Coolwebsearch

Discussion in 'privacy problems' started by auggief, Nov 24, 2004.

Thread Status:
Not open for further replies.
  1. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    My spyware program, BPS finds coolwebsearch which I delete. I then run CWShredder and it says my computer is clean. However, I run regedit "find" coolwebsearch and it finds it in the registry along with another two dozen entries with the first word "cool". I manually delete each one.
    The next day. if I run BPS spyware it finds it again and I start all over. HOw is "Coolwebsearch" getting into my machine? Is there any way I can stop it from getting in?
     
  2. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,449
    Location:
    North Carolina, USA
    Hi auggief,

    First of all I am going to move your thread to the privacy problems forum where it will get the proper attention.

    Secondly, I would seriously consider trashing BPS as it is considered a rogue anti-spyware product and is known for its false positives amongst other things. For more info, see HERE.

    I would run either or both of the following and see what these scans come up with. Both programs are free.
    Spybot Search&Destroy
    SpybotS&D Setup Tutorial.
    Ad-Aware
    Ad-Aware Setup Tutorial.
    Before scanning with either Ad-Aware or Spybot S&D, remember to bring them up-to-date first.

    Then post back and let us know your status.
     
  3. no13

    no13 Retired Major Resident Nutcase

    Joined:
    Sep 28, 2004
    Posts:
    1,327
    Location:
    Wouldn't YOU like to know?
    You'll need spysubtract. CWShredder was sold to these ppl (AFAICT) and they're responsible for updating it. coolwebsearch ppl are updating daily, and CWshredder needed such a massive effort that the author found less and less time for his own stuff.
     
  4. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    Puff, I use Spybot and Adaware and they don't find Coolwebsearch. I have to ask. If it is a false positive from BPS, why when I do regedit do I find several entries starting with "cool" including coolwebsearch.com etc. I manually delete then all from the registry, but somehow when I run BPS the next day, it finds coolwebsearch again and I run CWShedder which says computer is clean. However, I go into regedit and the "cool" entres are there again. I don't go into porno sights or anything that could cause Coolwebsearch to get into my machine. I put coolwebsearch.com in my Norton Firewall restricted sites, but that didn't stop it.
     
  5. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,449
    Location:
    North Carolina, USA
    Hi auggief,

    Do you any programs like SpywareBlaster or IE-SpyAds, or had you previously used the immunize function of SpyBot?

    It also would help if you would post exactly what BPS is finding and any reg keys that you are finding also.
     
  6. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    I installed Spysubtract(trial) and scanned. It found 11 itmes in the registry which I deleted. I think I should have put them in blacklist before I deleted and will if they come up the next time I run Spycontract.
     
  7. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    Puff-M-D, I use Spywareblaster, Spywareguard, BPS, Adaware and Spybot and I immunize on Spybot. Next time BPS finds someting I will post here. As I recall it says something like Hijack attempt and lists coolwebsearch. It also listed a toolbar but I determined that it was the Google Toolbar and put it into ignore.
    What has been real confusing to me is that after I delete coolwebsearch, using BPS, I run CW Shredder and it says I am clean. However when I go into the registry and"find" coolwebsearch, it finds about 20 items starting with the word cool, which I delete. Hopefull having just used Spysubtract for the first time and finding 11(new) registry items which I deleted, the problem will stop. Next time I run BPS, I will advise you what it finds. Many thanks.
     
  8. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,449
    Location:
    North Carolina, USA
    One reason I asked you about the programs was that SpywareBlaster puts 25 to 30 reg keys for CWS into your registry as does both SpyBot and IE-SpyAd. A lot of scanners will pick these up and they are false positives. THIS THREAD will give you some more info. This could be the cause for reg keys reappearing....
     
  9. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    Puff, I just ran BPS again. This time I didn't not get coolwebsearch but got:
    1.Spy Registry Key Persistent Handler aspfile\persistenthandler
    2.Spy Registry Key Possible Browser Hijack Attempt H-key-currnet user/software/microsoft/windows/currentversion/internetsettings/zonemap/domains/pluginaccess.com.
    I went into the registry and deleted item 2.
    Sorry. I couldn't get BPS to let me copy and paste.
     
  10. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    Puff, if I understand correctly those "cool" items in the registry were put there by SpywareBlaster and Ie-Spyad and are harmless and don't need to be manually deletedo_O Next time I run BPS and it comes up with coolwebsearch, I will report to you.
     
  11. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,449
    Location:
    North Carolina, USA
    That is the probable reason.
    This one was put there by SpywareBlaster also. Run SpywareBlaster and see if it tells you you have unprotected items. You probably have several unprotected CWS items and one for pluginaccess also.
     
  12. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    Puff-M-D, you were right. Spyblaster had plug in access and several coolweb search items in red which wereunchecked in restricted. I checked all to be protected. Thanks for staying with me to solve this problem. Hopefully spyblaster will now keep me from getting cooweb search and plugin access.
     
  13. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,449
    Location:
    North Carolina, USA
    No problem auggief as you are most welcome ;) . I am just glad to have been of help.....
     
  14. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    I installed Spysubtract on 30 day trial. A screen comes up to update, but when I say ok, it says I am not connected to the internet. I am on cable and always connected. Why won't it let me update?
     
  15. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
  16. auggief

    auggief Registered Member

    Joined:
    Sep 11, 2003
    Posts:
    26
    Puff-M-D, this is my log since using Spysubtract. The last scan on Nov 25th came up with coolwebesearch as some I haven't seen before. Maybe the update had something to do with it.
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 05:14:36 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 05:15:44 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 05:16:09 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Programs in Memory
    Finished Scanning
    Started Scanning
    Internet Cookies
    Programs in Memory
    Windows Registry
    Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\my-internet.info'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com'
    Internet URL Shortcuts
    Files and Directories
    Finished Scanning
    Started Backup
    Finished Backup
    Started Cleaning
    Finished Cleaning
    Extracting file 'C:\DOCUME~1\Computer\LOCALS~1\Temp\session.ini' (1999 bytes).
    Started Scanning
    Internet Cookies
    Programs in Memory
    Windows Registry
    Internet URL Shortcuts
    Files and Directories
    Finished Scanning
    Started Cleaning
    Internet Explorer/MSN/AOL Cache
    Windows Temp Files
    Cookies
    Finished Cleaning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 05:46:24 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 17:04:37 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 17:04:55 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Programs in Memory
    Finished Scanning
    Started Scanning
    Internet Cookies
    Programs in Memory
    Windows Registry
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com'
    Internet URL Shortcuts
    Files and Directories
    Finished Scanning
    Started Backup
    Finished Backup
    Started Cleaning
    Finished Cleaning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 17:57:58 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 17:59:21 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 18:04:07 2004
    Product Version=1, 0, 1, 53
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 18:05:58 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Programs in Memory
    Finished Scanning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Wed Nov 24 20:29:16 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Programs in Memory
    Finished Scanning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 02:35:04 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 02:37:31 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Programs in Memory
    Finished Scanning
    Started Scanning
    Internet Cookies
    Programs in Memory
    Windows Registry
    Internet URL Shortcuts
    Files and Directories
    Finished Scanning
    Started Cleaning
    Internet Explorer/MSN/AOL Cache
    Windows Temp Files
    Cookies
    Finished Cleaning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 03:11:25 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 03:17:25 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    --------------------------------- SpySubtract session ended ---------------------------------

    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 03:17:29 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Internet Explorer/MSN/AOL Cache
    Windows Temp Files
    Cookies
    Started Scanning
    Programs in Memory
    Finished Scanning
    Started Scanning
    Internet Cookies
    Programs in Memory
    Windows Registry
    Internet URL Shortcuts
    Files and Directories
    Finished Scanning
    Started Cleaning
    Internet Explorer/MSN/AOL Cache
    Windows Temp Files
    Cookies
    Finished Cleaning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 03:27:01 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Internet Cookies
    Programs in Memory
    Windows Registry
    Internet URL Shortcuts
    Files and Directories
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 03:28:51 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Finished Scanning
    Started Cleaning
    Internet Explorer/MSN/AOL Cache
    Windows Temp Files
    Cookies
    Finished Cleaning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 05:48:49 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

    Started Scanning
    Internet Cookies
    Found 'unicast.com' in 'Internet Explorer Cache'
    Programs in Memory
    Windows Registry
    Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\my-internet.info'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com'
    Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com'
    Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1'
    Internet URL Shortcuts
    Files and Directories
    Finished Scanning
    Started Backup
    Finished Backup
    Started Cleaning
    Finished Cleaning
    --------------------------------- SpySubtract session started ---------------------------------
    Machine=COMPUTER-1
    Time=Thu Nov 25 06:00:34 2004
    Product Version=1, 0, 1, 49
    OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)
     
Thread Status:
Not open for further replies.