Windows Forum

Ask something
Discussion Locked

CoolWebSearch

0 helpful
20 replies

by megasurfer

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Has anyone figured out a way to remove the latest version of CoolWebSearch from an infected computer. This "ScumWare" is like a really bad case of athletes foot, it just keeps coming back no matter what you do to it. I saw on the net that the guy that has been writing CWSShreder has given up. Said that the latest version had whipped his butt. The last 3 computers I have had to deal with that were infected, I ended up formatting and reinstalling, after trying for about 12 hours to get rid of it. I have tried a dozen different Ad/Spy ware removers that claim to get rid of it, and none of them worked. Help!!!!!
Thanks in advance,
Gary

20 replies

by tabcomputers2002

Last time I had it, I used Spybot Search and Destroy to get rid of it. I would try that or Ad-aware. Both can be found at www.download.com I usually run one as a double check for other.

Good luck
Tim

by willcomp

I run both Ad-Aware and Spybot but they are not always effective in removing Cool Web Search which is modified frequently.

by willcomp

Out of curiosity, went to Merijn.org to see wahat's new with CWS. Found out CWShredder is no longer being updated since CWS is growing more complex and therefore more difficult to remove. There are some useful links on the site if CWShredder doesn't do the job.

by willcomp

Should have read your initial post more carefully. Hadn't had enough caffeine yet. You had already been there. But would like to know if you have any file info including dates for this latest incarnation of adware from hell. I haven't seen it yet, but it's just a matter of time.

Good luck. Hope you are successful.

by megasurfer

Don't have any file info, but this is the wildest thing I have ever seen. I can run AdAware, find the .exe file that is running, open up taskmanager, end the process, delete the file, reboot the computer, and the same process is running, but with a different file name. If you turn off scripting, and java in internet explorer, you can reset to program defaults, and it will stay that way, but there are a lot of web pages you can't use with it set like that.

by tabcomputers2002

Wow you got me stumped.. What version of windows are you running? I know on XP you will need to turn off the system restore before running either program and turn it back on after you've removed everything and rebooted.

Tim

by pierrejamme

SpyBot Search and Destroy version 1.3 finds some versions. Rather dissapointed with them though as it didn't tell me there are any updates if updating with version 1.2??

by megasurfer

I spent $150 so far trying different programs, including that one. Most of them find it, or portions of it, but they don't get rid of it.

by willcomp

Did you run last version of CWShredder available?

Also wouldn't hurt to run hijack this (also available at merijn.com) if you haven't done so already. May show where the critter is hiding.

It is common practice for CWS and some other adware/spyware/hijackers to reproduce and rename files each time PC is booted.

Before obtaining CWShredder, I spent hours searching through the registry on one system trying to remove what was then unknown (to spybot and ad-aware) malware. Turned out to be early version of CWS.

Happy hunting.

by megasurfer

Tried that, didn't get much help. Thanks. Finally gave up and formatted, reinstalled OS.

by megasurfer

Got rid of it on one computer I worked on today. Downloaded X-Cleaner, from www.xblock.com, installed it on my computer, popped the hard drive from the infected computer into my removable drive bay, and scanned it. Then I put it back in other computer, booted up and scanned again. X-Cleaner found 3 more files. Reset I.E. defaults, and it worked. Had another computer with what looked like the identical infection. Tried the same thing, didn't work. The only difference was that the second computer had MS Office on it, and every time I thought I had gotten rid of it, when I would start up I.E., an installation window for MS office would pop up, do a short install, and CoolWebSearch would be right back? I don't think CoolWebSearch is very COOL!!!! I wanted to uninstall Office, and try again, but did not have customers disk.
I will try sending he Hijackthis log to that web site. Thanks

This discussion is closed to new replies.