Solved

Can't remove Spyware: CoolWWWSearch.WCADW

Posted on 2004-09-16
21
1,778 Views
Last Modified: 2012-08-14
I'm running both Spybot S&D and Ad-Aware but the following just keeps on coming back:

CoolWWWSearch.WCADW: IE Search page (Registry change, fixing failed)

Spybot offers to re-run on boot up but still cannot remove this item.

Any suggestions:

Thanks
0
Comment
Question by:bigstar
21 Comments
 
LVL 17

Expert Comment

by:Microtech
ID: 12073232
Hi bigstar,
http:Q_20975384.html#10973796 a tool to remove all spyware including coolweb etc


Hope This helps
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12073316
Hi
run your updated spyware tools in safe mode.

that should take care of it for you


Tanelorn
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12073323
I'm sorry,  
boot your machine into safemode by pressing F8 at startup,  once the system boots up,  run your tools.

T
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 3

Expert Comment

by:matthew1471
ID: 12073495
I'll just expand on that :$

Keep pressing F8 rapidly at startup just before the Windows logo comes up and select "Safe Mode"...

Is Ad-Aware actually detecting the spyware? You might need to hit "Web Update" in Ad-aware..
0
 
LVL 3

Expert Comment

by:dheeruthakur
ID: 12073580
do this its defnetely help you.
         in internet explorer(properties) - set about blank then run this tools.

·      RepairDefaultPrefix.reg <http://mvps.org/winhelp2002/RepairDefaultPrefix.reg> [right-click and select: Save As]
Repairs the corrupted or altered (spyware) HTTP prefixes
Note: HijackThis can also repair the DefaultPrefix entry [more info <http://www.spywareinfo.com/~merijn/htlogtutorial.html>]

dheerendra
(Network Engineer)

0
 
LVL 21

Expert Comment

by:jvuz
ID: 12074047
0
 
LVL 1

Expert Comment

by:BAFP
ID: 12074342
This worked for me:
>Use Spybot but also enable teatimer (comes with Spybot) then run a scan.
>once scan is finished, reboot computer.
>Spybot will run again. clean any thing that was found.
>Spybot Teatimer will then report that its noticed a registry change, tick the box that reads 'remember this..' and then click on deny change.
>That's it.

What this does is it will disable the program from running - effectively deleting it and making sure it doesnt comeback.

I hope this helps you out.

regards

BAFP
0
 
LVL 1

Expert Comment

by:BAFP
ID: 12074354
oh when u do the first scan, make sure you click all the spyware and click Fix It. then follow the remaining intructions.
0
 

Author Comment

by:bigstar
ID: 12076203
So far I've tried running Spybot and Ad-Aware (with latest updates) in safe mode, then usermode. This is my company machine and I had to get the admin credentials. When I ran the progs in safe mode, I am seeing a different set of spyware found, I.E. not CoolWWWSearch.WCADW. When I return to my ordinary user mode, CoolWWWSearch is still there and still immovable.

I have also removed the Java VM as suggested.

Admittedly I have not tried all the solutions here, but I'm disappointed to know the safe mode method has not worked.

Can this be remedied?
0
 
LVL 3

Expert Comment

by:matthew1471
ID: 12076338
How about making the user an Admin, Booting into safe mode, logging in as that user....Clearing computer of Spyware..

Remove Admin privallages..and then be done ready for tea time ;)?
0
 

Author Comment

by:bigstar
ID: 12076442
Hmmn

Good Idea Matthew.

I'll give it a bash.

Looking forward to teatime :)
0
 
LVL 20

Expert Comment

by:Debsyl99
ID: 12076659
Hi

Let's hope that works ok. If it doesn't, then disable system restore if xp or Me, restart in safe mode, run this and post the log up here for us to have a look at,
Hijackthis
http://www.spychecker.com/program/hijackthis.html

Deb :))
0
 
LVL 2

Expert Comment

by:kinveachy
ID: 12081239
Read this:

http://www.experts-exchange.com/Web/Browser_Issues/Q_20975384.html

Many experts contributed to this and it'll give you the right info you need to remove all spyware etc!

Good Luck

Kin
0
 
LVL 21

Expert Comment

by:jvuz
ID: 12081738
Have you tried the collwebshredder already?
0
 
LVL 3

Expert Comment

by:4ceReconSniper
ID: 12082365
update its definitions it solved my problem
0
 

Expert Comment

by:MichaelKnoll
ID: 12092919
Dear Bigstar:

Perhaps this is a variant or alias of CoolWebSearch.  Details and manual removal instructions are on Pest Patrol's web site at http://pestpatrol.com/pestinfo/c/coolwebsearch.asp.

Regards,
Michael Knoll
0
 
LVL 1

Expert Comment

by:lawyerboy780
ID: 12094934
Dear Bigstar...

If you haven't already solved your CoolWebSearch problem, try CWShredder.  You can download it from the following sites:

http://www.softpedia.com/progDownload/CWShredder-Download-8114.html
http://www.majorgeeks.com/download4086.html
http://www.pcworld.com/downloads/file_download.asp?fid=23551&fileidx=1

Regards
James H
0
 
LVL 3

Expert Comment

by:matthew1471
ID: 13738476
"Hmmn

Good Idea Matthew.

I'll give it a bash."

Wonder how that went, logically it was a good solution,
0
 

Accepted Solution

by:
modulo earned 0 total points
ID: 13747690
PAQed with no points refunded (of 100)

modulo
Community Support Moderator
0

Featured Post

ScreenConnect 6.0 Free Trial

Want empowering updates? You're in the right place! Discover new features in ScreenConnect 6.0, based on partner feedback, to keep you business operating smoothly and optimally (the way it should be). Explore all of the extras and enhancements for yourself!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ESXi lockdown mode without vCenter connected? 10 107
vcenter/esxi crash?  Going haywire... 18 385
Exchange 2007 standard - defrag (eseutul /d) 10 46
OS Selection Menu 1 25
Windows 10 is here and for most admins this means frustration and challenges getting that first working Windows 10 image. As in my previous sysprep articles, I've put together a simple help guide to get you through this process. The aim is to achiev…
#Citrix #POC #XenDesktop #vCenter #VMware #ESX
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question