Coolwwwsearch - mpeux.exe & xjoffzr.exe



  • 1. Cookie Blocking Changes
    After visiting a few sites recommended in posts here, I recently changed my IE settings to block cookies. The problem is that now every time I visit a web site, I'm prompted to download cookies, even at I don't know when it's safe and when it's not. Usually there are multiple prompts. Is there a way to set IE to allow session cookies and prompt for the others? TIA.
  • 2. Hijacked?
    I receive several emails per week indicating that my emails are undeliverable. The following is typical but not exclusive. "Hi. Message from Undelivered message to XXXX@XXXXX.COM " I have no idea who "osecwolic" is and I have certainly not sent any emails there. I have a hardware firewall, a software firewall, anti-virus software and spyware blocker software. I use WinXP/SP2. I have not noticed any reduction in performance of my system. Do these messages mean that my system has been hijacked? Peter.
  • 3. Files corrupt, with comment
    When trying to run, comand promt pops-up and inside is written: "Program too big to fit in memory"

Coolwwwsearch - mpeux.exe & xjoffzr.exe

Postby TWVwbw » Sat, 08 Jan 2005 00:49:02 GMT

Are mpeux.exe and xjoffzr.exe files problems associated with this virus?  or 
any other virus?  I noticed that in our office one of the computers having 
problems had these two.

Thanks Mepo

Re: Coolwwwsearch - mpeux.exe & xjoffzr.exe

Postby Jim Byrd » Sat, 08 Jan 2005 01:36:12 GMT

i Mepo - There are a number of viruses and malware which create files with
pseudo-random type file names, including several of the CWSearch variants.
It's impossible to identify these specific names as belonging to a
particular piece of malware just from the name. For your problem at work,
you might want to try to clean up the machine in question using some of the
available proven tools. It will take some effort. Try working your way
through the following:

Sounds like this might be a variant of some malware called CoolWebSearch (if
CWShredder doesn't fix it, then see AdAware, SpyBot, and HijackThis, below,
in that order). You can read about CWSearch here: The CoolWebSearch

A good general "malware" removal site FAQ's with pretty good step-by-step
instructions is available for review here:

Read all of the following carefully first, then do the following in order:

Before you try to remove spyware using any of the programs below, download
both a copy of LSPFIX here:

AND a copy of Winsockfix for W95, W98, and ME
Directions here:

or here for Win2k/XP
Info here:
Directions here:

The process of removing certain malware may kill your internet connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
to regain your connection.

NOTE: It is reported that in XP SP2, the Run command netsh winsock reset
will fix this problem without the need for these programs. (You can also
try this if you're on XP SP1. There has also been one, as yet unconfirmed,
report that this also works there.) Also, one MS technician suggested the
following sequence:

netsh int reset all
ipconfig /flushdns

See also: for additional XPSP2
info/approaches using the netsh command.

Show hidden files and run all of the following removal tools from Safe mode
or a "Clean Boot" when possible. Reboot and test if the malware is fixed
after using each tool.
HOW TO Enable Hidden Files

Clean Boot - General Win2k(if w/msconfig)/XP procedure, but see below for
links for other OS's:
1. Start|Run enter msconfig.
2. On the General tab, click Selective Startup, and then clear the Process
System.ini File, Process Win.ini File, and Load Startup Items check boxes.
Leave the boot.ini boxes however they are currently set.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button.
4. Click OK and then reboot.

For additional information about how to clean boot your operating system,
click the following article numbers to view the articles in the Microsoft
Knowledge Base:
310353 How to Perform a Clean Boot in Windows XP
281770 How to Perform Clean-Boot Troubleshooting for Windows 2000
267288 How to Perform a Clean Boot in Windows Mille

Return to virus


Who is online

Users browsing this forum: No registered users and 57 guest