coolweb...no doubt again!

[henry bucket]

I've got a (w98) machine in here with coolwwwsearch.searchklick and some
related infections.

spybot detects and removes but they return on reboot
adaware detects and removes but they return on reboot
hijackthis does not detect the registry keys matching those detected by
the above
the latest cwshredder does not detect
the online trend scan does not detect

avg7 (free) detects 3 files (startpage mods) but can neither heal, move
to vault or delete?

I'm reluctant to wipe this system as finding old w98 drivers is a pain
these days

any suggestions?

H

 

[Sanjaya]

I've got a (w98) machine in here with coolwwwsearch.searchklick and some
related infections.

spybot detects and removes but they return on reboot
adaware detects and removes but they return on reboot
hijackthis does not detect the registry keys matching those detected by
the above
the latest cwshredder does not detect
the online trend scan does not detect

avg7 (free) detects 3 files (startpage mods) but can neither heal, move
to vault or delete?

I'm reluctant to wipe this system as finding old w98 drivers is a pain
these days

any suggestions?

H

Try Bazooka
http://www.kephyr.com/spywarescanner/index.html
I'm not sure it will find your problem spies, it only checks on 500-600 things,
but if it does find something it will tell you how to manually remove it.

 

[Art]

I've got a (w98) machine in here with coolwwwsearch.searchklick and some
related infections.

spybot detects and removes but they return on reboot
adaware detects and removes but they return on reboot
hijackthis does not detect the registry keys matching those detected by
the above
the latest cwshredder does not detect
the online trend scan does not detect

avg7 (free) detects 3 files (startpage mods) but can neither heal, move
to vault or delete?

I'm reluctant to wipe this system as finding old w98 drivers is a pain
these days

Try this:

http://www.claymania.com/KASFX.EXE

Art

http://home.epix.net/~artnpeg

 

[David H. Lipman]

From: "henry bucket" <[email protected]>

| I've got a (w98) machine in here with coolwwwsearch.searchklick and some
| related infections.
|
| spybot detects and removes but they return on reboot
| adaware detects and removes but they return on reboot
| hijackthis does not detect the registry keys matching those detected by
| the above
| the latest cwshredder does not detect
| the online trend scan does not detect
|
| avg7 (free) detects 3 files (startpage mods) but can neither heal, move
| to vault or delete?
|
| I'm reluctant to wipe this system as finding old w98 drivers is a pain
| these days
|
| any suggestions?
|
| H

The lastest CWShredder is owned by Trend Micro and Win9x/ME are not compliant to use it.

I hope that you are suing Ad-aware SE v1.06 and SpyBot Search and Destroy v1.4 and they are
both fully updated.

I strongly suggest scanning the system in Safe Mode when using Ad-aware and SpyBot.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

BHODemon
http://www.definitivesolutions.com/bhodemon.htm

 

[David H. Lipman]

I forgot to mention, please install the VX2 remover add-on for Ad-aware SE...

http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml

 

[Ron Lopshire]

From: "henry bucket" <[email protected]>

| I've got a (w98) machine in here with coolwwwsearch.searchklick and some
| related infections.
|
| spybot detects and removes but they return on reboot
| adaware detects and removes but they return on reboot
| hijackthis does not detect the registry keys matching those detected by
| the above
| the latest cwshredder does not detect
| the online trend scan does not detect
|
| avg7 (free) detects 3 files (startpage mods) but can neither heal, move
| to vault or delete?
|
| I'm reluctant to wipe this system as finding old w98 drivers is a pain
| these days
|
| any suggestions?
|
| H

The lastest CWShredder is owned by Trend Micro and Win9x/ME are not compliant to use it.

I hope that you are suing Ad-aware SE v1.06 and SpyBot Search and Destroy v1.4 and they are
both fully updated.

I strongly suggest scanning the system in Safe Mode when using Ad-aware and SpyBot.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

BHODemon
http://www.definitivesolutions.com/bhodemon.htm

Henry,

Please don't sue Lavasoft or Patrick. Ad-Aware and Spybot S&D are both
really good programs. ;-)

Sorry, David. Couldn't help myself.

Ron

 

[David H. Lipman]

From: "Ron Lopshire" <[email protected]>


| Henry,
|
| Please don't sue Lavasoft or Patrick. Ad-Aware and Spybot S&D are both
| really good programs. ;-)
|
| Sorry, David. Couldn't help myself.
|
| Ron

Ooooooops -- Major Typo :-(

Its amazing how a simple typo can /*COMPLETELY*/ alter the meaning of a sentence !

Thanx Ron.

 

[Robin T Cox]

I've got a (w98) machine in here with coolwwwsearch.searchklick and some
related infections.

spybot detects and removes but they return on reboot
adaware detects and removes but they return on reboot
hijackthis does not detect the registry keys matching those detected by
the above
the latest cwshredder does not detect
the online trend scan does not detect

avg7 (free) detects 3 files (startpage mods) but can neither heal, move
to vault or delete?

I'm reluctant to wipe this system as finding old w98 drivers is a pain
these days

any suggestions?

H

SpywareBlaster will prevent re-infection:
http://www.javacoolsoftware.com/spywareblaster.html

 

[henry bucket]

SpywareBlaster will prevent re-infection:
http://www.javacoolsoftware.com/spywareblaster.html

Many thanks for all the suggestions. Everything was tried using all the
normal practices i.e. safe mode etc. Nothing worked at all.
Interestingly I managed to get the spybot 'item found:coolweb' window at
the same time as the trend cws showed no instances of coolweb found? was
tempted to send them a screen print.

This is not my first encounter with coolweb just the first time I have
not been able to remove it. While I'm pissed off that the specialised
tools could have no effect I am really, really pissed that avg7 can find
files that it can neither move to vault, heal or delete!

This confirms recent reports that I have read that it is slipping
downwards. I certainly would not be tempted to buy the avg pro edition
so defeating the purpose of making a free version available at all!

In the end I wiped the thing and am now hunting through the mists of
time for very old drivers.#

Once it's reset with firefox,avast, sb etc it'll be reasonably safe...maybe

thanks again

H