Spy Sweeper with AntiVirus

The most award-winning anti-spyware software

Spy Sweeper with Antivirus

Get serious about removing spyware with Spy Sweeper - the award-winning anti-spyware software trusted by millions of home computer users.

Add to Cart Button

$29.95

Spyware & Virus Directory

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 

Adware.Caishow

Updated: September 20, 2006 11:17:14 AM ZE9
Type: Adware
Risk Impact: Low

SUMMARY


Behavior

Adware.Caishow is a Chinese application that may display pop-up advertisements.

Symptoms

Your Symantec program detects Adware.Caishow.

Transmission

Protection

  • Virus Definitions (LiveUpdate™ Daily) June 12, 2006
  • Virus Definitions (LiveUpdate™ Weekly) June 14, 2006
  • Virus Definitions (Intelligent Updater) June 12, 2006
  • Virus Definitions (LiveUpdate™ Plus) June 12, 2006

TECHNICAL DETAILS



When Adware.Caishow is executed, it performs the following actions:
  1. Creates the following files:

    • %ProgramFiles%CaiShow TechCaiShowBrowerHelper.dll
    • %ProgramFiles%CaiShow TechCaiShowCaiShow.exe
    • %ProgramFiles%CaiShow TechCaiShowMMSFactory.dll
    • %ProgramFiles%CaiShow TechCaiShowMMSSend.dll
    • %ProgramFiles%CaiShow TechCaiShowSendShell.exe
    • %ProgramFiles%CaiShow TechCaiShowUpdate.exe
    • %ProgramFiles%CaiShow TechCaiShowUpdateManager.exe
    • %ProgramFiles%CaiShow TechCaiShow[CHINESE CHARACTERS].exe
    • %System%MicrosoftNet.dll

      Notes:
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:Program Files.
    • %System% is a variable that refers to the System folder. By default this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).

  2. Creates the following nonmalicious files:

    • %ProgramFiles%CaiShow TechCaiShowcaishow.htm
    • %ProgramFiles%CaiShow TechCaiShowcaishow.ini
    • %ProgramFiles%CaiShow TechCaiShowdefaultrec.dll
    • %ProgramFiles%CaiShow TechCaiShowdfmmssendrec.dll
    • %ProgramFiles%CaiShow TechCaiShowDownload.dll
    • %ProgramFiles%CaiShow TechCaiShowgdiplus.dll
    • %ProgramFiles%CaiShow TechCaiShowmadlldlib.dll
    • %ProgramFiles%CaiShow TechCaiShowmfc71.dll
    • %ProgramFiles%CaiShow TechCaiShowmfc71u.dll
    • %ProgramFiles%CaiShow TechCaiShowmp4lib.dll
    • %ProgramFiles%CaiShow TechCaiShowmsvcp71.dll
    • %ProgramFiles%CaiShow TechCaiShowmsvcr71.dll
    • %ProgramFiles%CaiShow TechCaiShowSendMMS.htm
    • %ProgramFiles%CaiShow TechCaiShowssoaddionalindical.dll
    • %ProgramFiles%CaiShow TechCaiShowupdate.ini
    • %ProgramFiles%CaiShow TechCaiShowwavdest.dll
    • %Windir%Installer[RANDOM NAME].msi

      Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:Windows (Windows 95/98/Me/XP) or C:Winnt (Windows NT/2000).

  3. Creates and populates the following registry subkeys:

    HKEY_CLASSES_ROOTAppIDBrowerHelperMFC.DLL
    HKEY_CLASSES_ROOTAppIDMy.DLL
    HKEY_CLASSES_ROOTAppIDssoaddionalindical.DLL
    HKEY_CLASSES_ROOTAppID{18E8C855-FF2E-4BEB-B9D2-E7B25AF92A48}
    HKEY_CLASSES_ROOTAppID{37BC804E-E26B-4D09-836F-AC15FC0C253E}
    HKEY_CLASSES_ROOTAppID{FBB4D7BA-CCD3-457D-BEFF-F3B1757BD6B1}
    HKEY_CLASSES_ROOTCLSID{3AF40CB8-B3BA-4E2D-8968-4BF8DB172997}
    HKEY_CLASSES_ROOTCLSID{5673A7C0-95CC-4646-BB07-3BD71234CEF9}
    HKEY_CLASSES_ROOTCLSID{DD6C4862-4BF9-48CE-BD27-9838E30D3DD5}
    HKEY_CLASSES_ROOTInterface{315420B2-E5C8-4E7B-B812-6676BA4F30CE}
    HKEY_CLASSES_ROOTInterface{6CA6DE10-8705-4E1B-9117-BCFA5BECE14B}
    HKEY_CLASSES_ROOTInterface{CE98AD53-16F1-48D3-9208-1203AA19F77E}
    HKEY_CLASSES_ROOTInterface{D32D8A55-A21A-4237-B8BB-5A5EBEE6746D}
    HKEY_CLASSES_ROOTInterface{DBD14208-5F2F-40B8-8D97-6DE44C1D2E3D}
    HKEY_CLASSES_ROOTInterface{DC616C5A-3BD6-4774-9823-F20802655811}
    HKEY_CLASSES_ROOTInterface{F6CE85C8-99E7-49F5-A1A2-03FFC4FF09A5}
    HKEY_CLASSES_ROOTTypeLib{1F805A43-0E95-4245-8EAF-9271D520722A}
    HKEY_CLASSES_ROOTTypeLib{73D53D7B-66DF-419B-9B44-CF3F42ADF5C9}
    HKEY_CLASSES_ROOTTypeLib{864F198D-6568-4686-B4F5-4A970B85E58B}
    HKEY_CLASSES_ROOTTypeLib{89A99589-82B0-4983-A882-E8D8DB3DA5C7}
    HKEY_CLASSES_ROOTTypeLib{CEBE027D-5423-41B8-AF51-9F1C22557CC6}
    HKEY_CLASSES_ROOTTypeLib{D0581D47-E3CB-402D-B8A6-5F8561B2A36C}
    HKEY_CLASSES_ROOTBrowerHelperMFC.CaiShowBH
    HKEY_CLASSES_ROOTBrowerHelperMFC.CaiShowBH.1
    HKEY_CLASSES_ROOTMy.NetAccelerate
    HKEY_CLASSES_ROOTMy.NetAccelerate.1
    HKEY_CLASSES_ROOTssoaddionalindical.Identify
    HKEY_CLASSES_ROOTssoaddionalindical.Identify.1
    HKEY_CLASSES_ROOTemffileshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTgiffileshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTjpegfileshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTMIDFileshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTmp3fileshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTMSPaper.Documentshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTPaint.Pictureshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTpngfileshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTSoundRecshell[CHINESE CHARACTERS]
    HKEY_CLASSES_ROOTTIFImage.Documentshell[CHINESE CHARACTERS]
    HKEY_LOCAL_MACHINESOFTWARECaiShow
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3AF40CB8-B3BA-4E2D-8968-4BF8DB172997}
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{5673A7C0-95CC-4646-BB07-3BD71234CEF9}
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes51D767EC8AF379D43B3E631A28E7DEF7
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components14AA5729DADA23D2F57C1C2297718AC2
    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Products8D15EFAFF3F76694E8331E3D97FE51D7
    HKEY_CURRENT_USERSoftwareClassesAppIDDownload.DLL
    HKEY_CURRENT_USERSoftwareClassesAppIDMMSFactory.DLL
    HKEY_CURRENT_USERSoftwareClassesAppIDMMSSend.DLL
    HKEY_CURRENT_USERSoftwareClassesAppID{22A36E6E-07CB-4851-AA84-5FC1CA73A1DE}
    HKEY_CURRENT_USERSoftwareClassesAppID{88ABD365-12AE-44E7-8450-DA5C3653325B}
    HKEY_CURRENT_USERSoftwareClassesAppID{F375F726-23D3-4179-9CA2-54FE6E490879}
    HKEY_CURRENT_USERSoftwareClassesCLSID{0E6E0B51-0300-4AE2-B6C4-F4EFE33A33B2}
    HKEY_CURRENT_USERSoftwareClassesCLSID{32F64094-A155-4554-8753-E5E267A8C002}
    HKEY_CURRENT_USERSoftwareClassesCLSID{6ABB6C58-FEB7-43AE-946A-AF05D074F493}
    HKEY_CURRENT_USERSoftwareClassesInterface{315420B2-E5C8-4E7B-B812-6676BA4F30CE}
    HKEY_CURRENT_USERSoftwareClassesInterface{DBD14208-5F2F-40B8-8D97-6DE44C1D2E3D}
    HKEY_CURRENT_USERSoftwareClassesInterface{DC616C5A-3BD6-4774-9823-F20802655811}
    HKEY_CURRENT_USERSoftwareClassesInterface{F6CE85C8-99E7-49F5-A1A2-03FFC4FF09A5}
    HKEY_CURRENT_USERSoftwareClassesDownload.Download
    HKEY_CURRENT_USERSoftwareClassesDownload.Download.1
    HKEY_CURRENT_USERSoftwareClassesMMSFactory.Send
    HKEY_CURRENT_USERSoftwareClassesMMSFactory.Send.1
    HKEY_CURRENT_USERSoftwareClassesMMSSend.Send
    HKEY_CURRENT_USERSoftwareClassesMMSSend.Send.1
    HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExt[CHINESE CHARACTERS]
    HKEY_CURRENT_USERSoftwareMicrosoftInstallerFeatures8D15EFAFF3F76694E8331E3D97FE51D7
    HKEY_CURRENT_USERSoftwareMicrosoftInstallerProducts8D15EFAFF3F76694E8331E3D97FE51D7
    HKEY_CURRENT_USERSoftwareMicrosoftInstallerUpgradeCodes51D767EC8AF379D43B3E631A28E7DEF7
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats{3AF40CB8-B3BA-4E2D-8968-4BF8DB172997}
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats{5673A7C0-95CC-4646-BB07-3BD71234CEF9}

  4. Adds the values:

    "C:Program FilesCaiShow TechCaiShow" = ""
    "C:Program FilesCaiShow Tech" = ""

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders

  5. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowMMSFactory.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components262F10FC566740686B539050DE7DB69

  6. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowMMSSend.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components41E0BFCEE60FBA83E34DFD1628090FF

  7. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowCaiShow.exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF88A300530942E96B8D37506857E506

  8. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmsvcr71.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsFF2AEFF45EEA0A48A4B33C1973B6094

  9. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C?WINDOWSsystem32MicrosoftNet.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components14AA5729DADA23D2F57C1C2297718AC2

  10. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowssoaddionalindical.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components1912BE7FD83F3D26BC7C94B6B2AB7D78

  11. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowDownload.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components1DEA09A7138CF5B3C2CCE72A2E7C5ED2

  12. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "01:SoftwareMicrosoftInternet ExplorerMenuExt[CHINESE CHARACTERS]contexts"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components1F246B57F05476CA11E5858E0508A143

  13. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "01:SoftwareMicrosoftInternet ExplorerMenuExt[CHINESE CHARACTERS]"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components288249C0965235B1D6E1E68F2664D6BF

  14. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = ""

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components2BCD7B4C1786475E0BBB347A1EAD64A9

  15. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmsvcp71.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components305B09CE8C53A214DB58887F62F25536

  16. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowcaishow.htm"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components32EB6BCD8253993E8281808D6265ADD2

  17. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowdefaultrec.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components34135461A6C1DFF5C25EA5AD34866A15

  18. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = ""

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components4A8C3C5263190A44A01498D716DF370D

  19. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmfc71u.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components52AA4CA3A82A90F428A603ACA026F053

  20. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmp4lib.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components58AFFA0581745225300DA35FFE91E85C

  21. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowcaishow.ini"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components6DAFA372696644ED48471B0CB1EF33F0
  22. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowBrowerHelper.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components7D0F9833BA32EE4050A2AE33EA58660F

  23. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowSendShell.exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components8043E79E62D55612D5B2B54A5CD33410

  24. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowwavdest.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components84755F8FCF90F80B0AB0AA245848185B

  25. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmfc71.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components84AC706F233C9204FAA893DB6F19C24D

  26. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "02:SoftwareCaiShowini"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components8AF2DBB21506EFC3C1A44D39AA6C6687

  27. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "02:SoftwareCaiShowpath"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components957AE07208ABDBD242355856D8F90CBA

  28. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShow[CHINESE CHARACTERS].exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsA552277172AC17C688357D0F7705D587

  29. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowUpdateManager.exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsAA35EABA21C53B418ABB6615E517D65C

  30. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmadlldlib.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsCA146A70E068ACFCF0525620348A8144

  31. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowdfmmssendrec.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsD1349BFF71B6168EB2D8FA7FFAA1D0EE

  32. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowSendMMS.htm"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsE3A0E19C005360470407E07A0CE0A6D7

  33. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowgdiplus.dll"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF1B496B301445D115AA4000972A8B18B

  34. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "02:SoftwareCaiShowshell"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF1F463F9A4C24C1894228DA7B322813E

  35. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowUpdate.exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF766C97F4C3C8E6B156736593C092669

  36. Adds the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowupdate.ini"

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsFA88DB4C2049552173960AEC970F7588

  37. Adds the value:

    "C:WINDOWSsystem32MicrosoftNet.dll" = [NUMBER]

    to the registry subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs

  38. Attempts to register an uninstaller with the following parameters:

    Display name: Microsoft Explore Ex
    Uninstall string: MsiExec.exe /I{FAFE51D8-7F3F-4966-8E33-E1D379EF157D}

    by creating and populating the following registry entry:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{FAFE51D8-7F3F-4966-8E33-E1D379EF157D}

  39. Display pop-up advertisements.


REMOVAL



The following instructions pertain to all Symantec antivirus products that support security risk detection.
  1. Update the definitions.
  2. Run a full system scan.
  3. Delete any values added to the registry.
For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.


2. To run the scan
  1. Start your Symantec antivirus program, and then run a full system scan.
  2. If any files are detected, and depending on which software version you are using, you may see one or more of the following options:

    Note: This applies only to versions of Norton AntiVirus that support security risk detection. If you are running a version of Symantec AntiVirus Corporate Edition that supports security risk detection, and security risk detection has been enabled, you will only see a message box that gives the results of the scan. If you have questions in this situation, contact your network administrator.
    • Exclude (Not recommended): If you click this button, it will set the risk so that it is no longer detectable. That is, the antivirus program will keep the security risk on your computer and will no longer detect it to remove from your computer.

    • Ignore or Skip: This option tells the scanner to ignore the risk for this scan only. It will be detected again the next time that you run a scan.

    • Cancel: This option is new to Norton Antivirus 2005. It is used when Norton Antivirus 2005 has determined that it cannot delete a security risk. This Cancel option tells the scanner to ignore the risk for this scan only, and thus, the risk will be detected again the next time that you run a scan.

      To actually delete the security risk:
      • Click its file name (under the Filename column).
      • In the Item Information box that displays, write down the full path and file name.
      • Then use Windows Explorer to locate and delete the file.

    • Delete: This option will attempt to delete the detected files. In some cases, the scanner will not be able to do this.
      • If you see a message, "Delete Failed" (or similar message), manually delete the file.
      • Click the file name of the risk that is under the Filename column.
      • In the Item Information box that displays, write down the full path and file name.
      • Then use Windows Explorer to locate and delete the file.

Important: If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode. Once you have restarted in Safe mode, run the scan again.

After the files are deleted, restart the computer in Normal mode and proceed with the next section.

Warning messages may be displayed when the computer is restarted, since the risk may not be fully removed at this point. You can ignore these messages and click OK. These messages will not appear when the computer is restarted after the removal instructions have been fully completed. The messages displayed may be similar to the following:

Title: [FILE PATH]
Message body: Windows cannot find [FILE NAME]. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

3. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document: How to make a backup of the Windows registry.
  1. Click Start > Run.
  2. Type regedit

    Then click OK.

    Note: If the registry editor fails to open the risk may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

  3. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
  4. In the right pane, delete the values:

    "C:Program FilesCaiShow TechCaiShow" = ""
    "C:Program FilesCaiShow Tech" = ""

  5. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components262F10FC566740686B539050DE7DB69
  6. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowMMSFactory.dll"
  7. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components41E0BFCEE60FBA83E34DFD1628090FF
  8. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowMMSSend.dll"
  9. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF88A300530942E96B8D37506857E506
  10. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowCaiShow.exe"
  11. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsFF2AEFF45EEA0A48A4B33C1973B6094
  12. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmsvcr71.dll"
  13. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components14AA5729DADA23D2F57C1C2297718AC2
  14. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C?WINDOWSsystem32MicrosoftNet.dll"
  15. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components1912BE7FD83F3D26BC7C94B6B2AB7D78
  16. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowssoaddionalindical.dll"
  17. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components1DEA09A7138CF5B3C2CCE72A2E7C5ED2
  18. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowDownload.dll"
  19. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components1F246B57F05476CA11E5858E0508A143
  20. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "01:SoftwareMicrosoftInternet ExplorerMenuExt[CHINESE CHARACTERS]contexts"
  21. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components288249C0965235B1D6E1E68F2664D6BF
  22. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "01:SoftwareMicrosoftInternet ExplorerMenuExt[CHINESE CHARACTERS]"
  23. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components2BCD7B4C1786475E0BBB347A1EAD64A9
  24. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = ""
  25. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components305B09CE8C53A214DB58887F62F25536
  26. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmsvcp71.dll"
  27. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components32EB6BCD8253993E8281808D6265ADD2
  28. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowcaishow.htm"
  29. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components34135461A6C1DFF5C25EA5AD34866A15
  30. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowdefaultrec.dll"
  31. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components4A8C3C5263190A44A01498D716DF370D
  32. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = ""
  33. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components52AA4CA3A82A90F428A603ACA026F053
  34. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmfc71u.dll"
  35. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components58AFFA0581745225300DA35FFE91E85C
  36. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmp4lib.dll"
  37. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components6DAFA372696644ED48471B0CB1EF33F0
  38. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowcaishow.ini"
  39. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components7D0F9833BA32EE4050A2AE33EA58660F
  40. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowBrowerHelper.dll"
  41. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components8043E79E62D55612D5B2B54A5CD33410
  42. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowSendShell.exe"
  43. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components84755F8FCF90F80B0AB0AA245848185B
  44. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowwavdest.dll"
  45. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components84AC706F233C9204FAA893DB6F19C24D
  46. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmfc71.dll"
  47. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components8AF2DBB21506EFC3C1A44D39AA6C6687
  48. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "02:SoftwareCaiShowini"
  49. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]Components957AE07208ABDBD242355856D8F90CBA
  50. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "02:SoftwareCaiShowpath"
  51. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsA552277172AC17C688357D0F7705D587
  52. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShow[CHINESE CHARACTERS].exe"
  53. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsAA35EABA21C53B418ABB6615E517D65C
  54. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowUpdateManager.exe"
  55. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsCA146A70E068ACFCF0525620348A8144
  56. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowmadlldlib.dll"
  57. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsD1349BFF71B6168EB2D8FA7FFAA1D0EE
  58. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowdfmmssendrec.dll"
  59. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsE3A0E19C005360470407E07A0CE0A6D7
  60. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowSendMMS.htm"
  61. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF1B496B301445D115AA4000972A8B18B
  62. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowgdiplus.dll"
  63. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF1F463F9A4C24C1894228DA7B322813E
  64. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "02:SoftwareCaiShowshell"
  65. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsF766C97F4C3C8E6B156736593C092669
  66. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowUpdate.exe"
  67. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData[USER SID]ComponentsFA88DB4C2049552173960AEC970F7588
  68. In the right pane, delete the value:

    "8D15EFAFF3F76694E8331E3D97FE51D7" = "C:Program FilesCaiShow TechCaiShowupdate.ini"
  69. Navigate to the subkey:

    HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
  70. In the right pane, delete the value:

    "C:WINDOWSsystem32MicrosoftNet.dll" = [NUMBER]

  71. Exit the Registry Editor.



Spy Sweeper 5.2 stops spyware in its tracks while offering home computer users the ability to configure the program to suit their specific needs, such as:

Choose a Quick, Full or Custom Sweep: With Spy Sweeper 5.2, you can easily choose to perform a quick, full or customized sweep. If you're looking for an immediate diagnosis, choose a quick sweep. For a pinpointed search, customize your sweep to have Spy Sweeper skip files by folder or file extension. For a deep cleaning, opt for a full sweep.

Exclude Files from a Sweep: Spy Sweeper allows you to save time during a sweep by skipping specific files or different sections of your PC. You can select specific file extension, such as .xls or .mpg to exclude.

Additional Highlights

As soon as it's installed, Spy Sweeper gives 360 degrees of protection against spyware, including:

Simple Sweeps: Detecting spyware and removing unwanted programs found on your computer in three effortless steps

Easy Management: Quickly and simply configure program, sweep and upgrade options

Fast Home: Use the home screen to access the most commonly used functions of Spy Sweeper

Shields Summary: A redesigned shields summary page makes it simple to see at a glance which shields are on or off

Action Alerts: Receive clear, easy-to-understand notifications when new spyware threats are detected

"Spy Sweeper remains a favorite for protection from spyware."



"This program's dominance is apparent as soon as you install it."