confusearch.dll - Dangerous
confusearch.dll
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
After running the CISVC32.exe it creates ConfuSearch.dll and
STRAd32.dll in the %SysDir% folder (where %SysDir% is the the Widnows
System(for Windows 95/98/Me) or System32 folder(for Windows
NT4/2000/XP).
CISVC32.exe registers both DLLs in th registry.
STRAd32.dll is the Browser Helper Object. It's used for logging
visited pages.
Adds the sub-key {1433F750-E53F-11D8-9669-0800200C9A66} to:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
ConfuSearch.dll - URL search hook object.
Adds the sub-key {D7CD08F0-D691-11D8-9669-0800200C9A66} to the :
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks
It sends the user search requests to the:
http://www.dnscaching.net/search/?q=
Creates the keys:
HKCR\TypeLib\{D7CD08E1-D691-11D8-9669-0800200C9A66}
HKCR\TypeLib\{1433F742-E53F-11D8-9669-0800200C9A66}
HKCR\CLSID\{1433F750-E53F-11D8-9669-0800200C9A66}
HKCR\Interface\{1433F74F-E53F-11D8-9669-0800200C9A66}
To remove it you need to unregister both DLL's.
Run the command:
regsvr32 /u STRAd32.dll
regsvr32 /u ConfuSearch.dll
Delete other registry keys using regedit (it's not necessary).