Discussion Locked

Spyware Problems

0 helpful
14 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I've been trying to get rid of all the sypware on my computer for 2 days and Just about have it cleanned up but I just can't get rid on two things Comet and a Cool Web Search. They are only affecting 2 of my 4 accounts and only load when the computer is restarted. Microsoft antispyware detects them trying to load at startup and removes them but they reappear on each restart. I've tried Ad aware, Spybot Search and Destory, Pest Patrol, Microsoft Antispware and Virus scans as well as searching the hard drive and registry for entries I can't get rid of them. Please help your sugesstions are greatly appreciated. Thanks.

14 replies

by kelvin lin

There can be a few reasons why you can't get rid of these two things.

1st. You maybe running sharewares or freewares which are supported by these spywares. So you will need to uninstall these softwares in order to remove the spywares.

2nd. These spywares processes maybe running when the anti-spywares remove them. So they can actually connect to internet and download the whole spywares again. That's why you will still see them after you restarted your computer. Go into command-prompt and type netcraft -b (You will need WinsXP SP2) and see which application are connected. If you see any suspicious application, please kill thier PIDs.

3rd. If above steps still cannot solve your problem, please boot your Windows OS into safemode without any networking and run microsoft anti-spyware to scan and remove whatever spywares you have found. Then reboot windows normally. The spywares should be cleared.

by black panther

Comet

How to Remove Comet Cursor?

Follow these removal instructions to remove Comet Cursor:

Click Start > Settings > Control Panel
Double-click the "Add/Remove Programs"
Select the entry "Comet- Comet Cursor 3.0".
Click the "Add/Remove"
Follow the instructions that appear
Sometimes the uninstall is not successful because some key file was manually deleted that the uninstall process needs. In these cases, you should go to http://www.cometcursor.com and reinstall it, and then proceed with a normal uninstall shown above.

Cool Web Search

let's try a few things, starting with the simplest:

download CWShredder 2.14 from http://majorgeeks.com/download3019.html

close Internet Explorer. run the CWS scan, and if any problems are found, allow it to FIX them. hopefully, this may solve your problem.... re-open Internet Explorer, and see what happens.

by willcomp

There is a new variant of CWS that cannot be removed by usual tools (Ad-Aware, Spybot, MS Anti-Spyware, Hijack This, CWShredder).

I have had reasonable success using Hijack This to temporarily stop the critter, booting into safe mode, and deleting files in Windows and Windows/system folders used by CWS.

Organize files by date since they will always be rather new files.

As someone else said, disconnect from internet and also turn off System Restore.

I know this is not specific, but file names change each time CWS loads.

Dalton

by borginva

To completely avoid, turn PC off. Truthfully.
If you really want to use it, prevention with running programs are best. Read their docs on how to use them and update them. All these are FREE.
Oh, yes! KEEP WINDOWS UP TO DATE! Use the AUTOMATIC UPDATE feature.

ONLINE VIRUS CHECKS, no software install required other than an Active X component if required (some do removals):
Symantec Security Check
http://security.symantec.com/sscv6/home.asp?langid=ie&venid=sym&plfid=23&pkj=QQWRORVWHFHMFNZMBBX
BitDefender
http://www.bitdefender.com/scan/licence.php
Panda ActiveScan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Trend Micro Online Virus Scan
http://housecall.antivirus.com/housecall/start_corp.asp
Trend Micro Housecall
http://housecall.trendmicro.com/
Virus Threat Center Blog
http://virusthreatcenter.com/?tag=zd.ft.fs.vtc
McAfee Virus Removal Tools
http://us.mcafee.com/virusInfo/default.asp?id=vrt

ONLINE SPYWARE CHECKS
ZoneAlarm Spyware Check
http://download.zonelabs.com/bin/promotions/spywaredetector/index3.html

REFERANCE
http://www.download.com/spyware-center/2001-2023-0.html?tag=note

ANTIVIRUS SOFTWARE (again all FREE)
Free avast! 4 Home Edition
http://www.asw.cz/eng/avast_4_home.html
AVG FREE
http://free.grisoft.com/freeweb.php
AntiVir? PersonalEdition Classic
http://www.free-av.com/index.htm
BitDefender Free Edition v7
http://www.bitdefender.com/bd/site/products.php?p_id=24

by borginva

ANTI SPYWARE (yes, all FREE)

About:Buster
http://www.malwarebytes.biz/index.php
Bug Off
http://www.spywareinfo.com/~merijn/downloads.html
CWShredder
http://www.intermute.com/spysubtract/cwshredder_download.html
HijackThis 1.99.1
http://www.spywareinfo.com/~merijn/downloads.html
Ad-Aware SE Personal edition
http://www.lavasoftusa.com/
Microsoft? Windows AntiSpyware (Beta) [I believe updates are done through Windows Update)
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Spybot Search and Destroy 1.3
http://www.safer-networking.org/
SpywareBlaster 3.3
http://www.javacoolsoftware.com/spywareblaster.html
X-RayPC Spyware Process Analyzer 1.001
http://www.x-raypc.com/

TO WATCH YOUR START UP PROGRAMS
MSCONFIG (not on W2k)
Use RUN and type MSCONFIG and then hit ENTER
Use these programs too
Startup Monitor
http://www.mlin.net/index.shtml
StartupRun v1.22
http://www.nirsoft.net/utils/strun.html

FREE FIREWALLS:

ZoneAlarm (one of the BEST, even for free)
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=staticcomp_za

Sygate Personal Firewall 5.x (never used myself but it is a good one)
http://smb.sygate.com/products/spf_standard.htm

AND MORE ONLIE FIREWALL TESTS
ShieldsUP!
https://www.grc.com/x/ne.dll?bh0bkyd2
LeakTest
http://www.grc.com/lt/leaktest.htm
Symantec Security Check
http://security.symantec.com/sscv6/home.asp?langid=ie&venid=sym&plfid=23&pkj=QQWRORVWHFHMFNZMBBX

by snooper365

Hi eraser3498,
Removing spy-ware can be a pain. I pinpointed two links that I think will resolve both your issues.

Comet removal: http://securityresponse.symantec.com/avcenter/venc/data/spyware.cometcursor.html

Cool Web Search removal: http://8help.osu.edu/1759.html

I want to piggy back off of some earlier recommendations and remind you to determine what site it was that you visited and stay away from it. The Symantec link identifies all of the locations where Comet hang's out. This is a big advantage because you can manually go in and manually remove all of the bad stuff. Prior to doing so make MSN your default home page to rule out your custom home page as the problem site. Also, empty your cache and temp files. After removing the files and uninstalling the spy-ware do not forget to empty the recycle bin prior to restarting your computer and as mentioned by another respondent disconnect the Ethernet cable from the internet. This will prevent any hostile file that escaped removal from going out to the Internet for reinforcements. After starting up with no spy-ware detected you can then plug in and establish an internet connection. You might want to creates a restore point once you verify the spy-ware has been removed prior to proceeding in WinXP. I wish you luck.

Chris

This discussion is closed to new replies.