cws.msconfig

Advertise at AfterDawn.com

Link to us!

Private messages

Compose a private message

List of all updated threads

Threads without replies

Search messages

Tuesday 3.12.2024 / 13:03

Search AfterDawn Forums:

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > cws.msconfig

Browse by topic

Forums

Start a new thread

cws.msconfig

Jump to:

Posted

Message

ozzymary

Suspended permanently

2. January 2006 @ 04:27

Link to this message

here is what i found on this i wonder if it is safe to do this
Approx date first sighted: February 5, 2004
Symptoms: IE pages being hijacked to www.31234.com on system startup and when changing homepage back, continuous errors about an invalid Registry script in temp2.txt, extra item in right-click menu of webpages named '??????'
Cleverness: 2/10
Manual removal difficulty: Involves a process killer, some Registry editing and restoring a Windows system file from CD
This variant uses the filename msconfig.exe which overwrites the real Windows file in Windows 98/98SE/ME. The temp2.txt file it drops is actually a Registry script, but since it's in the wrong format, Windows 9x/ME will throw up an error about an invalid Registry script. Windows 2000/XP will import it without complaining, creating the '??????' item in the IE right-click menu. The msconfig.exe file will always stay in memory, reinstalling the hijack every 5 seconds. Killing the process, deleting the file and restoring the IE homepages/search pages fixes this hijack.

The real Windows file msconfig.exe can be download here, if you can't restore it from your Windows Setup CD for some reason.

[ + quote]

-kemisti-

AfterDawn Addict

2. January 2006 @ 04:40

Link to this message

@ozzymary: You don't have cws.msconfig. Msconfig just starts while booting, this line in HjT log ->
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

You can fix this line, too.

EDIT: I just checked that from merijn, you don't have this cws-variant.

[ + quote]

This message has been edited since posting. Last time this message was edited on 2. January 2006 @ 04:42

ozzymary

Suspended permanently

2. January 2006 @ 04:48

Link to this message

iran cwshreeder and it says i have it

[ + quote]

-kemisti-

AfterDawn Addict

2. January 2006 @ 04:52

Link to this message

Well, that must be false alarm.
You must have these line in your HjT-log if you have it,see here ->
http://www.merijn.org/cwschronicles.html#msconfig

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.31234.com/www/homepage.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.31234.com/www/homepage.html
O4 - HKLM\..\Run: [msconfig] C:\WINDOWS\SYSTEM\msconfig.exe
O4 - HKCU\..\Run: [msconfig] C:\WINDOWS\SYSTEM\msconfig.exe
O8 - Extra context menu item: ?????? - C:\WINDOWS\system32\openme.htm

And you don't have.

I guess cwshedder thinks that this line ->

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

is this line

O4 - HKLM\..\Run: [msconfig] C:\WINDOWS\SYSTEM\msconfig.exe

[ + quote]

Start a new thread

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > cws.msconfig


		User name	Password

		Not registered yet? Register here. Lost your password? Click here.