Solved

Can't remove Spyware: CoolWWWSearch.WCADW

Posted on 2004-09-16
21
1,772 Views
Last Modified: 2012-08-14
I'm running both Spybot S&D and Ad-Aware but the following just keeps on coming back:

CoolWWWSearch.WCADW: IE Search page (Registry change, fixing failed)

Spybot offers to re-run on boot up but still cannot remove this item.

Any suggestions:

Thanks
0
Comment
Question by:bigstar
21 Comments
 
LVL 17

Expert Comment

by:Microtech
ID: 12073232
Hi bigstar,
http:Q_20975384.html#10973796 a tool to remove all spyware including coolweb etc


Hope This helps
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12073316
Hi
run your updated spyware tools in safe mode.

that should take care of it for you


Tanelorn
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12073323
I'm sorry,  
boot your machine into safemode by pressing F8 at startup,  once the system boots up,  run your tools.

T
0
 
LVL 3

Expert Comment

by:matthew1471
ID: 12073495
I'll just expand on that :$

Keep pressing F8 rapidly at startup just before the Windows logo comes up and select "Safe Mode"...

Is Ad-Aware actually detecting the spyware? You might need to hit "Web Update" in Ad-aware..
0
 
LVL 3

Expert Comment

by:dheeruthakur
ID: 12073580
do this its defnetely help you.
         in internet explorer(properties) - set about blank then run this tools.

·      RepairDefaultPrefix.reg <http://mvps.org/winhelp2002/RepairDefaultPrefix.reg> [right-click and select: Save As]
Repairs the corrupted or altered (spyware) HTTP prefixes
Note: HijackThis can also repair the DefaultPrefix entry [more info <http://www.spywareinfo.com/~merijn/htlogtutorial.html>]

dheerendra
(Network Engineer)

0
 
LVL 21

Expert Comment

by:jvuz
ID: 12074047
0
 
LVL 1

Expert Comment

by:BAFP
ID: 12074342
This worked for me:
>Use Spybot but also enable teatimer (comes with Spybot) then run a scan.
>once scan is finished, reboot computer.
>Spybot will run again. clean any thing that was found.
>Spybot Teatimer will then report that its noticed a registry change, tick the box that reads 'remember this..' and then click on deny change.
>That's it.

What this does is it will disable the program from running - effectively deleting it and making sure it doesnt comeback.

I hope this helps you out.

regards

BAFP
0
 
LVL 1

Expert Comment

by:BAFP
ID: 12074354
oh when u do the first scan, make sure you click all the spyware and click Fix It. then follow the remaining intructions.
0
 

Author Comment

by:bigstar
ID: 12076203
So far I've tried running Spybot and Ad-Aware (with latest updates) in safe mode, then usermode. This is my company machine and I had to get the admin credentials. When I ran the progs in safe mode, I am seeing a different set of spyware found, I.E. not CoolWWWSearch.WCADW. When I return to my ordinary user mode, CoolWWWSearch is still there and still immovable.

I have also removed the Java VM as suggested.

Admittedly I have not tried all the solutions here, but I'm disappointed to know the safe mode method has not worked.

Can this be remedied?
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 3

Expert Comment

by:matthew1471
ID: 12076338
How about making the user an Admin, Booting into safe mode, logging in as that user....Clearing computer of Spyware..

Remove Admin privallages..and then be done ready for tea time ;)?
0
 

Author Comment

by:bigstar
ID: 12076442
Hmmn

Good Idea Matthew.

I'll give it a bash.

Looking forward to teatime :)
0
 
LVL 20

Expert Comment

by:Debsyl99
ID: 12076659
Hi

Let's hope that works ok. If it doesn't, then disable system restore if xp or Me, restart in safe mode, run this and post the log up here for us to have a look at,
Hijackthis
http://www.spychecker.com/program/hijackthis.html

Deb :))
0
 
LVL 2

Expert Comment

by:kinveachy
ID: 12081239
Read this:

http://www.experts-exchange.com/Web/Browser_Issues/Q_20975384.html

Many experts contributed to this and it'll give you the right info you need to remove all spyware etc!

Good Luck

Kin
0
 
LVL 21

Expert Comment

by:jvuz
ID: 12081738
Have you tried the collwebshredder already?
0
 
LVL 3

Expert Comment

by:4ceReconSniper
ID: 12082365
update its definitions it solved my problem
0
 

Expert Comment

by:MichaelKnoll
ID: 12092919
Dear Bigstar:

Perhaps this is a variant or alias of CoolWebSearch.  Details and manual removal instructions are on Pest Patrol's web site at http://pestpatrol.com/pestinfo/c/coolwebsearch.asp.

Regards,
Michael Knoll
0
 
LVL 1

Expert Comment

by:lawyerboy780
ID: 12094934
Dear Bigstar...

If you haven't already solved your CoolWebSearch problem, try CWShredder.  You can download it from the following sites:

http://www.softpedia.com/progDownload/CWShredder-Download-8114.html
http://www.majorgeeks.com/download4086.html
http://www.pcworld.com/downloads/file_download.asp?fid=23551&fileidx=1

Regards
James H
0
 
LVL 3

Expert Comment

by:matthew1471
ID: 13738476
"Hmmn

Good Idea Matthew.

I'll give it a bash."

Wonder how that went, logically it was a good solution,
0
 

Accepted Solution

by:
modulo earned 0 total points
ID: 13747690
PAQed with no points refunded (of 100)

modulo
Community Support Moderator
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Just about everyone has an old PC laying around.  Ask anyone in the IT industry, whether they are a professional or play in it as a hobby.  From outdated Desktops to cheap "throwaway" laptops, they are all around and not as hard to "fix up" as you m…
Sometimes a user will call me frantically, explaining that something has gone wrong and they have tried everything (read - they have messed it up more and now need someone to clean up) and it still does no good, can I help them?!  Usually the standa…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now