Remove Winshow. Description and removal instructions

 
Title: Winshow

Type: Browser Hijackers
Severity scale:Winshow severity is 37  (37 / 100)
 
Winshow is a pop-up opener implemented as an Internet Explorer Browser Helper Object, controlled by 00hq.com. The origin is currently unknown. When a targeted word or phrase is spotted in a web site you are viewing in Internet Explorer, Winshow may open a pop-up advert. So far adverts have been served from 00hq.com and 8ad.com. Can download and execute arbitrary unsigned code from its controlling server, as a self-updating feature.


Winshow properties:
• Changes browser settings
• Shows commercial adverts
• Hides from the user
• Stays resident in background

Automatic Winshow removal:

remover for Winshow

Winshow manual removal:

Kill processes:
msupdater.exe, trojandownloader.win32.winshow.c.exe, trojandownloader.win32.winshow.e.exe, trojandownloader.win32.winshow.o.exe
Delete registry values:
'HKEY_CLASSES_ROOT\clsid\{6cc1c918-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_CLASSES_ROOT\clsid\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{6cc1c918-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_CLASSES_ROOT\winlink.viewsource'
'HKEY_CLASSES_ROOT\winlink.viewsource.1'
'HKEY_CLASSES_ROOT\winshow.viewsource'
'HKEY_CLASSES_ROOT\winshow.viewsource.1'
'HKEY_CURRENT_USER\software\winshow'
'HKEY_LOCAL_MACHINE\clsid\{6cc1c918-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_LOCAL_MACHINE\software\classes\clsid\{6cc1c918-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_LOCAL_MACHINE\software\classes\clsid\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_LOCAL_MACHINE\software\classes\winshow.viewsource'
'HKEY_LOCAL_MACHINE\software\classes\winshow.viewsource.1'
'HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6cc1c918-ae8b-4373-a5b4-28ba1851e39a}'
'HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ currentversion \ uninstall \ winshow'

Delete files:
msupdater.exe, winlink.dll, winshow.dll, winshow.dll, mshp.dll, trojandownloader.win32.winshow.c.exe, trojandownloader.win32.winshow.e.exe, trojandownloader.win32.winshow.o.exe
Delete directories:
\winlink
\winshow

Other programs to remove Winshow:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 19/03/04
Information updated: 18/06/05

Additional resources related to Winshow:

Attention: If you know or you have a website or page about Winshow removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Winshow parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:


Comments from visitors:


1. 6 of one and a half dozen of the other by Guest. 2005-06-18 12:06:30
Win32 is not only an annoyance, I eventually could not get on the internet to even investigate how to get rid of it. What I finally realized was I could do a system restore that returned my computer to 3 days prior before the fatal blow to my internet accessibility. I happily downloaded the fix that Yahoo provides and Win32 is now history - but my computer is SO SLOW with the fix. oh well.

2. by Boston. 2004-03-05 21:19:49
Currently used by 'SearchV' They used to be a (yet another) search engine site, but now every page requested redirects to porn.

The SearchV program changes your homepage to their own.


Related news:
Similar parasites:
Related articles:
Related discussions: