My spyware program, BPS finds coolwebsearch which I delete. I then run CWShredder and it says my computer is clean. However, I run regedit "find" coolwebsearch and it finds it in the registry along with another two dozen entries with the first word "cool". I manually delete each one. The next day. if I run BPS spyware it finds it again and I start all over. HOw is "Coolwebsearch" getting into my machine? Is there any way I can stop it from getting in?
Hi auggief, First of all I am going to move your thread to the privacy problems forum where it will get the proper attention. Secondly, I would seriously consider trashing BPS as it is considered a rogue anti-spyware product and is known for its false positives amongst other things. For more info, see HERE. I would run either or both of the following and see what these scans come up with. Both programs are free. Spybot Search&Destroy SpybotS&D Setup Tutorial. Ad-Aware Ad-Aware Setup Tutorial. Before scanning with either Ad-Aware or Spybot S&D, remember to bring them up-to-date first. Then post back and let us know your status.
You'll need spysubtract. CWShredder was sold to these ppl (AFAICT) and they're responsible for updating it. coolwebsearch ppl are updating daily, and CWshredder needed such a massive effort that the author found less and less time for his own stuff.
Puff, I use Spybot and Adaware and they don't find Coolwebsearch. I have to ask. If it is a false positive from BPS, why when I do regedit do I find several entries starting with "cool" including coolwebsearch.com etc. I manually delete then all from the registry, but somehow when I run BPS the next day, it finds coolwebsearch again and I run CWShedder which says computer is clean. However, I go into regedit and the "cool" entres are there again. I don't go into porno sights or anything that could cause Coolwebsearch to get into my machine. I put coolwebsearch.com in my Norton Firewall restricted sites, but that didn't stop it.
Hi auggief, Do you any programs like SpywareBlaster or IE-SpyAds, or had you previously used the immunize function of SpyBot? It also would help if you would post exactly what BPS is finding and any reg keys that you are finding also.
I installed Spysubtract(trial) and scanned. It found 11 itmes in the registry which I deleted. I think I should have put them in blacklist before I deleted and will if they come up the next time I run Spycontract.
Puff-M-D, I use Spywareblaster, Spywareguard, BPS, Adaware and Spybot and I immunize on Spybot. Next time BPS finds someting I will post here. As I recall it says something like Hijack attempt and lists coolwebsearch. It also listed a toolbar but I determined that it was the Google Toolbar and put it into ignore. What has been real confusing to me is that after I delete coolwebsearch, using BPS, I run CW Shredder and it says I am clean. However when I go into the registry and"find" coolwebsearch, it finds about 20 items starting with the word cool, which I delete. Hopefull having just used Spysubtract for the first time and finding 11(new) registry items which I deleted, the problem will stop. Next time I run BPS, I will advise you what it finds. Many thanks.
One reason I asked you about the programs was that SpywareBlaster puts 25 to 30 reg keys for CWS into your registry as does both SpyBot and IE-SpyAd. A lot of scanners will pick these up and they are false positives. THIS THREAD will give you some more info. This could be the cause for reg keys reappearing....
Puff, I just ran BPS again. This time I didn't not get coolwebsearch but got: 1.Spy Registry Key Persistent Handler aspfile\persistenthandler 2.Spy Registry Key Possible Browser Hijack Attempt H-key-currnet user/software/microsoft/windows/currentversion/internetsettings/zonemap/domains/pluginaccess.com. I went into the registry and deleted item 2. Sorry. I couldn't get BPS to let me copy and paste.
Puff, if I understand correctly those "cool" items in the registry were put there by SpywareBlaster and Ie-Spyad and are harmless and don't need to be manually deleted Next time I run BPS and it comes up with coolwebsearch, I will report to you.
That is the probable reason. This one was put there by SpywareBlaster also. Run SpywareBlaster and see if it tells you you have unprotected items. You probably have several unprotected CWS items and one for pluginaccess also.
Puff-M-D, you were right. Spyblaster had plug in access and several coolweb search items in red which wereunchecked in restricted. I checked all to be protected. Thanks for staying with me to solve this problem. Hopefully spyblaster will now keep me from getting cooweb search and plugin access.
I installed Spysubtract on 30 day trial. A screen comes up to update, but when I say ok, it says I am not connected to the internet. I am on cable and always connected. Why won't it let me update?
I sent email to company and was told to run this link to update. http://www.intermute.com/support/spydatupd.exe
Puff-M-D, this is my log since using Spysubtract. The last scan on Nov 25th came up with coolwebesearch as some I haven't seen before. Maybe the update had something to do with it. --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 05:14:36 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 05:15:44 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 05:16:09 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Programs in Memory Finished Scanning Started Scanning Internet Cookies Programs in Memory Windows Registry Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\my-internet.info' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com' Internet URL Shortcuts Files and Directories Finished Scanning Started Backup Finished Backup Started Cleaning Finished Cleaning Extracting file 'C:\DOCUME~1\Computer\LOCALS~1\Temp\session.ini' (1999 bytes). Started Scanning Internet Cookies Programs in Memory Windows Registry Internet URL Shortcuts Files and Directories Finished Scanning Started Cleaning Internet Explorer/MSN/AOL Cache Windows Temp Files Cookies Finished Cleaning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 05:46:24 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 17:04:37 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 17:04:55 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Programs in Memory Finished Scanning Started Scanning Internet Cookies Programs in Memory Windows Registry Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com' Internet URL Shortcuts Files and Directories Finished Scanning Started Backup Finished Backup Started Cleaning Finished Cleaning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 17:57:58 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 17:59:21 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 18:04:07 2004 Product Version=1, 0, 1, 53 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 18:05:58 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Programs in Memory Finished Scanning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Wed Nov 24 20:29:16 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Programs in Memory Finished Scanning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 02:35:04 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 02:37:31 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Programs in Memory Finished Scanning Started Scanning Internet Cookies Programs in Memory Windows Registry Internet URL Shortcuts Files and Directories Finished Scanning Started Cleaning Internet Explorer/MSN/AOL Cache Windows Temp Files Cookies Finished Cleaning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 03:11:25 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 03:17:25 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) --------------------------------- SpySubtract session ended --------------------------------- --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 03:17:29 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Internet Explorer/MSN/AOL Cache Windows Temp Files Cookies Started Scanning Programs in Memory Finished Scanning Started Scanning Internet Cookies Programs in Memory Windows Registry Internet URL Shortcuts Files and Directories Finished Scanning Started Cleaning Internet Explorer/MSN/AOL Cache Windows Temp Files Cookies Finished Cleaning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 03:27:01 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Internet Cookies Programs in Memory Windows Registry Internet URL Shortcuts Files and Directories --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 03:28:51 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Finished Scanning Started Cleaning Internet Explorer/MSN/AOL Cache Windows Temp Files Cookies Finished Cleaning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 05:48:49 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600) Started Scanning Internet Cookies Found 'unicast.com' in 'Internet Explorer Cache' Programs in Memory Windows Registry Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\my-internet.info' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com' Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com' Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1' Internet URL Shortcuts Files and Directories Finished Scanning Started Backup Finished Backup Started Cleaning Finished Cleaning --------------------------------- SpySubtract session started --------------------------------- Machine=COMPUTER-1 Time=Thu Nov 25 06:00:34 2004 Product Version=1, 0, 1, 49 OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)
