cool Search Virus

I will download the hijacked software and then post the log thank you

First try spybot . It will give you a list of unwanted files.Then download hijacthis.RUn it and post the log here
Also before running spybot update it with the latest spyware definitions same with hijackthis

Sunray

We will do think you I will get back to you with my results if I have successfully removed the cool search component or not

Dear Nitty,

I have faced these issues before.

First power off the cable modem
power off the router
wait for 5 MINS. ( Actually 3 or 4 MINS is fine)
Now plug in everything
Press the reset button at the back of the router
Check if that would work .. This can be the simplest remedy


Try pinging 192.168.0.1 and check what you get

Thanks,
Sunray

OOPS sorry wrong thread

Sunray

lbp4433,
> We will do think you I will get back to you with my results if I have successfully
> removed the cool search component or not

Sorry I am not understanding what you are trying to say here

Do as I had said and post the logs that you get from hijackthis HERE. Myself or any other expert can help you.
I will be online for few more hours

Thanks,
Sunray

If I am not mistaken you wrote

First try spybot . It will give you a list of unwanted files.Then download hijacthis.RUn it and post the log here
Also before running spybot update it with the latest spyware definitions same with hijackthis

Sunray

Will this get rid of the cool search problem after I download the software and run it as suggested?

lbp4433,
> Will this get rid of the cool search problem after I download the software
> and run it as suggested?

The idea of running these 2 are most of the time they can solve the problem.
There are others in the list that I have sent you that you should try if the problem is not resolved

Most likely Hijackthis will give the key cos it will tell you what registry keys that you need to delete to get rid of the cool search issue ..
post the log here

After these 2 you can test Adaware and CWshredder

Thanks,
Sunray

CoolWebSearch-the coolwebsearch chronicles


[langalist] LangaList Standard Edition 2003-10-23
Date: 10/22/2003 9:17:30 PM Pacific Daylight Time

CoolWebSearch = Very UnCool

It is a nasty hijack program that hides very well. It would run
once a day so even if he thought he had things fixed and
working the problem would return the next day (after a reboot).
[The CoolWebSearch exploit (explained at
http://www.spywareinfo.com/~merijn/cwschronicles.html )] was
the root of the problem. If you read this site you can see just
how nasty this is. The dam* thing can install from a web page
you may be at or passing through.

http://www.spywareinfo.com/~merijn/

 has a fast little shredder
to remove it plus a few other useful utilities. He won't be
100% sure that he has finally beat this bug for a couple days,
but from the tests he's done so far it does appear to have been
killed.


Subject: Registry cure for Searchv hijacker

http://www.computing.net/security/wwwboard/forum/6873.html

ty 4 the info  LRI41

So i go to http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder and downlad CWShredder.exe ??  LRI41 ??

lbp4433,

Did you download and run hijackthis Post the log  here .
I can tell you the registry keys that you need to delete first.

Why did you accept an answer before doing that ?

Thanks,
Sunray

lbp4433,
>  http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder and downlad
> CWShredder.exe ?

and regarding this one I had already asked you to do so after using hijackthis ?

Thanks,
Sunray

sunray_2003 I apologize for not posting the log file first I will do that shortly.  And I also apologize for excepting an before posting the log file.  I really appreciate everyone's help I am new to web site.  I will certainly go through all the frequently asked questions on using this web site appropriately

I am not saying what  LRI41  told was wrong.If you can see in that article that there can be many variants for that spyware. But I have helped to solve many spyware issues.
if you can post the log we can assist you and then if it doesnot go away with all the softwares then accept the answer

Sunray

lbp4433

If you want to reconsider and split and points  or even award all of the
to the Bellyacher since he really needs them and wants them, it make me no never mind, just post a 0 point question in CS listed at the top right of you screen.

LRI41,
> even award all of the
> to the Bellyacher since he really needs them and wants them

I would think you need to watch your language here , Mr.LRI41.what I have said to the questioner is to check the softwares and see if the spywares can be removed. Using most of the softwares if it is not removed then fine. If it can be removed then it is going to benefit all of us here . I am not disagreeing with what you had given ..

Bellyacher since he really needs them  = totally unacceptable



Thanks,
Sunray

In regards to posting the  log I have already run the software as suggested and its been removed I did post a zero point  question in cs I'm certainly willing to split the points without any hesitation.  Thank you again for everyone's help

lbp4433,
> have already run the software as suggested and its been removed

what has been removed ?

Thanks,
Sunray

The cool search spyware problem

So did you delete the all registry keys pertaining to cool search

If you have not or even had done that check these keys

***************

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

***************

So even after removing them , you are getting them ..

hav you tried Cwshredder aswell ?

Sunray

Cwshredder is what I used and that is all I used

lbp4433,
> Cwshredder is what I used and that is all I used

OK finally..You used Cwshredder and it your problem is solved . is it NOT ?


Thanks,
Sunray

It is solved thank you

LRI41,
>  even award all of the
> to the Bellyacher since he really needs them and wants them, it make me no never mind,

I would guess you are not going to mind even if I get all the points here cos I had asked him to use CWshredder FIRST

It would be generous of him to split the points and I donot mind  

lbp4433 , If had already requested CS to open this question so that you can split , it is fine with ME

Thanks,
Sunray

I will certainly split points not a problem there

Thank you for all yor help sunray_2003 and LRI41

NPlbp4433

here is what my Hijack this log has...any suggestions??
Logfile of HijackThis v1.98.2
Scan saved at 12:31:51 PM, on 8/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\netjs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\TASKMAN.EXE:ciqqy
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\MIKE\Desktop\HijackThis.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.EXE
C:\Program Files\Trend Micro\Internet Security\PCCGUIDE.EXE
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ayrfi.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ssgrd.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ssgrd.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ayrfi.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4EF24DB7-3509-B765-D598-CCE2A69F964D} - C:\WINDOWS\system32\javams32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [netjs.exe] C:\WINDOWS\netjs.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab