Cool WebSearch is winning Trojan war

[Tyson Pearcey]

Tweet

Hello all,

This article is a month old and may have been posted already so I apologies in advance if it has. I felt that this would be of interest to all of you.

http://www.theregister.co.uk/2004/06/29/cws_shredder/

All the best

[Tyson Pearcey]

This is also the one that has disabled my personal (play) PC.

[Dynamoo]

CoolWebSearch is evil. I have a machine in my Real Life Work that I've run CWShredder, AdAware and Spybot S&D on and I can't get rid of 100% of the components.

This particular CWS variant, like a lot of others will continually download new applications and crapware onto the infected PC, and also has strong self-repairing functions.

Normally when a machine gets infected this badly with this sort of crap it ends up getting nuked and rebuilt, but in this case it's not an option.

Evil software, really evil.

[spatny]

Hi,

I had some success with removal of this today.

Not the best technical method, but it did work.

1) update your norton or anti virus to the latest definitions, and have Ad-adware and spybot installed.
2) shut computer down remove available internet connection from PC
3) Restart PC in safe mode (F8) and use Ad-adware and spybot to remove adware etc.
4) run antivirus software with adware detection enabled. It will find a further 4 files, in particular iewt32.dll and sdkzm.exe. Delete these files. Empty recycle bin.
5 check host file and remove junk. Also remove cookies and temp internet files from the internet control panel.
6. Now configure your firewall to block incoming and outgoing connection to 209.66.114.129 ( I did the range 209.66.114.00 to 209.66.114.254)
I saw this earlier -
http://www.webhelper4u.com/CWS/cwseasterneurope.html

My customer had a Netgear router, and the firewall is easy to configure. I also blocked the keyword "coolwebsearch"
7. Restart the PC in normal mode, and so far (4 hours) coolwebsearch has not come back

Spatny

[Tyson Pearcey]

http://www.mozilla.org

Truly fantastic!!!! I've recently swapped over to the Mozilla browser and it kills CoolWebSearch.

Also have say to love the functionality! If you haven't tried Mozilla, get it and give the tires a kick on this one! I was really sceptical but have to say.... I'm sold!

Tyson

PS no I do not have any ties with Mozilla at all.

[Matthew Wood]

Also a thumbs down for Findwhat for allowing their paid results to be on such evil software. Though they are not alone as Overture partners with Claria (searchscout) amongst others..

[getvisible]

alone as Overture partners with Claria (searchscout) amongst others..

and Espot for their UK results I understand.

[chrisk999]

It's clever software - I noticed it on my computer yesterday, and I consider myself to be very cautious about anything that might download spyware onto my computer. Bizarre how it managed to install itself - could have sworn I never authorised it...

Lots of realmedia ads popping up all over the shop...