SpyBlaster putting CoolWebSearch in registry

Discussion in 'SpywareBlaster & Other Forum' started by Morphosis, Jun 27, 2004.

Thread Status:
Not open for further replies.
  1. Morphosis

    Morphosis Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    4
    First let me say that I am NOT by any means an expert with spyware or adware...

    I have the following on my computer, and all are current versions:
    CWShredder
    SpyBlaster
    AdAware
    Spybot S&D
    Hijack This
    Spyware Guard
    Spyware Nuker 2004
    Spyware BeGone

    I have two problems with SpyBlaster:
    1) Whenver I open SpyBlaster there is one item with protection disabled. The XXX Toolbar is continually unchecked (somehow).
    2) Whenever I select "Enable All Protection" then a CoolWebSearch is placed into my registry. This is ONLY detected by Spyware Nuker 2004. None of the other software is finding it.

    I even booted into safe mode and ran each program but still Spyware Nuker was the ONLY one that detected the CoolWebSearch in the registry.

    After going through this Forum and reading the posts, I think I may have a solution to the XXX Toolbar problem. Although, the fix was a little complicated for my level of knowledge but I suppose I will just have to walk myself through it. Will the XXX Toolbar fix also resolve the CoolWebSearch in registry problem?

    Does anyone have fixes for these problems?

    And finally, is fixing SpywareBlaster really worth the effort? Is the software worth the headache? Is there better software available that will provide better protection and not require fixing? Any advice is welcomed!

    Karen
     
  2. JemW

    JemW Registered Member

    Joined:
    Jun 9, 2004
    Posts:
    32
    First of all, SB is, without doubt, worth the effort. But what you should understand is that SB is designed to stop Spyware / Malware from getting onto your machine in the first place. It does not remove anything if already there. Also, some existing spyware (depending on exactly what it is) can and does subsequently interfere with the installation and running of anti-virus and anti spyware products.

    So, the first thing you need to do is get rid of what you have already. There are a number of scanners available, many of then free, but my recommendation would be to use one of the best known and, in my experience, most effective: Lavasoft AdAware downloadable here:

    http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

    Install AdAware, use the on-line update to ensure you have the latest 'Reference File' and run what they call an in depth scan. It's basically easy to use and should show you a resulting list of the nasties on your machine. You can then choose to remove the lot if you wish (and you probably should). AdAware quarantines what it removes so you can go back later if you find that you've removed something you didn't want to - but, to be honest, I think it unlikely with AdAware.

    Then, and only only then, install Spyware Blaster, use the one line update and 'Enable all Protection'. See how you go from there - hopefully, you'll be clean and protected!!

    Couple of important things more:

    AdAware, in it's basic, freeware form, scans & removes but does NOT then protect - that's Spyware Blaster's job, ok?

    When you've run AdAware and 'cleaned up', run it again to check, then re-boot and run it again to check!! These things have a habit of resurrecting themselves sometimes - there's some clever sons of ******* out there...

    Good luck...

    Jem
     
  3. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Hi Morphosis :)

    SpywareNuker is a ripoff of SpyBot S&D. This is a well known fact. It is actually spyware itself, info here,

    http://www.spywareeliminator.com/forum/index.php?showtopic=683&st=0&#entry2214

    I would recommend uninstalling it.


    snowbound
     
  4. Morphosis

    Morphosis Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    4
    Re: Snowbound...

    Thank you for letting me know! I wonder why it is the only spyware detector that I am using that is able to detect the SpyBlaster associated CoolWebSearch in the registry? SpyBot S&D didn't detect it, nor any of the others that I listed in my orignal post.

    Thanks.
     
  5. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    "2) Whenever I select "Enable All Protection" then a CoolWebSearch is placed into my registry. This is ONLY detected by Spyware Nuker 2004. None of the other software is finding it."

    Hey Morphosis\Karen,

    What Spywarenuker is falsely detecting is one of the many entries\sites SpywareBlaster places in the Restricted Zone. There are other programs that falsely detect similar entries....Spysweeper being one. Since the problem is not with SpywareBlaster....I suggest you consider re-evaluating the use of Spynuker....if for no other reason than the one Snowbound gave.

    Also....concerning the XXXToolbar question....I do not see Pestpatrol in your list of installed software but I'll ask anyway. Do you use Pest Patrol ?

    Edit: Overlooked an item.

    The reason being there is nothing to detect because it also places various CoolWebSearch URL's in the registry\IE's Restricted Zone via it's Immunization feature.
     
  6. Morphosis

    Morphosis Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    4
    Re: Jem

    Jem,

    Thanks for taking the time to respond to my questions! Its because of those "cleaver sons of ******* out there" that I am going back to college to change careers. I have worked in networking (enterprise) for 15 years and I can't keep up with the security issues. I've never liked the software side of the job anyway... so now I'm studying Biology!!! ;)

    Thank goodness there are so many clever do-gooders to help fight off the clever do-badders!
     
  7. Morphosis

    Morphosis Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    4

    Oh! I think I get it now. Thanks so much! So I won't worry about that registry entry - but just to confirm, it shows up in SpywareNuke as being located in the: HKCU.../Internet Settings/zonemap/domains/xxxtoolbar.com
    Is that the false positive?




    No, I do not have Pestpatrol installed. I had read in the forums that it was causing problems with SpyBlaster and I can only handle one thing at a time!
    It sounds like the same problem that I am having with SpywareNuker. (Now that you have explained it to me.)

    Removing SpywareNuker today... :D
     
    Last edited: Jun 28, 2004
  8. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Yes....that is the false positive. The location you gave....HKCU.../Internet Settings/zonemap/domains....is where the Trusted AND Restricted Zone URL's are placed.
     
Thread Status:
Not open for further replies.