• Welcome to Poasters Computer Forums.
 

News:

Welcome to the ARCHIVED Poasters Computer Forums (Read Only)

Main Menu

"Cool Web Search" Browser Hijacker

Started by Whizbang, January 11, 2004, 19:10 hrs

Previous topic - Next topic

Whizbang

This is an annoying program that takes over your web searches and injects its own info into the search.  Once you see the request to install this piece of trash, it is too late.  If you click "NO," it will simply loom in the shadows and wait for another opportunity to invade.  Technically it is not a virus; but it really is a pest, and there are an increasing number of variants.

I first encountered this critter several weeks ago as I was minding my own business and just looking up some computer hardware, when I saw this script popup that said, "Do you want to install "Cool Web Search Engine?"  I said, "NO."  Then it retorted, "Are you sure?  We advise you to install it."  I still clicked "NO."  It did not matter.  The program had already been installed and was simply waiting for another chance to raise its ugly head, which it did.  In the meantime, I looked for it in the program installation list and could not find it.  The next time, I said "Yes," when asked if I wanted to install the program and was able with the help of AVG antivirus and a checkoff list in MSCONFIG to locate it and remove it.  The problem is that it is very subtle.  Check with your antivirus site on this malware to see if they list a fix for it.  It is so pervasive that Computer Cops even lists a program called CWshredder that you can download just to remove this pest.

Before you resort to the drastic action of clicking "Yes", run PC-Cillin House Call from this forum page.  If that does not reveal anything, do a complete resident antivirus virus scan of system.

I finally was able to remove it, but only after clicking "Yes" to installing it.  Both AVG and House Call identified it.  AVG apparently had identified and deactivated it and House Call found the remaining traces of it.

Cwshredder program is supposed to remove it, but if you get this pest, take the obvious path of antivirus searches first to see if something else is present.

A quick Google search of Cool Web Search will reveal how active this pest is.  Apparently the ftp address piggy-backs on a URL search of infected sites.  

Neon

#1
This thread may provide some additional info:

http://www.poasters.com/index.php?topic=7234


Link edited by Mark H
Area 64 project|Asus SK8N|nForce3 Pro 150 chipset|AMD Athlon 64 FX-51|2x 512MB Kingston HyperX PC3200R|eVGA GeForce 6800GT|WD Caviar SE 1200JD SATA|Plextor PX-708A 8x DVD+R|Plextor PX-116A 16x DVD-ROM|Lian Li PC-60H1S|Antec TruePower 430W ATX|WinXP x64 edition