Holds hand up as not being the most computer literate on here, but it appears I have been infected with somethign called a CoolWebSearch cookie, which has embedded itself in my RegKey and RegValue somehow. I have tried Webroot and AdAware which both say they have removed it but then it is still there. It is just trackin where I am going (so no nippin off to juicy boobs.com then!!! ;) ) but also resets my homepage.

 

I have run a hijack this log if its any use.

 

Anyone had this before? Any advise from you computer specialists as to whats best to compeltely remove it with??

 

TIA

 

Nick

Quick look on google and it tells me your syptoms could be caused by a nbumber of browser hijackers.

 

Have you updated your adaware reference file?

 

if so and no luck, try:

 

 

http://www.safer-networking.org/index.php?page=download

 

try spy bot - bit more advanced that adaware.

Yup, first thing I did was update the ref file.

 

Just downloaded a CWS Shredder, but will try your link. If not then might have to purchase Norton and see if ti will locate and remove the booldy thing when I install it.

 

Thanks for the advise.

 

Nick

Holds hand up as not being the most computer literate on here, but it appears I have been infected with somethign called a CoolWebSearch cookie, which has embedded itself in my RegKey and RegValue somehow. I have tried Webroot and AdAware which both say they have removed it but then it is still there. It is just trackin where I am going (so no nippin off to juicy boobs.com then!!! ;) ) but also resets my homepage.

 

I have run a hijack this log if its any use.

 

Anyone had this before? Any advise from you computer specialists as to whats best to compeltely remove it with??

 

TIA

 

Nick

 

 

 

http://www.webroot.com

 

Get spysweeper, it will get rid of all spyware cookies and spyware programs, trojan cookies too, and will clean out the registry of spyware entries.

I have already tried that. It says it removes it then it, then when I log back on to the internet the same problems are in place. Log of and re run the spysweeper and it finds the same files.

 

I am just downloading the Spybots ver 1,3 which I will log off and try in a mo.

 

Thanks for the advice.

 

Nick

If you have IE open while its removing the files then it may well not be able to gain access to delete - make sure you have all running IE windows closed - in fact go to task manager and ensure there's no instances of iexplore.exe then run it :)

Oh, and you might just be getting re-infected... - have you run windows update recently?

Andy, everythings closed down as best I can, not aware of anythign else running whilst I am scanning and am defo logged off the net whislt doing it.

 

Hi5, next on my list of updates!!!

 

I have run CWS Shredder which corrected something, then rerun Adaware which removed another cookie, then ran Spy Sweeper which didnt detect anything. have logged on and my settigns are correct. Fingers crossed I might be getting somewhere.

 

Cheers fellas

 

Nick

Sounds like you ahve something installed which is in contact with the site all the time. You have Kazaa by any chance/

Yep, I had this last month.

 

does your homepage always default to 'blank'

 

If so this is how it's hijacking IE because your always get

reinfected by going back to there website.

 

I got around this hijacking by looking in the registery

under Microsoft and Internet Explorer and you will see

some settings with something Like

 

%1%1%3%4%

 

and just blanking them out

Oh, and you might get an error on rebooting

like

 

ctrplan.dll error while loading.

 

If so, as mentioned above cwshredder should get rid of this

other web browsers have an option which prevents the home page from being hijacked by malicious web sites. as far as i know IE doesn't do this. i use MyIE2 - it's the d0gs b0110cks :bow:

Thought Id got this sussed. Got rid of the CoolWebSearch thing but now spybot has pulled up some DSO Exploits (whatever they are!) I remove them using Spybot, reboot, scan again and there they are!! I am not even goingon the net some not getting em back from there. All I can assume is that Spybot cannot delete them correctly. Incidently, neither CWShredder, Ad-aware or Webroot Spy Sweeper finds these expolit things.

 

Yes my homepage was defaulting to about:blank, but thats stopped now, in fact it stopped after I ran the shredder.

 

Have attached a screen capture so if anyone can shed some light on it then please step forward now!!

 

Incidentally, I havent got a clue how to edit the registry!!

 

Thanks

 

Nick

If everything is running Ok now, and working as before

you might be just getting a bit paranoid

(SPYBOT maybe picking something up quite harmless).

 

Oh by the way ditch Internet Explorer

and use Mozilla FireFox.

Stuart

Whats Kazaa?

 

Jamiee

Whats the Mozilla thing then? Where do I obtain it? And whats the cost? (and didnt our parents used to fry chips with it???)

Never liked IE anyway!!

 

I have read on greymagic thats theres a security breach in IE that allows websites to execute code without you knowing. But as I am not logged on and the Spybot keeps finding this then I am somewhat confused.

 

Off to download the latest microsoft XP updates.

 

Nick

Here's the link for the Firefox Web Browser Download Web Page

 

http://www.mozilla.org/products/firefox/

 

Just Download it, it's Free. ;)

 

And it stops annoying pop ups.

Nice one.

Thanks.