not listed
here, please be so kind as to
send it to me. Thanks!
How to installNote: all files are zipped and can bed with a file compression program like WinZip if you don't have one already. To see what Windows version you have, right-click the 'My Computer' icon on the desktop and click 'Properties'. Windows 95/98/98SE: Windows ME: Windows NT4/2000: Windows XP: rundll32.exeLocated in: Get the file: control.exeLocated in: Get the file: wmplayer.exeLocated in: Get the file: msconfig.exeLocated in: Get the file: notepad.exe
Located in:
Windows 95: C:\WINDOWS Windows 95/98/98SE/ME: C:\WINDOWS Windows NT4/2000: C:\WINNT and C:\WINNT\System32 Windows XP: C:\WINDOWS and C:\WINDOWS\System32 Deleted by: CWS.Googlems, and most browser hijackers that use the ADODB.Stream exploit. Purpose: Notepad application executable, required to run it. Symptoms: Error messages 'Cannot find file NOTEPAD.EXE' or 'NOTEPAD.EXE' is not a valid Win32 application'. Get the file: shell.dllLocated in: Get the file: sdhelper.dllLocated in: Get the file: |
