Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Oct 13th, 2008, 11:46am
   Mischel Internet Security Forum
   Malware
   Adware, Browser Hijackers and other Malware (Moderators: Helena, Gavin_Coe, Magnus)
   CWS_NS3 Trojan?		 « Previous topic | Next topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: CWS_NS3 Trojan?  (Read 3832 times)
MMBrown26
Newbie
*



I love YaBB 1G - SP1!

   


Posts: 3
CWS_NS3 Trojan?
« on: Jul 26th, 2004, 12:56am »		 Quote Quote  Modify Modify
I purchased Trojan Hunter because it seems as though I have a trojan on my computer.  It is also called ADWARE by Webroot, whose Spy Sweeper program identifies the bug as CWS_NS3, removes it, but the darn thing comes back immediately, changing my homepage.  I have tried Spybot 1.3, updated, Ad Aware 6, I've run anti-virus checks.  Trojan Hunter finds "packed" files but can't do anything with them after I scan with it.  I'd like to get rid of this thing with all possible haste on a permanent basis.  It has been a major pain for the last 4 weeks and I'm trying  not to reformat my drive to get rid of it(and possibly some of my needed data).  How should I proceed with this?  Your help will be HUGELY appreciated!!!  Michael Brown
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5671
Re: CWS_NS3 Trojan?
« Reply #1 on: Jul 26th, 2004, 4:14am »		 Quote Quote  Modify Modify
Have you tried the various fixes as found if you use www.google.com and search for CWS_NS3?  Here is one link for example:
 
http://forums.spywareinfo.com/index.php?showtopic=11539
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4107
Re: CWS_NS3 Trojan?
« Reply #2 on: Jul 26th, 2004, 5:43am »		 Quote Quote  Modify Modify
Could you email the file(s) with CWS to submit@misec.net ?
IP Logged
MMBrown26
Newbie
*



I love YaBB 1G - SP1!

   


Posts: 3
Re: CWS_NS3 Trojan?
« Reply #3 on: Jul 26th, 2004, 11:14am »		 Quote Quote  Modify Modify
Hello Magnus!  Yes, I could send the files but the problem is that I can detect and remove them but when the bug comes back after reboot or just starting up the web browser again or after some unknown length of time, the files that are later detected after initial removal are different than the ones I took off before to fix the bug.  I hope that makes sense.  This thing sort of acts like a trojan horse virus; there is some main file that I cannot find that keeps dumping infected files onto the system which hijack the browser.  I can't get to the root of this problem.  Should I still send the infected file to you nonetheless?  Many thanks for your help!  Mike
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4107
Re: CWS_NS3 Trojan?
« Reply #4 on: Jul 26th, 2004, 11:47am »		 Quote Quote  Modify Modify
Yes, please do send the files. I would urge you to use Mozilla Firefox as your main browser(www.mozilla.org) to rule out the possibility of a bug in IE being exploited to reinstall this piece of malware.
IP Logged
MMBrown26
Newbie
*



I love YaBB 1G - SP1!

   


Posts: 3
Re: CWS_NS3 Trojan?
« Reply #5 on: Jul 26th, 2004, 12:59pm »		 Quote Quote  Modify Modify
Many thanks for the advice.  Mozilla does work perfectly well and does not get hijacked.  Meanwhile, I have submitted the files in a .zip to your support team, as requested.  Any help to permanently eradicate this pesky pest will be greatly appreciated.  Right now my IE browser is NOT being hijacked by this bug although Spy Sweeper KEEPS detecting the infection on my system, each time after I remove it, and always with completely different file names.  It seems like some sort of trojan horse, the root file which is NOT detected and the dropped files which are detected.  Thank you kindly,
Mike
IP Logged
mcpoo726
Newbie
*





   
Email

Gender: male
 Posts: 2
Re: CWS_NS3 Trojan?
« Reply #6 on: Oct 11th, 2004, 10:05am »		 Quote Quote  Modify Modify
Is this a new strain of CoolWebSearch? The symptoms seem to be right but I don't recognize the name. You might check out http://www.spywareinfo.com/~merijn/
IP Logged
mcpoo
If you're not livin' on the edge
You're takin' up too much space
Kayrac
Full Member
***






   
Email

Posts: 162
Re: CWS_NS3 Trojan?
« Reply #7 on: Oct 11th, 2004, 10:21am »		 Quote Quote  Modify Modify
hey although you have sent the files, and magnus will help you out, another alternative is to goto this forum
http://www.dslreports.com/forum/security
 
and before you post a thread(to get all infections removed.....and i do mean all, not just cws, that is if you have more)
follow the steps in this thread
http://www.dslreports.com/faq/8428
then....goto the security forum when done.....make a new thread, with a subject of your problem, and be sure to include your HIJACKTHIS program log in the thread......make sure you are using version 1.98 of hijackthis
 
although magnus/aaron are experts and will help you out by adding detection/removal to the trojanhunter database
the people at dslreports.com are also very good, and will get you cleared of your problem in no time
(and yes they will help you to stop it from coming back....you can also ask them how to secure your browser, to prevent this from happening again)
hope this helps
« Last Edit: Oct 11th, 2004, 10:22am by Kayrac » IP Logged
Aaron
Administrator
*****





   


Gender: male
 Posts: 286
Re: CWS_NS3 Trojan?
« Reply #8 on: Oct 11th, 2004, 12:46pm »		 Quote Quote  Modify Modify
" Is this a new strain of CoolWebSearch?"
 
Well, the thread's from July, so in terms of age on the Internet, the short answer is, "No."
 
I'd hope that this was resolved by now...
 
Remember that CWS has a fuzzy definition out there.  Some say it's a trojan, some say it's malware/adware.  Now that adware's being heavily added, the fuzzy definition doesn't matter.  But, there are SEVERAL HUNDRED VARIANTS of this thing, and I think there are all of 10... 15 defined in TrojanHunter that I've added.  Only a drop in the bucket in terms of what I've reviewed vs. what exists.  Only in time, after grabbing various variants, will I have a better picture about coverage.
« Last Edit: Oct 11th, 2004, 12:47pm by Aaron » IP Logged
Aaron Hulett | Trojan Analyst | Mischel Internet Security
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register