HELP ! - anybody - virus problem

  • Thread starter Thread starter EJN
  • Start date Start date
I hate to play devils advocate here, but I know you're thinking
what I'm thinking. This viri has taken residence in your master
boot record. Despite your refusal to fdisk you may have no choice.

I lost some of my most favorite portrait shots once, not because I
didn't take steps to protect them (nothing, and I mean nothing goes
on my C: drive that is of much importance. All my pics are on a
totally seperate hard drive) but because I accidently fdisked the
wrong drive (oops!).

Live and learn. Never put all your eggs in one
basket.....partition, partition, partition (makes defragging a
whole lot faster too). Ideally, install a second hd and dedicate it
to those files that are irreplacable.
I do the same in a way. Being a laptop user, this one , although brand new update only has a 60Gig HD but I use an external LACIE 40Gig and ALL pics and new apps d/loaded go to that...so they're seperate and hopefully safe,. The prob is that on a re-install you've no "installed" progs in the 'new' fresh computer ...so everything surely has to be re-installed...and finding it all ...serials etc etc as well as progs...even though the bulk is on an extenal...it isn't that easy. You should see my desktop...and ALL in regular use...the thought of setting that up again frightens me as much as the hassle of cleaning it all !!

EJN
 
Yes, by sheer chance I put Ad-Aware on just about two hours BEFORE the event !! but it's NOT solved the problem...nor have about 6 others I've tried so far. Trouble is, it's becoming increasingly clear that this Cool Web is NOT a Trojan/Virus but 'Scumware' so is not recognised as such...apart from the fact that apparently it changes itself all the time.

I'm REALLY grateful to all who are trying with suggestions...nothing has worked so far..just about to try the next ...wish me luck !!

EJN
http://www.lavasoftusa.com/software/adaware/

it seems to deal with this cool web search thing...

http://www.lavasoftsupport.com/index.php?showtopic=28801&hl=cool+web+search
http://www.lavasoftsupport.com/index.php?showtopic=29044&hl=cool+web+search

here's another faq on it i found that might help.

http://www.scumware.com/apps/scumware.php/action::view_article/article_id::1075329940/topic::Scumware,-Spyware,-Adware-&-Malware-Applications/

anyway, hope some fo this stuff will help you to get rid of it.

somy
Well, guys, if nobody can come up with a solution I really think
this might be the last you hear from me - really ...
About 22 hours ago I foolishly logged onto what I knew was maybe a
dodgy site and in less than 1/2 hour I'd got 7 viruses.
Fortunately, most were of a nature that I sorted them out but right
now I'm plagued incessantly witrh this blasted 'Cool Web Search'
thing ...and CANNOT find a way to rid it - just changes my Home
Page EVERY time , even though I've done all in my power to stop it.
Had for years on my machines - AVG (excellent overall) - Triojan
Remover and Pest Patrol. Funnily , just a few hours before this
episode I d/loaded and setup Ad-Aware6. It found one or two things
but has done NOTHING to sort out the Cool Web Search thing. Got
'HiJackThis' which is a superb thing...it shows immediately the
entries giving this Cool Web page but although I clear them they
just auto return instantly. Got a super prog called CWShredder -
that found at first the 'AboutBlank' entry that had been popped in
, but within the last hour or two I've clearly done something and
CWShredder now tells me I've got a clean machine...which I haven't
of course.
Did NOT have before, Spybot, so d/loaded that this morning. It
found a few things but again done NOTHING to shift Cool Web ...and
in spite of numerous searches in Google , plenty of ideas on
shifting it but none work,.
This is on a two-month old new P4 3Gig laptop, on XP, my latest
pride and joy and have been piling tons of progs on it that I want
to use - NO WAY am I going to re-install to scratch and have to
start over again. Don't really know how to start and I don't know
where I'd find half the progs, keys etc to do that without a month
or more searches.
Frankly I'm just about fed up..spent 22 hours now trying to sort it
, apart from 6 hours restless night, and getting nowhere
I'd rather just give up the Internet if THIS is going to persist -
anyway, I believe that it can in fact open the door to allow
anything in ...so how on earth do I shift it after trying all this ?
Unlocked SysRestore just in case something was in there, nothing,
so I've now lost all my Restores too !!! and still no better off.
No problems in going into the Register but again, try as I may I
cannot find any clue as to WHERE is the kick-off...well, I DO find
the entry in 'Exolorer-Main' key , but that's obviously not where
it's triggered..as I change that but iyt just comes back.
It's thanks or gooodbye mates - I've about had it !

--
EJN
--
EJN
 
There was a thread here with a similar problem awhile back and one of the links had the solution. It was a file in system directory and not a virus. I remember that part, but can't find a link to it. So you might search this forum. Also search for things like changed start pages at the help sites. PCmag did a whole issue on where to get help so it has some webpage listings on that.

After you get it fixed, n Spybot you can turn on the ability to block home page changes. Also this program does it
http://www.snapfiles.com/get/startpageguard.html

--
Stinson
C-750, D-40, B-300, Nikon 4T macro, PS CS
http://www.StinsonsTerra.StinsonsC750Gallery.PhotoShare.co.nz
http://www.photosig.com/go/users/view?id=64739

 
I concur with Stinson and other advice for the merijn source to rid you of the Cool Web Search scourge. And nope, Ad-Aware and Spybot don't touch it. I had this in April and Googled on my own until I found the merijn solution. It's been running like a charm since -- and Ad-Aware is back to doing its thang...

Cool Web Search hijacks your browser -- replacing your Links bar with its own links, changing your homepage, and opening a darned-hard-to-close window of more links (nothing seemingly rude, but sourcing it's version of a myriad of web services; eg, hosting, search, shop, gambling).

I still don't know how it got in my machine!
 
I'm surprised none of the usual steps has worked so far, but the first step I would have taken beyond what you've already done is to Google on the beast itself. I fed in:
"cool web search" virus

in the search line, and got a bunch of hits. This one looks promising as it provides a link to a "CoolWebShredder" program designed to remove the thing.

http://www.scumware.com/apps/scumware.php/action::view_article/article_id::1075329940/topic::Scumware,-Spyware,-Adware-&-Malware-Applications/

I can't speak to how good/bad/indifferent this proposed "cure" is. I just stumbled across it in 2 minutes of searching. Use at your own risk.

Here's a link to my Google search results:

http://www.google.com/search?hl=en&ie=UTF-8&q=%22cool+web+search%22+virus&btnG=Google+Search

Good luck!!
Well, guys, if nobody can come up with a solution I really think
this might be the last you hear from me - really ...
About 22 hours ago I foolishly logged onto what I knew was maybe a
dodgy site and in less than 1/2 hour I'd got 7 viruses.
Fortunately, most were of a nature that I sorted them out but right
now I'm plagued incessantly witrh this blasted 'Cool Web Search'
thing ...and CANNOT find a way to rid it - just changes my Home
Page EVERY time , even though I've done all in my power to stop it.
Had for years on my machines - AVG (excellent overall) - Triojan
Remover and Pest Patrol. Funnily , just a few hours before this
episode I d/loaded and setup Ad-Aware6. It found one or two things
but has done NOTHING to sort out the Cool Web Search thing. Got
'HiJackThis' which is a superb thing...it shows immediately the
entries giving this Cool Web page but although I clear them they
just auto return instantly. Got a super prog called CWShredder -
that found at first the 'AboutBlank' entry that had been popped in
, but within the last hour or two I've clearly done something and
CWShredder now tells me I've got a clean machine...which I haven't
of course.
Did NOT have before, Spybot, so d/loaded that this morning. It
found a few things but again done NOTHING to shift Cool Web ...and
in spite of numerous searches in Google , plenty of ideas on
shifting it but none work,.
This is on a two-month old new P4 3Gig laptop, on XP, my latest
pride and joy and have been piling tons of progs on it that I want
to use - NO WAY am I going to re-install to scratch and have to
start over again. Don't really know how to start and I don't know
where I'd find half the progs, keys etc to do that without a month
or more searches.
Frankly I'm just about fed up..spent 22 hours now trying to sort it
, apart from 6 hours restless night, and getting nowhere
I'd rather just give up the Internet if THIS is going to persist -
anyway, I believe that it can in fact open the door to allow
anything in ...so how on earth do I shift it after trying all this ?
Unlocked SysRestore just in case something was in there, nothing,
so I've now lost all my Restores too !!! and still no better off.
No problems in going into the Register but again, try as I may I
cannot find any clue as to WHERE is the kick-off...well, I DO find
the entry in 'Exolorer-Main' key , but that's obviously not where
it's triggered..as I change that but iyt just comes back.
It's thanks or gooodbye mates - I've about had it !

--
EJN
 
It should not be too difficult to remove!
Let me know where you are up to at this point!

--
Old Ashtonian
http://www.tameside.gov.uk/corpgen/webcam.htm
Thanks - I have quite a few good progs on already and from this post I've been given one or two other that have proved very good - but one exceptionally ...Spy Killer .. which I installed, did a Scan, and it was the ONLY one that recognised and included CWWSearch in the 'baddies' - so at the end I deleted that along with a couple of other Adware things it found. Did not cure entirely but at least it did SOMETHING. Left overnight and Scanned again just now with SpyKiller - AGAIN it found CWW and it was in two 'restore' files - so those were deleted also.

Up to this pioint, SpyKiller apparently monitors and it repeatedly came up with 'your Home Page has been changed - do you want this' so I said 'No' regularly ...after about 5 of this and the latest Scan ...so far it is NOT reporting any attempt to change.

Too early to say it's cured...MUCH too early I guess..but at least it's doing SOMETHING.

Only trouble with the free prog is that if you don't do an update immediately after install you don't seem to get chance again. I DID it so I AM update...so far..but it seems that for such as this it really does need regular updates. AVG Free which I use and find VERY good is great..but it seems that many excellent and expensive progs still do not recognise this Scumware...it is neither Trojan nor Virus...so Spy Killer really does seem a good one.

Fingers tightly crossed but I feel I just shall not trust it for a LONG time, as it's impossible to pin it down

Could maybe that one reason SpyKiller is reporting (has been) this Home page change is that I found the keys in the Register which clearly showed the 'dirty one' (keys as 'Home', 'Start' and 'Local' page etc) and restricted Permissions ON THOSE KEYS to Deny the System to Delete (after changing them to Google of course) . Was tryig ANYTHING ...

EJN
 
There was a thread here with a similar problem awhile back and one
of the links had the solution. It was a file in system directory
and not a virus. I remember that part, but can't find a link to
it. So you might search this forum. Also search for things like
changed start pages at the help sites. PCmag did a whole issue on
where to get help so it has some webpage listings on that.

After you get it fixed, n Spybot you can turn on the ability to
block home page changes. Also this program does it
http://www.snapfiles.com/get/startpageguard.html

--
Stinson
C-750, D-40, B-300, Nikon 4T macro, PS CS
http://www.StinsonsTerra.StinsonsC750Gallery.PhotoShare.co.nz
http://www.photosig.com/go/users/view?id=64739

Oddly enough I've already got on what is supposed to be a good tweak prog and it includes Lock Home Page which of course I ticked. Fat lot of good that's done - makes you wonder if these progs are better off !

I've just d/l the one you gave - seems decent enough as it IS for thepurpose. If all else fails, anything to try ...

--
EJN
 
Cool Web Search hijacks your browser -- replacing your Links bar
with its own links, changing your homepage, and opening a
darned-hard-to-close window of more links (nothing seemingly rude,
but sourcing it's version of a myriad of web services; eg, hosting,
search, shop, gambling).

I still don't know how it got in my machine!
Been using HiJack and CWShredder for some months since daughter had trouble and very good they are - but it didn't do ANYTHING for this with me. HiJack clearly showed the duff site links for the dirty Home page etc and as fast as I fixed them,. closed, re-opened and it was there again. NEVER has worked although NOW I get CWShredder telling me I've got a clean machine...which I then hadn't !!! Lost faith a bit, although I recognise the goodness ..
--
EJN
 
I'm surprised none of the usual steps has worked so far, but the
first step I would have taken beyond what you've already done is to
Google on the beast itself. I fed in:
"cool web search" virus
in the search line, and got a bunch of hits. This one looks
promising as it provides a link to a "CoolWebShredder" program
designed to remove the thing.

http://www.scumware.com/apps/scumware.php/action::view_article/article_id::1075329940/topic::Scumware,-Spyware,-Adware-&-Malware-Applications/

I can't speak to how good/bad/indifferent this proposed "cure" is.
I just stumbled across it in 2 minutes of searching. Use at your
own risk.

Here's a link to my Google search results:

http://www.google.com/search?hl=en&ie=UTF-8&q=%22cool+web+search%22+virus&btnG=Google+Search

Good luck!!
Actually I'm sure I did find this, but looking at it again I don't think it actually gives you a d/l does it - just an explanation.

Anyway, read above and you'll see I've so far got results of a sort with SpyKiller...just biding my time but at least I've got SOMETHING working on it !! Trouble with this is that's it's a so-and-so to get any lead on , in the Register or Windows....nothing shouts out at you ...and I believe it changes anyway. Looks like the only (or best) cover is a permanent 'control' over changes, and SpyKiller seems to be doing this. It's already warned me of 5 changes this morning and I stopped it ..so far it's given up or gone to sleep !"!

EJN
 
I believe I also found the scumware link in my search. As you note it is mostly descriptive. A temporary work-around that got me through the crisis was using Alt-Ctrl-Del to open Task Manager and use that to close the offensive windows. Then I could more or less use IE to browse.

Please do what Francisco suggests. CWShredder worked for me immediately and totally when I had to use it at the end of April. http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder The prime action is the link at the line,"Normal form, will work for most people:" When clean I removed the CWShredder program just as easily.

My VirusScan took no issue with what I was doing as I used the merijn material. After I got rid of Cool Web Search all of my settings, links and favorites were intact. Sure, I had to line up the bars at the top of the screen again... You are closer to freedom than you think!

I've not jumped in to cause you grief. I'm a new poster to these forums but have been browsing forever. I'll unlock my email if that helps validate my 'actual' existence. There's a good thing going here.

Good luck, Bob
Actually I'm sure I did find this, but looking at it again I don't
think it actually gives you a d/l does it - just an explanation.
Anyway, read above and you'll see I've so far got results of a sort
with SpyKiller...just biding my time but at least I've got
SOMETHING working on it !! Trouble with this is that's it's a
so-and-so to get any lead on , in the Register or
Windows....nothing shouts out at you ...and I believe it changes
anyway. Looks like the only (or best) cover is a permanent
'control' over changes, and SpyKiller seems to be doing this. It's
already warned me of 5 changes this morning and I stopped it ..so
far it's given up or gone to sleep !"!

EJN
--
Bob
 
This thread has been going for 21 hours or more you could have re-installed that machine a half dozen times by now, including all your other apps. Especially considering you have all your docs and photo's backed up on the external LACIE...you have nothing to lose.

If you do actually manage to remove this virus will you really believe it has gone????? If your children use this laptop then that is even more of a reason to start again do you really want them redirecting off to some strange site?????

I would seriously consider FDSIK...etc and a fresh start, then buy a good personal firewall/anti-virus program, if you compare the cost of the firewall to the original investment in this laptop you will see it is minimal...sure there are plenty of free programs out there but you only get what you pay for IMO.

I'm sure almost all the members who have contributed to this post over the last 21 hours would be prepared to offer you advice re resurrecting your laptop from the death, if you have any concerns on that subject (I would certainly help).

Take this as it is intended, friendly advice.

Davew

--
'You'd be surprised how little I knew even up to yesterday.' (Jack Kerouac)
Dave White - dwit1 - C5060WZ
 
I'm surprised none of the usual steps has worked so far, but the
first step I would have taken beyond what you've already done is to
Google on the beast itself. I fed in:
"cool web search" virus
in the search line, and got a bunch of hits. This one looks
promising as it provides a link to a "CoolWebShredder" program
designed to remove the thing.

http://www.scumware.com/apps/scumware.php/action::view_article/article_id::1075329940/topic::Scumware,-Spyware,-Adware-&-Malware-Applications/

I can't speak to how good/bad/indifferent this proposed "cure" is.
I just stumbled across it in 2 minutes of searching. Use at your
own risk.

Here's a link to my Google search results:

http://www.google.com/search?hl=en&ie=UTF-8&q=%22cool+web+search%22+virus&btnG=Google+Search

Good luck!!
Actually I'm sure I did find this, but looking at it again I don't
think it actually gives you a d/l does it - just an explanation.
Anyway, read above and you'll see I've so far got results of a sort
with SpyKiller...just biding my time but at least I've got
SOMETHING working on it !! Trouble with this is that's it's a
so-and-so to get any lead on , in the Register or
Windows....nothing shouts out at you ...and I believe it changes
anyway. Looks like the only (or best) cover is a permanent
'control' over changes, and SpyKiller seems to be doing this. It's
already warned me of 5 changes this morning and I stopped it ..so
far it's given up or gone to sleep !"!

EJN
I just feel in utter despair asa I'm getting nowhere. Neither SpyKiller nor the StartGuard prog are holding the page and it STILL keeps coming up. As fast as I revert it, it goes back again it seems. I honestly just feel like this is the end..I wish I could see SOME improvement but NOTHING appears to change it from just going in to Web Search Start/Home page...in spite of theTHREE progs now that are supposed to lock it as YOU want.

EJN
 
Please do what Francisco suggests. CWShredder worked for me
immediately and totally when I had to use it at the end of April.
http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder
The prime action is the link at the line,"Normal form, will work
for most people:" When clean I removed the CWShredder program just
as easily.

My VirusScan took no issue with what I was doing as I used the
merijn material. After I got rid of Cool Web Search all of my
settings, links and favorites were intact. Sure, I had to line up
the bars at the top of the screen again... You are closer to
freedom than you think!


I've not jumped in to cause you grief. I'm a new poster to these
forums but have been browsing forever. I'll unlock my email if that
helps validate my 'actual' existence. There's a good thing going
here.

Good luck, Bob
Actually I'm sure I did find this, but looking at it again I don't
think it actually gives you a d/l does it - just an explanation.
Anyway, read above and you'll see I've so far got results of a sort
with SpyKiller...just biding my time but at least I've got
SOMETHING working on it !! Trouble with this is that's it's a
so-and-so to get any lead on , in the Register or
Windows....nothing shouts out at you ...and I believe it changes
anyway. Looks like the only (or best) cover is a permanent
'control' over changes, and SpyKiller seems to be doing this. It's
already warned me of 5 changes this morning and I stopped it ..so
far it's given up or gone to sleep !"!

EJN
--
Bob
Bob -

I do appreciate your time and thoughts but as I've already said in other posts I'm a great fan of CWShredder and it HAS worked but on other things..the 'AboutBlank' particularly...but it does NOTHING for me on this. Got the very latest ver 1.57 and it tells me I've got a clean system...I ask you ...why should I not be disheartened. EVERYTHING I try seems to do NOTHING
--
EJN
 
This thread has been going for 21 hours or more you could have
re-installed that machine a half dozen times by now, including all
your other apps. Especially considering you have all your docs and
photo's backed up on the external LACIE...you have nothing to lose.

If you do actually manage to remove this virus will you really
believe it has gone????? If your children use this laptop then that
is even more of a reason to start again do you really want them
redirecting off to some strange site?????

I would seriously consider FDSIK...etc and a fresh start, then buy
a good personal firewall/anti-virus program, if you compare the
cost of the firewall to the original investment in this laptop you
will see it is minimal...sure there are plenty of free programs out
there but you only get what you pay for IMO.

I'm sure almost all the members who have contributed to this post
over the last 21 hours would be prepared to offer you advice re
resurrecting your laptop from the death, if you have any concerns
on that subject (I would certainly help).

Take this as it is intended, friendly advice.

Davew

--
'You'd be surprised how little I knew even up to yesterday.' (Jack
Kerouac)
Dave White - dwit1 - C5060WZ
Dave - this story has more twists and turns !!!

I was about to come back to you but first made a 'Permissions' change on the Home Page entry in the Reg, just as a 'hope'. Switched off, then on again to log this afresh (not sure if Reg changes DO take place 'on the fly' ...however I got some sort of 'key' error message on restart (hopefully thinking because 'it' was trying to change what it was now denied (???) ...but on logging on, I clicked on Home and guess what - up comes Google !!

Still cannot believe it but daughter about to descend on us for a very short visit on way back home - so probably going to be'off' awhile, but if I may, I'll come back on and ask you about this reinstall. Tell you now - as usual here - all I've got is a bog-standard 'Recovery Disk' so it wuld go back to as it was Day 1 from the shop. Fat lot of good that is - don't you think ??? what about such as the Win Updates and Lord knows what else, apart from all progs..AND contents such as a multiplicity of PS Actions, Plug-ins etc etc etc etc !!!!! I really DO hate to think of it..

EJN
--
EJN
 
Eric if your last attempt han't resolved it then please feel free to email me, it's in my profile.

Davew
This thread has been going for 21 hours or more you could have
re-installed that machine a half dozen times by now, including all
your other apps. Especially considering you have all your docs and
photo's backed up on the external LACIE...you have nothing to lose.

If you do actually manage to remove this virus will you really
believe it has gone????? If your children use this laptop then that
is even more of a reason to start again do you really want them
redirecting off to some strange site?????

I would seriously consider FDSIK...etc and a fresh start, then buy
a good personal firewall/anti-virus program, if you compare the
cost of the firewall to the original investment in this laptop you
will see it is minimal...sure there are plenty of free programs out
there but you only get what you pay for IMO.

I'm sure almost all the members who have contributed to this post
over the last 21 hours would be prepared to offer you advice re
resurrecting your laptop from the death, if you have any concerns
on that subject (I would certainly help).

Take this as it is intended, friendly advice.

Davew

--
'You'd be surprised how little I knew even up to yesterday.' (Jack
Kerouac)
Dave White - dwit1 - C5060WZ
Dave - this story has more twists and turns !!!
I was about to come back to you but first made a 'Permissions'
change on the Home Page entry in the Reg, just as a 'hope'.
Switched off, then on again to log this afresh (not sure if Reg
changes DO take place 'on the fly' ...however I got some sort of
'key' error message on restart (hopefully thinking because 'it' was
trying to change what it was now denied (???) ...but on logging on,
I clicked on Home and guess what - up comes Google !!
Still cannot believe it but daughter about to descend on us for a
very short visit on way back home - so probably going to be'off'
awhile, but if I may, I'll come back on and ask you about this
reinstall. Tell you now - as usual here - all I've got is a
bog-standard 'Recovery Disk' so it wuld go back to as it was Day 1
from the shop. Fat lot of good that is - don't you think ??? what
about such as the Win Updates and Lord knows what else, apart from
all progs..AND contents such as a multiplicity of PS Actions,
Plug-ins etc etc etc etc !!!!! I really DO hate to think of it..

EJN
--
EJN
--
'You'd be surprised how little I knew even up to yesterday.' (Jack Kerouac)
Dave White - dwit1 - C5060WZ
 
I got the same trojan horse a month ago. Like you, I struggled with it all one weekend, found the executable finally, removed it, and then tried to repair the damage. It had locked up the tool bar in my browser and destroyed my Restore Point files so there was no way to go back. Finally, I called Dell support. They said that the only way they knew they could remove ALL the damage was a reformat of the hard drive. They walked me through it (took about a hour or more), and then I had to reinstall everything. That took a couple of weeks and I'm still not back to where I started.

I have installed and subscribed to SpySweeper 2.2. This has done a good job of stopping the spyware and snooper stuff. Norton AntiVirus watches my email. I am behind a firewall to stop hackers. Yea though I walk through the valley of death, I will fear no evil...... well, maybe. I now regularly do a full backup to an external SeaGate drive.

Good luck.

Tom
 

Keyboard shortcuts

Back
Top