InterMute > Threat
Research
Winshow is a pop-up opener implemented as an Internet Explorer
Browser Helper Object, controlled by 00hq.com.
Distribution
The origin of Winshow is currently unknown.
What it does
Advertising
Yes. When a targeted word or phrase is spotted in a web site
you are viewing in Internet Explorer, Winshow may open a pop-up
advert. So far adverts have been served from 00hq.com and
8ad.com.
Privacy violation
No.
Security issues
Yes. Winshow can download and execute arbitrary unsigned
code from its controlling server, as a self-updating feature.
Stability problems
None known.
Removal
No uninstall feature has been seen.
Manual removal
Open a DOS command prompt window (from Start->Programs->Accessories),
and enter the following commands:
cd "%WinDir%\System"
regsvr32 /u "..\winshow.dll"
Restart the computer and you should be able to delete the
files winshow.dll, winshow.cfg and dict.dat from the Windows
folder.
|
