From: "Geo" 

"Jeff Shultz"  wrote in message
news:pan.2005.01.14.02.38.32.741358{at}shultzinfosystems.com...

> Anyone notice that there seems to be a new and rather resistant version of
> CoolWebSearch out there now? I've run into it a couple times now.
> cwsweeper doesn't see it, Ad-Aware might see it, but can't kill it.

No but I ran into a new bot that's damn impossible to kill using remover
programs. usb2.exe or something like that, the tcpview program
http://www.sysinternals.com/ntw2k/source/tcpview.shtml shows dozens of
ports open and the process as "hidden", I only found the exe by
searching for file dates around the time of infection. Nasty bugger. I
posted about it in another post in nthelp I believe.

Geo.

--- BBBS/NT v4.01 Flag-5