How to kill CoolNetSearch

Discussion in 'Virus Information' started by =?Utf-8?B?amF5b3Jib24=?=, Jan 8, 2006.

  1. Please help,

    I can't kill spyware from CoolNetSearch. Microsoft Antispyware dosn't work,
    and Ad-Aware SE dosn't work. The software creates 40 new spyware programs as
    soon as I open Internet Explorer.
     
    =?Utf-8?B?amF5b3Jib24=?=, Jan 8, 2006
    #1
    1. Advertisements

  2. =?Utf-8?B?amF5b3Jib24=?=

    Malke Guest

    Since I don't know how you scanned, go through these malware removal
    steps systematically:

    http://www.elephantboycomputers.com/page2.html#Removing_Malware

    Malke
     
    Malke, Jan 8, 2006
    #2
    1. Advertisements

  3. From: "jayorbon" <>

    | Please help,
    |
    | I can't kill spyware from CoolNetSearch. Microsoft Antispyware dosn't work,
    | and Ad-Aware SE dosn't work. The software creates 40 new spyware programs as
    | soon as I open Internet Explorer.


    For non-viral malware...

    Please download, install and update the following software...

    * Ad-aware SE v1.06
    http://www.lavasoft.de/
    http://www.lavasoftusa.com/

    * SpyBot Search and Destroy v1.4
    http://security.kolla.de/

    * CWShredder:
    http://www.trendmicro.com/cwshredder/

    * VX2/Look2Me Fix:
    http://www.downloads.subratam.org/VX2Finder.exe

    After the software is updated, I suggest scanning the system in Safe Mode.

    I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
    that may be on the PC.

    * BHODemon

    http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

    For viral malware...

    * Download MULTI_AV.EXE from the URL --
    http://www.ik-cs.com/programs/virtools/Multi_AV.exe

    To use this utility, perform the following...
    Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
    Choose; Unzip
    Choose; Close

    Execute; C:\AV-CLS\StartMenu.BAT
    { or Double-click on 'Start Menu' in C:\AV-CLS }

    NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
    FireWall to allow it to download the needed AV vendor related files.

    C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
    This will bring up the initial menu of choices and should be executed in Normal Mode.
    This way all the components can be downloaded from each AV vendor's web site.
    The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

    You can choose to go to each menu item and just download the needed files or you can
    download the files and perform a scan in Normal Mode. Once you have downloaded the files
    needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
    during boot] and re-run the menu again and choose which scanner you want to run in Safe
    Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

    When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
    file. http://www.ik-cs.com/multi-av.htm


    * * * Please report back your results * * *
     
    David H. Lipman, Jan 8, 2006
    #3
  4. Use Ewido http://www.ewido.net/en/ and Hijackthis
    http://www.spywareinfo.com/~merijn/downloads.html post your HJT log to
    for expert analysis.
     
    Robert Jordan, Jan 8, 2006
    #4
  5. It is probably Cool WEB Search .Cool WEB Search is a spyware - the most
    difficult to remove. I recommend you use the programs that finds it .There
    are many variants and not all programs find all versions.

    You need to scan in Safe Mode with command prompt because most its versions
    ^gets into ^ Windows expolorer .Security softwares kills the process in
    order to eliminate the malware but because it is Windows process it loads but
    not only because of that and because of the malware makes the explorer.exe
    permanent.


    If you scan in Safe Mode with command prompt ,explorer.exe will not load
    and that's why you'll (all together with the software) have a success.

    Please ,go to my web-site and perform the malware removal instruction.
    http://free.hit.bg/fightmalware/homepage_en.htm

    Be very careful ! Also use CWShredder by TrendMicro
    http://housecall.trendmicro.com

    Use it in Safe Mode.
    :)

    Panda_man
     
    =?Utf-8?B?UGFuZGFfbWFu?=, Jan 8, 2006
    #5
  6. Thanks for all the advice. I will give it a try. I will be travling for the
    next 2 weeks so it may take a little time.
     
    =?Utf-8?B?amF5b3Jib24=?=, Jan 9, 2006
    #6
  7. Hi Dave,

    I updated my Virus package and ran it in Safe mode. I added AD-Aware and
    Spybot and ran them plus the Microsoft software. Microsoft couldn't find
    anything. Each of the others found many items. But the problem remains. The
    software adds stuff to real URLS and forces me to web searchg engines to
    look for similar sounding stuff. Once a URL is "on the list" It is hard to
    get to the real page.
     
    =?Utf-8?B?amF5b3Jib24=?=, Jan 30, 2006
    #7
  8. =?Utf-8?B?amF5b3Jib24=?=

    Malke Guest

    Clean up your hosts file and then download the trial version of Ewido.
    Update it and run it in Safe Mode. You can uninstall Ewido when your
    computer is clean. If that doesn't completely fix the problem, run
    HijackThis and post your log in one of the forums listed on the site
    below (not here, please).

    http://www.elephantboycomputers.com/page2.html#Removing_Malware

    Information about the Hosts file -
    http://www.mvps.org/winhelp2002/hosts.htm

    http://www.ewido.net/en/

    Malke
     
    Malke, Jan 30, 2006
    #8
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.