Spyware: Can't remove coolwwwsearch.smartkiller

Posted on 2005-05-04
Last Modified: 2013-12-04
Anybody have any solutions for removing coolwwwsearch.smartkiller? I've been searching around for a way to get rid of it with no success. I installed cwshredder, spybot 1.4beta, hijackthis, adaware, etc. I have this on my work computer and my home computer. Tried removing with Spybot recommending a pre-startup scan and it still can't remove it cause it thinks it's in 'memory' or something. ugh...

Here is my hijackthis.log - I didn't see anything out of the ordinary. Maybe someone else can spot something:

<<  Hijack This log removed by humeniuk, Page Editor  >>
<<  log file available at >>

Thanks in advance for any help,
Question by:jplee3
    LVL 13

    Expert Comment

    Spyware Dr. will get rid of that. But it's payware :(
    LVL 57

    Expert Comment

    by:Pete Long
    LVL 57

    Expert Comment

    by:Pete Long

    Author Comment

    i removed the recommended "nasty" item (microsoft office lnk) with HijackThis and also disabled WinPCAP (i think). but coolwwwsearch still shows up under spybot and i can't remove it. i guess i'll check out spyware dr - i hope they would have at least a trial version.. no?
    LVL 57

    Accepted Solution

    run though this

    Browser Hijacking/Spyware/Adware/Malware Removal instructions

    Full removal and Prevention instructions are available on my website,

    The EE Official Link to info is,

    Author Comment

    i figured it out. id10t error over here - so i guess coolwwwsearch has been on my machine for some time now (i haven't run spybot in a long time). so before i ran a check on spybot, i thought "it would be good if i doublecheck my 'hosts' file to make sure there aren't any weird ips, to block ips with the '' redirect trick, and to lock it down" --- this is the source of the problem. apparently, spybot is sifting through the modified hosts file and, for some reason, keeps complaining that there about three website redirects (i forgot the name of the spam websites off the top of my head). if i replace the modified hosts file with the original hostfile with " localhost" as the only entry, the "coolwwwsearch" doesn't show up anymore.

    this is really odd behavior. not sure why spybot is picking up spyware from my hosts file. maybe it does a keyword-scan and assumes spyware exists if it hits specific keywords... i don't know.

    anyway, problem resolved for now.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
    Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now