coolwwwsearch problems

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by locadelic, Jun 8, 2005.

  1. locadelic

    locadelic Private E-2

    Hi!
    I'm in desperate need of help as i'm having more than a few problems with my pc at the moment. It seems i somehow managed to get some form of spyware/malware called coolwwwsearch.

    I found a bunch of programs i've never seen before in my Add/Remove Programs, notably:

    Shopping Wizard
    Search Extender
    Downloader Pro v 1.5
    Home Search Assistent (yes, with an 'e')

    My IE (which i rarely use) was also getting hijacked with some 'about:blank' page which led me to a search engine i had never seen before. Luckily that is now gone, removed with the help of HJT and AboutBuster (both are the latest versions).

    I found Adaware and SpyBot SD were of no use whatsoever for this as the problems keep reappearing.

    My computer is currently running Win2k SP4.

    Let me know when i can post my HJT log so that someone can take a look at it. Thanks :(

     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Before we get to a HijackThis log we require that standard cleanup procedures be followed. Make sure you observe the sections related to about:blank and HSA (aka "Only the Best) hijackers. Please follow the steps below:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
  3. locadelic

    locadelic Private E-2

    Hey!

    Thanks for the reply. I managed to sort it out though luckily :) I ran HJT in safe mode, used AboutBuster, SpyBot SD, and cleaned out a few of my registry entries, rebooted a couple times and it still hasn't reappeared. My HJT logs are normal so i think it's safe to assume that this infection is gone.

    Thanks for the reply though :)
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    True full blown HSA hijackers can be rather nasty to remove and can respawn themselves. You really should complete the steps and post you HJT log so we can make sure you go all of it.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds