Dear Friends, I finally killed Cool Web Search. Here is how I did it.
If you get constant res://*****/*****.dll/sp.html#****** browser hijacking after you've removed it with SpyBot, or Adaware, then you know u have a Cool Web Search problem.
You've observed some very strange .exe processes (two for mine) running when u press alt+ctrl+delete, right? If you shut them off, and load IE, they reappear again with mutated names, and your browser keeps on reverting back to res://**** .
(The following is a reiteration of the post: Cool Web Search has me hostage found elsewhere on the internet).
If you run CWShredder.exe, whether in safe mode or not, and it worked, great! Your problem is solved. If, like me, the problem still persists, then read on.
Sadly, if you delete whatever out-of-place .exe processes u find, they will just perpetuate themselves. The master mind behind all of these attacks is a BHO, or Browser Helper Object, (a .dll file), which loads when the browser loads. This .dll file is different from the res://*****/*****.dll/sp.html#******* file.
To find out where it is located, there is a tool called BHO Demon (Currently version 2), which will do just that. For example, the BHO infecting my system was C:\Windows\System32\winka32.dll dated June 29, 2004.
Okay, so you've found out where it is located, how do you go about eliminating it? Remember the strange .exe processes still running in your background? They aren't just there for no reason. They may be there to reassemble the BHO should it be missing. So to ensure effective removal of the BHO and prevent its reinfection, I recommend the following steps:
1. Disconnect ur Network cable. (You don't want any more .exe or BHO downloaded from the net while u disable it). You may want to save this post for reference as you will be working offline.
2. End all questionable .exe running processes. How to find out if a process is affliated with the BHO? run cmd from the Start->Run menu. Locate the process via dir filename /a /s. You want the /a switch in case the file is hidden. Look at the date of the .exe file. Most Windows XP systems files (besides the updates) have year dates of 2001 or 2002. If you see that your .exe is 2004 and around June or July, that .exe is potentially scumware. By ending questionable .exe processes, you prevent it from reassebling the BHO .dll.
3. Remove the BHO .dll file reported by BHODemon 2.0. How to do it? Run cmd from the Start ->Run menu. CD to the directory where the BHO is located. For example CD C:\Windows\System32. Then attrib -h -s -r BHO.dll file to ensure that it is removable. Then erase the BHO.dll file.
4. Ok, remember the .exe processes. You've shut them down. But how do you know that there isn't a registry setting which decides to load the suckers the next time you reboot, thus reassembling the BHO.dll file. You'll have to delete them too.
*DON'T TAKE MY WORDS FOR THIS PART, IT'S BEST TO CONSULT WITH AN EXPERT.
So run cmd from the Start->Run menu. CD C:\Windows. Then Dir *.exe /a and look for recent files dated 2004 and around June/July. Tease out the suspicious .exe*. You will notice that the suspicious .exe have usually the same file size, ie 26KB. Attrib -h -s -r the .exe files and erase them. Then CD C:\Windows\System32. Attrib -h -s -r the suspicious .exe files there and erase them.
5. Run Spybot. Remove all spyware entries.
6. Run Adaware. Remove all spyware entries.
7. Reboot. Voila, you are now rid of Cool Web Search!
Klik om te vergroten...
