SpywareBlaster doesn't find this...

Discussion in 'SpywareBlaster & Other Forum' started by NetBoot, Apr 20, 2004.

Thread Status:
Not open for further replies.
  1. NetBoot

    NetBoot Registered Member

    Joined:
    Apr 19, 2004
    Posts:
    9
    Everytime I go to Google.com I get this pest...

    CWS.GoogleMS.3

    Register entry:

    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com

    I don't use or install any BHO tools.

    I have it to always block xxxtoolbar.com in IE, but it keeps coming back...

    Anyone have any ideas on what to do with this?
     
    Last edited: Apr 20, 2004
    NetBoot, Apr 20, 2004
    #1
  2. fredvries

    fredvries Registered Member

    Joined:
    Jun 13, 2003
    Posts:
    62
    Location:
    Harlingen - The Netherlands
    It is a version of CoolWebSearch. Please download and run CoolWebShredder (from Merijn, the creator of HijackThis). Download available from www.merijn.org.
     
    fredvries, Apr 20, 2004
    #2
  3. NetBoot

    NetBoot Registered Member

    Joined:
    Apr 19, 2004
    Posts:
    9
    Thank you!

    I can't get to that site, unavailable...

    Nevermind I found it...


    Thanks again...
     
    Last edited: Apr 20, 2004
    NetBoot, Apr 20, 2004
    #3
  4. NetBoot

    NetBoot Registered Member

    Joined:
    Apr 19, 2004
    Posts:
    9
    The latest version of CoolWebShredder doesn't search for CWS.GoogleMS.3

    Comes up clean
     
    NetBoot, Apr 20, 2004
    #4
  5. NetBoot

    NetBoot Registered Member

    Joined:
    Apr 19, 2004
    Posts:
    9
    SpywareBlaster was a little so picking up the custom block for xxxtoolbar.com...

    It's now added for protection. Seems to be stopping this. Will let you know if it comes back.
     
    NetBoot, Apr 20, 2004
    #5
  6. NetBoot

    NetBoot Registered Member

    Joined:
    Apr 19, 2004
    Posts:
    9
    Any chance of adding:

    CoolWebSearch(XXX) Site: xxxtoolbar.com

    Thanks

    Spoke to soon, it's back again. Crap...
     
    Last edited: Apr 20, 2004
    NetBoot, Apr 20, 2004
    #6
  7. lavallie

    lavallie Guest

    I have the same thing happening. I've got Pest Patrol, Spy Bot, Adaware, CSWShredder and Spyware Blaster. Some find it, some attempt to block it, but once i reboot, bingo it is back.
     
    lavallie, May 4, 2004
    #7
  8. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    I would suggest you go over here and follow the instructions in that section of our forums. If you've already ran Spybot S&D and/or Ad-aware, you can skip to step 2.
     
    Detox, May 4, 2004
    #8
  9. ragnar

    ragnar Registered Member

    Joined:
    May 5, 2004
    Posts:
    1
    Greetings Netboot,
    i too have got this horrible problem with GoogleMs3 and also have problems with offshorclicks.com and teensguru.com and xxxtoolbar.com. Just like you my other software/ antispyware apart from ALURIA(these above) and Pest PATROL do not even pick it up.SpywareBlaster is unticked for these 3 sites on a periodic basis and i have tried some manual ways to remove it by editing the registry but to no avail.The trouble is i dont know what to look for.If i delete these (above)entries they just come back.
    Im sure i read somehwhere about userinit.exe being one of the culprits and i have managed to find where it is hiding but dont know if its safe to delete it.
    Its location is:HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\WINDOWS NT\CURRENT VERSION\WINLOGON\USERINIT.EXE
    which equals :C\WINDOWS\SYSTEM32\usernit.exe.
    Please let me know if you hav enay other info or find a cure.
    Best wishes, Ragnar.
     
    ragnar, May 5, 2004
    #9
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...