Quick Links: SpywareGuide Greynets Blog | SpywareGuide Product Database | SpywareGuide Company Database | SpywareGuide Categories
Search SpywareGuide Database & Site
Security Email Alerts & Updates
SpywareGuide powered by FaceTime Security Labs
Full Name:
CnsMin Websearch   Read More
Type: Adware
Created by: Beijing 3721 Technology Company Ltd.
SG Index: 5 [Explain]
Removal tools: List of products that detect/remove/protect against CnsMin:
  • Desktop Anti-malware: Pro User: X-Cleaner
  • Control IM and P2P use, block spyware and other malware: RTGuardian
  • Endpoint Spyware Remediation: Greynet Enterprise Manager
  • IM, P2P control, malware prevention and web filtering in single appliance: Unified Security Gateway
  • Category Description: Program that delivers advertisements on your PC.

    Note that many websites have their own advertising, unrelated to adware.

    Adware is any software application in which advertising is displayed while the program is running. The authors of these applications include additional code that delivers the ads, which can be viewed through pop-up windows or through a bar that appears on a computer screen and sometimes through text links or in integrated search results. Adware may or may not track personal information. It may also gather information anonymously or in aggregate only. Users should check the EULA and Privacy policy to ensure if the adware on their machines conforms to their standards.
    Comment: Other than replacing the IE search feature with a Chinese site likely to be incomprehensible to non-Chinese users, CnsMin is not overtly harmful, but it uses extremely anti-social methods to make it difficult to uninstall. Is installed by ActiveX drive-by-download at its company's site, 3721.com. Has also apparently been included in junk e-mail, which could be how some Western users have ended up with it.
    Screenshots:
    CnsMin This product alters the advanced options in IE.
    Information URL: http://www.3721.com/
       
    Manual removal: You cannot delete CnsMin whilst it is running; if you try to deregister it, it restores all its registry entries immediately. In Windows 95 and 98 you can boot without loaded it must be done by using Start -> Shutdown -> Restart in MS-DOS mode and typing the following commands:

    cd DOWNLO~1
    del cns*.*
    del 3721\*.*
    rmdir 3721
    exit
    Then reboot.

    In Windows NT/2000/XP it is possible to move the files so that they cannot be reloaded. Open the Command prompt (Start -> Programs -> Accessories) and type:

    cd "%WinDir%\Downloaded Program Files"
    ren CnsMin.dll CnsDel.dll
    Reboot and load the Command prompt again. Type:

    cd "%WinDir%\Downloaded Program Files"
    del cns*.*
    The first time you reboot after deleting or moving CnsMin you'll get an error about not being able to find it. Ignore this. To clean up the remaining traces of the software that cause this, open the registry (Start -> Run -> regedit) and delete the following keys:

    HKEY_CLASSES_ROOT\CLSID\{B83FC273-3522-4CC6-92EC-75CC86678DA4}
    HKEY_CLASSES_ROOT\CLSID\{D157330A-9EF3-49F8-9A67-4141AC41ADD4}
    HKEY_CLASSES_ROOT\CnsHelper.CH
    HKEY_CLASSES_ROOT\CnsHelper.CH.1
    HKEY_CLASSES_ROOT\CnsMinHK.CnsHook
    HKEY_CLASSES_ROOT\CnsMinHK.CnsHook.1
    HKEY_CURRENT_USER\Software\3721
    HKEY_LOCAL_MACHINE\Software\3721
    HKEY_LOCAL_MACHINE\Software\InterChina
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AdvancedOptions\!CNS
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{5D73EE86-05F1-49ed-B850-E423120EC338}
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}
    HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{FD00D911-7529-4084-9946-A29F1BDF4FE5}
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CnsMin
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\CnsMin
    Properties:
  •  Alters Key Windows Components
  •  Autostarts/Stays Resident
  •  Connects to the internet
  •  Force, hidden or stealth install
  •  No EULA present
  •  Stealth Tactics
  • Related Products
    Product Category Comment
  •  Trojan.Bind
  • Trojan

    User Comments about this Product

    What does the rating mean?
    Rating: 
    CnsMin in my computer was detected and fixed by Spybots Search and Destroy. Imediately after Sybots said it had fixed the problem i restarted the computer end had Spybots scan the computer again. CnsMin was not detected this time, so it looks as if Sybots Search and Destroy managed to eliminate it. I most certainly got this infection either by installing Foxmail or by my attempts to change the encoding. In the course of these attempts I was invited to download (or install) te simplified Chines characters. I indeed started doing so but immediately afterwards realized thes was nonsense siI stopped that procedure and the Chinese script was not installed (I hope). At least there is no font including Chinies characters in my font folder. I hope this information is of any use, althoug I have some doubts on that.
    User:  HenkProeme

    Click here to leave feedback for this product

    Help with the BUST!
    Click here and give us what details you have and let our international research team take it from there. If you desire your report will remain anonymous.
    Recent Blog Posts
  • Interesting Myspace Feature
  • Safe Gaming For Kids
  • "Buy Cocaine" Spam
  • The New Testing PC Dance
  • Magic EBay Money
  • "Verify Your Hotmail Account now To Avoid It Closed?"
  • Spin?
  • Paypal Phish Wants Your Social Security Number
  • Something I've Noticed...
  • Give Me Your Login, Please
  • Recent Modifications
    2008-11-18  PPHack
    2008-11-13  VirusTrigger
    2008-11-13  Trojan.Agent.TMC
    2008-11-11  AntiSpywareXP
    2008-11-11  Sysda
    2008-11-10  Vundo
    2008-11-10  MSAntivirus
    2008-11-7  PassHax
    2008-11-4  CoolWebSearch
    2008-11-4  Mirar
     

    Site EULA | Site Map | Contact Us | About Us | Site and Spyware FAQ | Advertise | RSS Feeds  | Link To Us | SpywareGuide Japan Japanese

    © Copyright 2007, FaceTime Communications, Inc. All rights reserved.