Coolwebsearch Spyware even Ad Aware SE is powerless against this omnipotent foe nasty-seeming spyware program, downloaded itself on my computer ripoff hijacked my homepage to www.0websearch.com Internet

Nancy, Paul here. You lucked out. Problem isolated to one partition. Good 4 you!

Read about the phone dialers here. People are surfing. Meanwhile, dialer downloads are running up their phone bills. Victim gets bill with $100 unknown calls. Phone company says it came from your line. Stuck with the bill. It's enough to make you want to tear the phone line right out of the wall!

Spyblocker, huh? Stupid zonealarm i'm using let's the stuff in; it just doesn't let them call out. That's the zone part. But, a lot of good that does me. I gotta fit spyblocker and firefox into my schedule. Find the time to get them on and learn how to use. XP disk is getting thinner from all the laser reads during format!

I have, like, 1/2 year online, so i'm learning everyday. Thnks again 4 the info!

Robin, figured you could appreciate this one. I was playing a game the other day and had turned off all programs but the game itself. I then didn't do a reboot which will auto start the programs I always have running when online and I got online. No spyblocker means no protection and I went to a few game cheat sites I have used for ages. I got nailed by a sex trojan horse. *sigh* (My hubby is have a truly wonderful time teasing me about getting it too and asking me how often I search sex sites. He WILL pay for this in the near future. LOL.)

Darn thing made all my desktop icons useless, screwed up my registry files, wouldn't let me do a thing basically, wouldn't let AdAware remove the TH files, Norton didn't see it (it was running when I got it, I changed to AVG now), and left me no option but to format my C drive and reinstall XP. Guess after 11 1/2 safe years online I'm now no longer a net virgin. LOL. :)

So hours later, I'm back up and running. I run my HD partitioned so I didn't lose much, I put all programs on D, E, and F drives, so I only lost the few things I had on C drive.

I knew spyblocker was a good program, but didn't realize HOW good till this happened. I just wanted to make everyone aware of what not running it did to me when I didn't have it turned on out of my own stupidity.

Andrew,

LOL, I see you have been digging in the archives here. I had completely forgotten the poor old Rusty Scupper! Thanks for the kind words...but I thought one had to be dead to achieve legend status. Oh, dear, I'd better go in for a checkup soon!

A complete reformat should get rid of CWS entirely. The problem is if you back anything up now you may be incorporating parts of this nasty beast into your backups. This thing gets everywhere; your registry, your boot sector, your files. CWShredder will fix it, but it just reloads the next time you boot!

Reformatting is a pain, and Microsoft still makes it ridiculously difficult to back up e-mail and your address book. Try some of the suggestions below first.

CoolWebSearch is an Internet Explorer exploit. To work around it in order to download the following programs, try downloading the new release of Mozilla Firefox, an alternative browser. You should find that it works just fine because it is not infected.

Firefox available here:

http://www.mozilla.org/products/firefox/

Do not give it permission to be your main browser at this time.

If you want to use this browser all the time, you could theoretically be able to call your problem resolved. But, if you are like me it really bugs you to know that there is some nasty yukky malware crawling around in your computer somewhere. Try the steps below to eradicate it.

I do not want to ask too many technical questions, but a couple of general ones.

Do you have antivirus and a firewall? Are both of them up-to-date? Try manually updating to check. CWS likes to shut these things down. It will also block you out of certain forums and program updates; yes, it is another insidious move to keep you from ridding yourself of it. Nasty beast!

There are still a couple of weapons in the arsenal that you can try without manually editing your registry.

Both the programs below are freeware.

A Squared is a fairly new spyware scanner available here:

http://www.emsisoft.com/en/

It is pretty thorough at locating and correcting malware problems.

Now the big gun...Bazooka. Available from Kephyr here:

http://www.kephyr.com/spywarescanner/index.html?source=appvisit

This one runs quickly and may find some things.

Download both of these; update both through the link within the program. Then reboot. Now run these programs in this order:

1. A Squared
2 Bazooka
3 CWShredder

(I have deliberately left Spybot out of this mix as it is reporting false positives right now that will confuse the issue. An update to correct that is in the works)

After running the three programs and letting them fix what ever they find, reboot.

Make sure you have found your recovery disk before beginning the next step.

Go here for Symantec's registry fix:

http://securityresponse.symantec.com/avcenter/venc/data/adware.coolwebsearch.html

This will help you manually remove any remaining registry elements the programs might have missed. You may not find all these keys in your registry; hopefully, most have been removed by the tools.

Editing the registry is risky business, so be warned.

If you still have CWS after all this, go for the reformat. Save the little spyware programs to disk and reinstall them when you are done. Also, make sure to get the Spyware Blaster which will block the barbarians out in the first place. Easier to prevent than try to fix.

Multiple layers of protection seem to work best. If you return to Internet Explorer as your main browser, you will need to remain on the defensive by using these programs often.

Good luck to you!

Andrew,

LOL, I see you have been digging in the archives here. I had completely forgotten the poor old Rusty Scupper! Thanks for the kind words...but I thought one had to be dead to achieve legend status. Oh, dear, I'd better go in for a checkup soon!

A complete reformat should get rid of CWS entirely. The problem is if you back anything up now you may be incorporating parts of this nasty beast into your backups. This thing gets everywhere; your registry, your boot sector, your files. CWShredder will fix it, but it just reloads the next time you boot!

Reformatting is a pain, and Microsoft still makes it ridiculously difficult to back up e-mail and your address book. Try some of the suggestions below first.

CoolWebSearch is an Internet Explorer exploit. To work around it in order to download the following programs, try downloading the new release of Mozilla Firefox, an alternative browser. You should find that it works just fine because it is not infected.

Firefox available here:

http://www.mozilla.org/products/firefox/

Do not give it permission to be your main browser at this time.

If you want to use this browser all the time, you could theoretically be able to call your problem resolved. But, if you are like me it really bugs you to know that there is some nasty yukky malware crawling around in your computer somewhere. Try the steps below to eradicate it.

I do not want to ask too many technical questions, but a couple of general ones.

Do you have antivirus and a firewall? Are both of them up-to-date? Try manually updating to check. CWS likes to shut these things down. It will also block you out of certain forums and program updates; yes, it is another insidious move to keep you from ridding yourself of it. Nasty beast!

There are still a couple of weapons in the arsenal that you can try without manually editing your registry.

Both the programs below are freeware.

A Squared is a fairly new spyware scanner available here:

http://www.emsisoft.com/en/

It is pretty thorough at locating and correcting malware problems.

Now the big gun...Bazooka. Available from Kephyr here:

http://www.kephyr.com/spywarescanner/index.html?source=appvisit

This one runs quickly and may find some things.

Download both of these; update both through the link within the program. Then reboot. Now run these programs in this order:

1. A Squared
2 Bazooka
3 CWShredder

(I have deliberately left Spybot out of this mix as it is reporting false positives right now that will confuse the issue. An update to correct that is in the works)

After running the three programs and letting them fix what ever they find, reboot.

Make sure you have found your recovery disk before beginning the next step.

Go here for Symantec's registry fix:

http://securityresponse.symantec.com/avcenter/venc/data/adware.coolwebsearch.html

This will help you manually remove any remaining registry elements the programs might have missed. You may not find all these keys in your registry; hopefully, most have been removed by the tools.

Editing the registry is risky business, so be warned.

If you still have CWS after all this, go for the reformat. Save the little spyware programs to disk and reinstall them when you are done. Also, make sure to get the Spyware Blaster which will block the barbarians out in the first place. Easier to prevent than try to fix.

Multiple layers of protection seem to work best. If you return to Internet Explorer as your main browser, you will need to remain on the defensive by using these programs often.

Good luck to you!

Andrew,

LOL, I see you have been digging in the archives here. I had completely forgotten the poor old Rusty Scupper! Thanks for the kind words...but I thought one had to be dead to achieve legend status. Oh, dear, I'd better go in for a checkup soon!

A complete reformat should get rid of CWS entirely. The problem is if you back anything up now you may be incorporating parts of this nasty beast into your backups. This thing gets everywhere; your registry, your boot sector, your files. CWShredder will fix it, but it just reloads the next time you boot!

Reformatting is a pain, and Microsoft still makes it ridiculously difficult to back up e-mail and your address book. Try some of the suggestions below first.

CoolWebSearch is an Internet Explorer exploit. To work around it in order to download the following programs, try downloading the new release of Mozilla Firefox, an alternative browser. You should find that it works just fine because it is not infected.

Firefox available here:

http://www.mozilla.org/products/firefox/

Do not give it permission to be your main browser at this time.

If you want to use this browser all the time, you could theoretically be able to call your problem resolved. But, if you are like me it really bugs you to know that there is some nasty yukky malware crawling around in your computer somewhere. Try the steps below to eradicate it.

I do not want to ask too many technical questions, but a couple of general ones.

Do you have antivirus and a firewall? Are both of them up-to-date? Try manually updating to check. CWS likes to shut these things down. It will also block you out of certain forums and program updates; yes, it is another insidious move to keep you from ridding yourself of it. Nasty beast!

There are still a couple of weapons in the arsenal that you can try without manually editing your registry.

Both the programs below are freeware.

A Squared is a fairly new spyware scanner available here:

http://www.emsisoft.com/en/

It is pretty thorough at locating and correcting malware problems.

Now the big gun...Bazooka. Available from Kephyr here:

http://www.kephyr.com/spywarescanner/index.html?source=appvisit

This one runs quickly and may find some things.

Download both of these; update both through the link within the program. Then reboot. Now run these programs in this order:

1. A Squared
2 Bazooka
3 CWShredder

(I have deliberately left Spybot out of this mix as it is reporting false positives right now that will confuse the issue. An update to correct that is in the works)

After running the three programs and letting them fix what ever they find, reboot.

Make sure you have found your recovery disk before beginning the next step.

Go here for Symantec's registry fix:

http://securityresponse.symantec.com/avcenter/venc/data/adware.coolwebsearch.html

This will help you manually remove any remaining registry elements the programs might have missed. You may not find all these keys in your registry; hopefully, most have been removed by the tools.

Editing the registry is risky business, so be warned.

If you still have CWS after all this, go for the reformat. Save the little spyware programs to disk and reinstall them when you are done. Also, make sure to get the Spyware Blaster which will block the barbarians out in the first place. Easier to prevent than try to fix.

Multiple layers of protection seem to work best. If you return to Internet Explorer as your main browser, you will need to remain on the defensive by using these programs often.

Good luck to you!

hi everybody. this is pretty much the first time i've been able to get online at an acceptable speed, not counting little bouts here and there. i would like to thank paul and robin especially for their quick responses. as a new user of this site, i was pretty honored to be helped by some (in my opinion) "ripoff legends."

no i'm not being sarcastic. i really find paul's commentary regarding those audiophile speaker van bastards to be right on point, probably the best on the subject. likewise, i especially liked robin's contribution to resolving the whole "rusty scupper" fiasco, probably the most ridiculous ripoff report i have ever read.

so, getting that out of the way, i haven't been altogether successful in locating my pc's system recovery disk, so i've held off on reformatting for the time being but expect to find the disk this weekend and intend to reformat if possible. in the meantime i continue my "quarantine & removal" efforts.

i tried some of the helpful pointers that were suggested, most notably using CWShredder. it sounded like a remarkable program! completely devoted to defeating my nemesis! but about 5 minutes after i ran it and it told me i had successfully removed coolwebsearch, the spyware was at it again and my homepage was back to www.0websearch.com. oh well.

i tried to update the program through its link, but that was unsuccessful with the message that the server might be down. does anyone know how to resolve this? or is this just another insidious move by coolwebsearch to limit my defensive capability?

at this point i have accepted the fact that i wll need to completely reformat my computer. i managed to burn most of the important stuff to CD, so hopefully coolwebsearch has not inbedded itself into my personal files, ready to wreak havoc on my new system!

does anyone know if reformatting my comp (using the system recovery disc) will completely get rid of coolwebsearch? common sense tells me it will, but i don't know of all of CWS' tricky games and would like to be sure before i lose all my info.

again, thanks for all the help from everyone. it makes me feel a lot better that even though i can't seem to do anything to defeat this enemy, there are nonetheless others out there who share my sentiments and resentment. like Atreides against Harkonnen!

hi everybody. this is pretty much the first time i've been able to get online at an acceptable speed, not counting little bouts here and there. i would like to thank paul and robin especially for their quick responses. as a new user of this site, i was pretty honored to be helped by some (in my opinion) "ripoff legends."

no i'm not being sarcastic. i really find paul's commentary regarding those audiophile speaker van bastards to be right on point, probably the best on the subject. likewise, i especially liked robin's contribution to resolving the whole "rusty scupper" fiasco, probably the most ridiculous ripoff report i have ever read.

so, getting that out of the way, i haven't been altogether successful in locating my pc's system recovery disk, so i've held off on reformatting for the time being but expect to find the disk this weekend and intend to reformat if possible. in the meantime i continue my "quarantine & removal" efforts.

i tried some of the helpful pointers that were suggested, most notably using CWShredder. it sounded like a remarkable program! completely devoted to defeating my nemesis! but about 5 minutes after i ran it and it told me i had successfully removed coolwebsearch, the spyware was at it again and my homepage was back to www.0websearch.com. oh well.

i tried to update the program through its link, but that was unsuccessful with the message that the server might be down. does anyone know how to resolve this? or is this just another insidious move by coolwebsearch to limit my defensive capability?

at this point i have accepted the fact that i wll need to completely reformat my computer. i managed to burn most of the important stuff to CD, so hopefully coolwebsearch has not inbedded itself into my personal files, ready to wreak havoc on my new system!

does anyone know if reformatting my comp (using the system recovery disc) will completely get rid of coolwebsearch? common sense tells me it will, but i don't know of all of CWS' tricky games and would like to be sure before i lose all my info.

again, thanks for all the help from everyone. it makes me feel a lot better that even though i can't seem to do anything to defeat this enemy, there are nonetheless others out there who share my sentiments and resentment. like Atreides against Harkonnen!

hi everybody. this is pretty much the first time i've been able to get online at an acceptable speed, not counting little bouts here and there. i would like to thank paul and robin especially for their quick responses. as a new user of this site, i was pretty honored to be helped by some (in my opinion) "ripoff legends."

no i'm not being sarcastic. i really find paul's commentary regarding those audiophile speaker van bastards to be right on point, probably the best on the subject. likewise, i especially liked robin's contribution to resolving the whole "rusty scupper" fiasco, probably the most ridiculous ripoff report i have ever read.

so, getting that out of the way, i haven't been altogether successful in locating my pc's system recovery disk, so i've held off on reformatting for the time being but expect to find the disk this weekend and intend to reformat if possible. in the meantime i continue my "quarantine & removal" efforts.

i tried some of the helpful pointers that were suggested, most notably using CWShredder. it sounded like a remarkable program! completely devoted to defeating my nemesis! but about 5 minutes after i ran it and it told me i had successfully removed coolwebsearch, the spyware was at it again and my homepage was back to www.0websearch.com. oh well.

i tried to update the program through its link, but that was unsuccessful with the message that the server might be down. does anyone know how to resolve this? or is this just another insidious move by coolwebsearch to limit my defensive capability?

at this point i have accepted the fact that i wll need to completely reformat my computer. i managed to burn most of the important stuff to CD, so hopefully coolwebsearch has not inbedded itself into my personal files, ready to wreak havoc on my new system!

does anyone know if reformatting my comp (using the system recovery disc) will completely get rid of coolwebsearch? common sense tells me it will, but i don't know of all of CWS' tricky games and would like to be sure before i lose all my info.

again, thanks for all the help from everyone. it makes me feel a lot better that even though i can't seem to do anything to defeat this enemy, there are nonetheless others out there who share my sentiments and resentment. like Atreides against Harkonnen!

hi everybody. this is pretty much the first time i've been able to get online at an acceptable speed, not counting little bouts here and there. i would like to thank paul and robin especially for their quick responses. as a new user of this site, i was pretty honored to be helped by some (in my opinion) "ripoff legends."

no i'm not being sarcastic. i really find paul's commentary regarding those audiophile speaker van bastards to be right on point, probably the best on the subject. likewise, i especially liked robin's contribution to resolving the whole "rusty scupper" fiasco, probably the most ridiculous ripoff report i have ever read.

so, getting that out of the way, i haven't been altogether successful in locating my pc's system recovery disk, so i've held off on reformatting for the time being but expect to find the disk this weekend and intend to reformat if possible. in the meantime i continue my "quarantine & removal" efforts.

i tried some of the helpful pointers that were suggested, most notably using CWShredder. it sounded like a remarkable program! completely devoted to defeating my nemesis! but about 5 minutes after i ran it and it told me i had successfully removed coolwebsearch, the spyware was at it again and my homepage was back to www.0websearch.com. oh well.

i tried to update the program through its link, but that was unsuccessful with the message that the server might be down. does anyone know how to resolve this? or is this just another insidious move by coolwebsearch to limit my defensive capability?

at this point i have accepted the fact that i wll need to completely reformat my computer. i managed to burn most of the important stuff to CD, so hopefully coolwebsearch has not inbedded itself into my personal files, ready to wreak havoc on my new system!

does anyone know if reformatting my comp (using the system recovery disc) will completely get rid of coolwebsearch? common sense tells me it will, but i don't know of all of CWS' tricky games and would like to be sure before i lose all my info.

again, thanks for all the help from everyone. it makes me feel a lot better that even though i can't seem to do anything to defeat this enemy, there are nonetheless others out there who share my sentiments and resentment. like Atreides against Harkonnen!

Thanks, Robin. glad to hear from you. My computer is fine. All my virus/adware problems are in the past. I'm 100% immune to data loss now. I only surf with my dedicated internet computer. It has no personal files on it. No work files. No personal information either. All it's used for is internet use. I search with it. Anything I download is saved to a thumb drive. I pull the drive out and take the downloads to my main computer. The main computer never hooks to the internet. Nothing can ever come across the wire and get on it.

If something gets to the internet computer, I try to straighten it out. If I can't, I format the drive and reinstall windows. A couple of hours for the XP to go back on. In the end, I'm brand new and clean again. So, let all the crackers send me stuff. I'll just erase all their hard work. They can't spy on me. I got no information on the computer for them. They can't use my computer to spam. The minute I see that happening, I'll get out my install disk and format.

I don't have hundreds of programs on the internet computer. Just windows. That's all you need to surf. So, it's nothing much for me to format. A few hours of lost time, is all.
I did have problems in the past though. I know what Andrew, above, is dealing with. Even worse, he may lose vital information. Corrupted work files. Corrupted boot files. Your work is stuck on the desktop somewhere. At best, you can use DOS to find it. Anything larger than a floppy is stuck, with no way to retrieve it. I learned a while ago. Now, I don't take chances anymore.
Hey, glad to hear about linux. I heard of it before. I had no idea it came bundled with a book in the store. I'll definitely have to check it out.

I'm really not a big fan of windows. But, I must admit that a new build works pretty well. It's when you install, uninstall, and get adware/spyware programs corrupting it that windows begins to give you problems. A fresh clean registry won't give you a problem.
I'm as secure as fort knox now. I haven't seen Andrew back. I hope he hasn't lost years of files or anything. Thank you, Robin. Best of luck to you!

Paul,

Glad you are up and running again. Computer snafus are the pits.

Just a comment. If you like command lines, you would really like Linux. It is pretty much all command line driven.

There is a book called Redhat Linux 9 Bible by Christopher Negus. It can be purchased at most bookstores or online for a reasonable price; I paid $49.00 for it.

It is huge (for us newbies), but if you are familiar with and like command lines, you would be ahead of the game.

In this book you get a complete three disk set of Linux Red Hat 9 OS. If you are using Windows XP with NTFS format on your hard drive, you would have to create a partition and reformat that for Linux. Or try it on an old computer if you do not want a dual boot drive.

Thought you might enjoy this "just for fun". It will give you a more secure online experience all in all. It is not expensive when compared to Micro$oft's O$. Linux is free, the programs are free, and if they ever develop a good bookkeeping program for Linux, it may be adis to Windows for me!

One word of warning: software Winmodems will not work with Linux (that is being worked on, but no good fix yet that I am aware of). It is best and easiest to use an external hardware modem to save yourself hours of frustration and headaches.

Good luck to you, and I hope you are able to keep the "baddies" out in the future.

Robin/Chris/Francis/Nancy-
great info you guys. I'm saving this page to disk to implement some of the software that was suggested.

I never had ME. I went straight from 98 to a new computer with XP pro.

I also tried some of those registry editors that claim to eliminate bad keys. They still didn't straighten everything out. I finally got rid of coolweb by the regedit method.
By that time, I knew the reg was so jumbled up, that I finally said the hell with it and just reformatted. I get the security of a brand new install, as well as the lightning fast response time.

Oh, check this out, that time the screen turned black, I was looking for web hosting. Absolutely nothing to do with porn. Although, I do admit to having my share of download pics. What the hell, boys will be boys. The spyware is everywhere now.
Nancy, I heard about unix and linux, but I just finished digesting this huge book on XP. I know how all the features work, finally. Ya know, I started with all the old microsoft products. All the old dos versions. I actually preferred that command line stuff better. I'm gonna look up and implement the suggestions that were made. But, I don't have a lot to lose anymore. Not since I did the double computer firewall method, anyway. Hey, thanks for the postings. Helpfull stuff. Anyone that surfs will run into these problems sooner or later. Thank you!

Another way to avoid much of this "Highjacker" software, especially "Coolwebsearch" is to stop going to porn sites!

Paul, while the information you gave Andrew is one way to get rid of the nasties you can get from web surfing, why not do it the easy way? Get a copy of SpyBlocker and put an end to those types of files getting on your computer to begin with. It stops the files before they can download to your computer and also puts a block on certain websites deemed 'bad' so you can't even get to them. I've been running it for the past year and have yet to get any spyware, malware, bugs, scripts, etc. on my computer. I run Norton Anti-Virus too, although in my 11 years online I have yet to get a virus. Protect yourself before you get online and you will stay safe.

You claim that XP is the only OS that offers the restore function. That is not correct. WinME has system restore too. You also said MicroSoft is the only OS there is, which is again wrong. You could always change to a flavor of Unix or Mac.

To get rid of CoolWebsearch go to this URL and you will find help and tools for removal. http://www.siena.edu/antivirus/spyware/cws.asp

Seach Google for CWShredder - or CoolWebSearch Shredder - and you'll find a FREE program that totally rids your computer of the CWS plague...

Andrew,

Don't panic yet! A full reformat of your drive is an incredible hassle.

First, do a Google search for a dandy little program called "CWShredder". Yep, created just for the purpose of removing the awful CoolWebSearch. If your computer will not download it, get it elsewhere and save it to a disk...I think even a floppy will hold this.

First, run CWShredder on your machine. Then download Spybot S&D. Run it as well to help clean up any other "lurkers" in your system. Neither Spybot or AdAware alone are up to removing this insidious malware.

If you are still experiencing problems, go to the Tom Coyote forum and download "Hijack This". Run it as explained at the site and send your logfile into the forum. These folks are experienced "spyware hunters" and they will tell you which registry entries you need to remove or alter to clear every last vestige of this nasty out of your system.

Now that you have cleaned house, it is time to practice prevention. JavaCool offers two programs, SpywareGuard and Spyware Blaster. Dow load both of these. Update both programs immediately as they update minutely sometimes, because CoolWebSearch mutates often.

Direct Spyware Blaster to "Enable All Protection" (it works with IE and Mozilla/Firefox) and it will forbid entry to CoolWebSearch, never allowing it in. Spybot also has an immunize feature, but even Spybot recommends the use of Spyware Blaster.

Paul, you mean well, but are a bit misguided. Windows ME offered a system restore function back in the day. The problem with using this is no one can be sure exactly when the registry changes began taking place; usually the "symptoms" of infection do not appear until days later, after the bug has infested everything and opened the back door and downloaded even more crap. Using system restore is not the best way.

Reformatting and reinstalling is not the best way, either. Too much data can be lost with this method, and it should be a last resort unless folks are using the "old PC" method of websurfing you suggest. That is a good way to go; if there is no valuable data to lose, don't worry about it. Just keep email and your address book backed up regularly just in case.

Farting around with Windows registry without professional guidance is not a good habit to get into unless you enjoy revamping your system often. Let the guys at Tom Coyote help you with this. Not all bad entries will be apparent to the untrained eye, anyway.

Get the Windows XP Service Patch 2 and install it, if that is your OS. It will offer some protection, too, until the d**n hackers and crackers began circumventing it (it is just a matter of time). You can download from Microsoft IT in a manner that allows you to burn it to disk. If you do have to do the occasional reformat, you will complete it much more quickly by having your patches on disk.

Always do your spyware/virus scans right before shutdown. Once you shut it down, the bugs will set to your drive and corrupt your registry and boot sector.

BACKUP, BACKUP, BACKUP! OFTEN, OFTEN, OFTEN! Get Drive Image....well, Norton Ghost now, as Symantec bought out Drive Image. Make a replica of your entire drive when you know it is "clean" and you will be ahead of the game if something gets in.

I think we can all agree that we would love to slowly strangle the idiots who have nothing better to do than ruin other people's computers. Finding them is well-nigh impossible, though. If I ever do, I would take great delight in cutting off various body parts with a dull plastic butter knife....

Be defensive. Good luck to you both.

Andrew, your posting really struck a nerve with me. I had the exact same thing happen to my computer. Spam is bad enough. I get 500 emails a day. About 90% of it is spam. But, these god-damned viruses, hijackers, and programs that take over your computer. The people who make them are absolute trash. I can't see what they get out of it, either. I had my screen turn all black one night.

A message appeared that told me to pay $30 on a credit card to have it fixed. Did I pay? Hell no! These dumbasses have no legitimate product or service to put on the web.

So, they try to redirect you to sites that pay them for clicks. What that means is people will pay these assholes for everyone they send.

The site owner thinks he will eventually sell something if enough people are forced to come to his site. I never bought anything. I don't know anybody that would be dumb enough to buy from a site who hijacks your computer and forces you to see his web pages.


You know, I'm not a programmer. But, I do know a few things. It is possible to take control of someone's computer over the internet conection. You can then do one of two things. You could format his hard drive. Or, even worse, you could provide the wrong instructions to the hard drive. You could tell the read-write heads to move to the very center of the spindle, where they would be ruined. No more hard drive.

Even a format puts an end to the spyware distribution for a while. I'm telling you, I'd sure love to know how to do this. I'd format their drive every 2 days. They'd never get online long enough to distribute another spyware program again. These people cause nothing but problems for the entire web community. Net trash, is what they are.

Now, onto the solution. These programs write to your windows registry. They install themselves just like any program. If you delete the program files themselves, the registry contains enough information to still function. What you have is called a browser hijacker.

You need to edit the registry. Under start/run, type regedit. Under edit/find, search for coolwebsearch. There will probably be at least a dozen instances of it. You need to delete every one of them. You delete in the right-hand side of the screen.

You want to delete the key that contains the words coolwebsearch. But, now, here is the problem. You are f**king with the Windows registry. There is no undo function.

Any change you make is instant and permanent. It's entirely possible to f**k up the registry so windows won't start anymore. But, if you only delete the coolwebsearch words, you will be OK. But, if you accidentally erase other lines as well, you could possibly screw windows up. Editing the registry is not for a casual user.

Here's what I do now. I have had so many bullshit things come over the internet that I don't take any chances anymore. By the way, a lot of this s**t comes from clicking on something for free. It's funny, most of the people on this site end up with problems trying to get something for free. The web is no different than real life.
Ok, back to the solution here.

First, never, ever put your main computer on the web. You are crazy to do that. I put a second computer on the web. I don't store any of my files on it. There is windows and there is office. But nothing in the my documents folder. And, no office files. There is nothing on it except programs.

I don't store any of my personal work files on it. I use a USB thumb drive. If I want to save a web page, or a web photo, I save it on the thumb drive. At the end of my internet session, I turn off and remove the thumb drive. I plug it into my main computer and transfer the info across. I could still carry an infected program onto the 2nd computer, but so far it hasn't happened.
If the internet computer gets corrupted, I have two solutions.

First, it's best to use XP because it gives you system restore. You can restore your registry to the point it was last saved. You want to save every couple of days. That way, you can restore if an internet session goes bad. Anything before XP doesn't offer this function. You have to try to edit the registry as described above.

My second solution is complete format and re-install. That's what I ended up doing. Andrew, by now, your computer is so filled with bullshit spyware that the best thing to do is format and reinstall. For me it's easy, but time consuming. You need a full windows version. Or a starter version and upgrades. New computers don't come with any of this. I had to buy disks. I have 98 second edition, full version. First I format and install that. Then I upgrade to XP pro. Then you need your programs. I just put Word on my internet computer. Remember, never work with personal files on the internet computer. Only use it to surf and save. Surf and save. Got it? Use the thumb drive to transfer. You need XP for many of these USB drives. Besides, I'm used to XP pro now. I wouldn't go back to 98.

If you continue to use your main computer on the internet, I guarantee you will lose your work. Guarantee it. It's just a question of time. Something will either delete your files. Or, a virus will make your computer un-bootable. Or, like you already have, it will slow to a halt and crash. It may boot, only to lock up and do nothing. Get your information off now, before you lose it.

Then get windows and programs. Format and reinstall. Then, never go online again with that computer. Always keep a dedicated internet computer. It can be a cheap system. I use an old 266 Mhz laptop.

The windows registry also gets fuked up every time you uninstall a program normally. You'll see this when you do regedit. Lots of old programs will still be in the registry. Microsoft makes poor software. But, it's all there is, so I try to make the best of it.

By all means, save your info. I've had a computer since Toshiba first came out. I've got a lot of important files I don't want to lose. Hell, my files are worth more to me than the computer. Try regedit if you think you can do that. Delete only the words coolwebsearch. Run through the whole registry. Do it twice in case you miss something the first time. But, plan on a format and reinstall as well. Then go the 2 computer route. Post here if you are still having problems. I'll check back tomorrow. I know how to start under DOS and how to copy your files under DOS too.
I use Zonealarm as a firewall. But, viruses still get through a firewall. That's why you need to be ready with format and re-install. That always kills everything.

There is a thing called a boot virus that hides in the boot section of the hard drive. I'm not sure if a format would remove that or not. But, format will solve 100% of anything else that comes across the internet line. The problem is you are talking hours of computer work. That's why these people are the trash dumpsters of the web. They cause a lot of wasted time. All for what? So they can make $1.27 on a few redirected searches? Hey, give this a shot and let me know how you make out. I'll check back.