drxcount.biz / real-yellow-page.com UPDATE
After much analyzing, headaches and sleepless nights I am glad to say that the experts who worked on this did a tremendous job and we are getting near a manual removal sollution. Please follow instructions on Merijn's page :NOTE
* : because Merijn's site still is up and down these days, i'll copy his post in this thread :
**Taken from Merijn's site! :
If your browser has been hijacked to drxcount.biz, real-yellow-page.com or list2004.com:
We are working on a fix for this one and drawing near to a solution. This is by far the most sophisticated CWS variant seen to date, and it will take some time before CWShredder will be able to remove it automatically.
So far, the following manual fix should work:
First download FAR explorer from here:
Install it, then start FAR.
Hit Alt-F1 and drive list should come up, go to '0 process list'.
Scroll to Iexplore.exe in the left panel, highlight it and hit F5.
Now go to the right pane of FAR and double click 'iexplore.exe.txt', it should open in notepad.
Look for a file with this size and beginning to it. The filename will always be different:
61C00000 F000 c:\windows\system32\wingn.dll
This part indicates the bad file:
It will always start with that header.
Write down the filename behind it.
Now download KillBox:
Unzip and run it.
Paste the filename you wrote down into the white kill line, then hit the bottom green arrow button to move the file to the bottom of killbox. Hit the 'remove on reboot' button and reboot. Once it reboots, make sure the file is gone.
If this doesn't work, search for more help on one of these following forums, the experts will assist you further :
-> this forum of courseWildersSecuritySpywareInfoComputerCopsTechSupportGuy
It will take some time before the shredder will be updated including this fix.
Thnx all and very good job !