SpyBlaster putting CoolWebSearch in registry

First let me say that I am NOT by any means an expert with spyware or adware...

I have the following on my computer, and all are current versions:
CWShredder
SpyBlaster
AdAware
Spybot S&D
Hijack This
Spyware Guard
Spyware Nuker 2004
Spyware BeGone

I have two problems with SpyBlaster:
1) Whenver I open SpyBlaster there is one item with protection disabled. The XXX Toolbar is continually unchecked (somehow).
2) Whenever I select "Enable All Protection" then a CoolWebSearch is placed into my registry. This is ONLY detected by Spyware Nuker 2004. None of the other software is finding it.

I even booted into safe mode and ran each program but still Spyware Nuker was the ONLY one that detected the CoolWebSearch in the registry.

After going through this Forum and reading the posts, I think I may have a solution to the XXX Toolbar problem. Although, the fix was a little complicated for my level of knowledge but I suppose I will just have to walk myself through it. Will the XXX Toolbar fix also resolve the CoolWebSearch in registry problem?

Does anyone have fixes for these problems?

And finally, is fixing SpywareBlaster really worth the effort? Is the software worth the headache? Is there better software available that will provide better protection and not require fixing? Any advice is welcomed!

Karen

 

First of all, SB is, without doubt, worth the effort. But what you should understand is that SB is designed to stop Spyware / Malware from getting onto your machine in the first place. It does not remove anything if already there. Also, some existing spyware (depending on exactly what it is) can and does subsequently interfere with the installation and running of anti-virus and anti spyware products.

So, the first thing you need to do is get rid of what you have already. There are a number of scanners available, many of then free, but my recommendation would be to use one of the best known and, in my experience, most effective: Lavasoft AdAware downloadable here:

http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

Install AdAware, use the on-line update to ensure you have the latest 'Reference File' and run what they call an in depth scan. It's basically easy to use and should show you a resulting list of the nasties on your machine. You can then choose to remove the lot if you wish (and you probably should). AdAware quarantines what it removes so you can go back later if you find that you've removed something you didn't want to - but, to be honest, I think it unlikely with AdAware.

Then, and only only then, install Spyware Blaster, use the one line update and 'Enable all Protection'. See how you go from there - hopefully, you'll be clean and protected!!

Couple of important things more:

AdAware, in it's basic, freeware form, scans & removes but does NOT then protect - that's Spyware Blaster's job, ok?

When you've run AdAware and 'cleaned up', run it again to check, then re-boot and run it again to check!! These things have a habit of resurrecting themselves sometimes - there's some clever sons of ******* out there...

Good luck...

Jem

 

Hi Morphosis

SpywareNuker is a ripoff of SpyBot S&D. This is a well known fact. It is actually spyware itself, info here,

http://www.spywareeliminator.com/forum/index.php?showtopic=683&st=0&#entry2214

I would recommend uninstalling it.


snowbound

 

Re: Snowbound...

Thank you for letting me know! I wonder why it is the only spyware detector that I am using that is able to detect the SpyBlaster associated CoolWebSearch in the registry? SpyBot S&D didn't detect it, nor any of the others that I listed in my orignal post.

Thanks.

 

"2) Whenever I select "Enable All Protection" then a CoolWebSearch is placed into my registry. This is ONLY detected by Spyware Nuker 2004. None of the other software is finding it."

Hey Morphosis\Karen,

What Spywarenuker is falsely detecting is one of the many entries\sites SpywareBlaster places in the Restricted Zone. There are other programs that falsely detect similar entries....Spysweeper being one. Since the problem is not with SpywareBlaster....I suggest you consider re-evaluating the use of Spynuker....if for no other reason than the one Snowbound gave.

Also....concerning the XXXToolbar question....I do not see Pestpatrol in your list of installed software but I'll ask anyway. Do you use Pest Patrol ?

Edit: Overlooked an item.

The reason being there is nothing to detect because it also places various CoolWebSearch URL's in the registry\IE's Restricted Zone via it's Immunization feature.

 

Re: Jem

Jem,

Thanks for taking the time to respond to my questions! Its because of those "cleaver sons of ******* out there" that I am going back to college to change careers. I have worked in networking (enterprise) for 15 years and I can't keep up with the security issues. I've never liked the software side of the job anyway... so now I'm studying Biology!!!

Thank goodness there are so many clever do-gooders to help fight off the clever do-badders!

 

Oh! I think I get it now. Thanks so much! So I won't worry about that registry entry - but just to confirm, it shows up in SpywareNuke as being located in the: HKCU.../Internet Settings/zonemap/domains/xxxtoolbar.com
Is that the false positive?

No, I do not have Pestpatrol installed. I had read in the forums that it was causing problems with SpyBlaster and I can only handle one thing at a time!
It sounds like the same problem that I am having with SpywareNuker. (Now that you have explained it to me.)

Removing SpywareNuker today...

 

Yes....that is the false positive. The location you gave....HKCU.../Internet Settings/zonemap/domains....is where the Trusted AND Restricted Zone URL's are placed.