Cool Web Search

[Cooter]

On a few occasions when I run my spyware detection program (Scan Spyware) it
complains about a file named 'nsreg.dat' and appears to associate it with
Cool Web Search and/or Market Score, based on its log file:

Pest: CWS - CoolWebSearch
Type: Registry Value
Value:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\quicktime
task
Pest: MarketScore
Type: File
Value: C:\WINDOWS\nsreg.dat

I can delete the file and a subsequent scan shows it is gone. A search on
Google for 'nsreg.dat' shows it as a Netscape profile file. The above
registry key seems to think it is a QuickTime file. I can't find any files
normally associated with Cool Web Scan, nor do I have any known symptoms of
such an infestation.

Can anyone shed some light on this? Any and all help appreciated.

 

[Wesley Vogel]

ScanSpyware is listed @
Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

[[ScanSpyware
scanspyware.net
aggressive advertising (1); false positives work as goad to purchase;
Ad-aware knockoff ]]

Get rid of ScanSpyware .

Download this, install it, run it, update it and run a scan!!!

CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

============

CoolWebSearch info >>
The CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

CoolWebSearch
http://www.doxdesk.com/parasite/CoolWebSearch.html

[[The following web sites have been found in log files of people infected
with this trojan. To our best knowledge, they are all affiliated with
coolwebsearch.com]]
http://www.spywareinfo.com/articles/cws/

 

[Wesley Vogel]

Forgot to add this.

First. Make sure of these settings and nothing will install without you
answering YES. (Except what may install as part of some other software.)
Don't click YES if you don't know/trust the source.

Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]

 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK

 Enable Install On Demand (Other)
Is part of the driveby downloading of unwanted programs. i.e. Scumware or
whatever will install w/o you even being aware of it.
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================

Third.
It is known as scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities. Make sure you update every program, even if you
just downloaded it. You must have the latest updates.

1) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

4) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4a) HijackThis (direct download)
http://aumha.org/downloads/hijackthis.zip

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) Ad-aware
http://www.lavasoft.de/support/download/

===============

Problems uninstalling? Here's some advice.
http://www.kephyr.com/spywarescanner/uninstallproblems.phtml

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp

Cleaning Up XP
http://www.kellys-korner-xp.com/xp_c.htm#cleanup

 

[Cooter]

Thanks for your help Wes. Seems that Scan Spyware is the problem. Prior to
reading your reply I checked to see if nsreg.dat was on my system - it was,
as a 0-byte file. I then ran Ad-Aware, Spybot S & D, SpyRemover and Scan
Spyware. Only Scan Spyware reported a problem - the same one. After reading
your post and following the various links I did a system search on the
various files associated with CWS and found none on my system.

Needless to say, I am dumping Scan Spyware, but will run CWShredder just for
safety. Thanks again for your help.

Cooter

ScanSpyware is listed @
Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

[[ScanSpyware
scanspyware.net
aggressive advertising (1); false positives work as goad to purchase;
Ad-aware knockoff ]]

Get rid of ScanSpyware .

Download this, install it, run it, update it and run a scan!!!

CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

============

CoolWebSearch info >>
The CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

CoolWebSearch
http://www.doxdesk.com/parasite/CoolWebSearch.html

[[The following web sites have been found in log files of people infected
with this trojan. To our best knowledge, they are all affiliated with
coolwebsearch.com]]
http://www.spywareinfo.com/articles/cws/

--
Hope this helps. Let us know.
Wes

In

On a few occasions when I run my spyware detection program (Scan
Spyware) it complains about a file named 'nsreg.dat' and appears to
associate it with Cool Web Search and/or Market Score, based on its
log file:

Pest: CWS - CoolWebSearch
Type: Registry Value
Value:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\quicktime
task
Pest: MarketScore
Type: File
Value: C:\WINDOWS\nsreg.dat

I can delete the file and a subsequent scan shows it is gone. A
search on Google for 'nsreg.dat' shows it as a Netscape profile file.
The above registry key seems to think it is a QuickTime file. I can't
find any files normally associated with Cool Web Scan, nor do I have
any known symptoms of such an infestation.

Can anyone shed some light on this? Any and all help appreciated.

 

[Wesley Vogel]

Cooter.

Did a little Searching on the web...
NSREG.DAT is Netscape Communicator's Registry File.
It should be located in C:\Windows.
Seems to be related to Netscape for Windows 9x.

You really need more than one antiscumware utility,
See my other post in this thread.

Keep having fun!! ;-)

--
Hope this helps. Let us know.
Wes

In

Thanks for your help Wes. Seems that Scan Spyware is the problem.
Prior to reading your reply I checked to see if nsreg.dat was on my
system - it was, as a 0-byte file. I then ran Ad-Aware, Spybot S & D,
SpyRemover and Scan Spyware. Only Scan Spyware reported a problem -
the same one. After reading your post and following the various links
I did a system search on the various files associated with CWS and
found none on my system.

Needless to say, I am dumping Scan Spyware, but will run CWShredder
just for safety. Thanks again for your help.

Cooter

ScanSpyware is listed @
Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

[[ScanSpyware
scanspyware.net
aggressive advertising (1); false positives work as goad to purchase;
Ad-aware knockoff ]]

Get rid of ScanSpyware .

Download this, install it, run it, update it and run a scan!!!

CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

============

CoolWebSearch info >>
The CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

CoolWebSearch
http://www.doxdesk.com/parasite/CoolWebSearch.html

[[The following web sites have been found in log files of people
infected with this trojan. To our best knowledge, they are all
affiliated with coolwebsearch.com]]
http://www.spywareinfo.com/articles/cws/

--
Hope this helps. Let us know.
Wes

In

On a few occasions when I run my spyware detection program (Scan
Spyware) it complains about a file named 'nsreg.dat' and appears to
associate it with Cool Web Search and/or Market Score, based on its
log file:

Pest: CWS - CoolWebSearch
Type: Registry Value
Value:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\quicktime
task
Pest: MarketScore
Type: File
Value: C:\WINDOWS\nsreg.dat

I can delete the file and a subsequent scan shows it is gone. A
search on Google for 'nsreg.dat' shows it as a Netscape profile
file. The above registry key seems to think it is a QuickTime file.
I can't find any files normally associated with Cool Web Scan, nor
do I have any known symptoms of such an infestation.

Can anyone shed some light on this? Any and all help appreciated.

 

[Cooter]

I found the same info on nsreg.dat via Google but forgot to mention it in my
post. The odd thing is that I don't have Netscape installed. At any rate I
am using Ad-Aware and SpyBot S & D and problems seem to have been corrected.
Thanks again.

Cooter.

Did a little Searching on the web...
NSREG.DAT is Netscape Communicator's Registry File.
It should be located in C:\Windows.
Seems to be related to Netscape for Windows 9x.

You really need more than one antiscumware utility,
See my other post in this thread.

Keep having fun!! ;-)

--
Hope this helps. Let us know.
Wes

In

Thanks for your help Wes. Seems that Scan Spyware is the problem.
Prior to reading your reply I checked to see if nsreg.dat was on my
system - it was, as a 0-byte file. I then ran Ad-Aware, Spybot S & D,
SpyRemover and Scan Spyware. Only Scan Spyware reported a problem -
the same one. After reading your post and following the various links
I did a system search on the various files associated with CWS and
found none on my system.

Needless to say, I am dumping Scan Spyware, but will run CWShredder
just for safety. Thanks again for your help.

Cooter

ScanSpyware is listed @
Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

[[ScanSpyware
scanspyware.net
aggressive advertising (1); false positives work as goad to purchase;
Ad-aware knockoff ]]

Get rid of ScanSpyware .

Download this, install it, run it, update it and run a scan!!!

CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

============

CoolWebSearch info >>
The CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

CoolWebSearch
http://www.doxdesk.com/parasite/CoolWebSearch.html

[[The following web sites have been found in log files of people
infected with this trojan. To our best knowledge, they are all
affiliated with coolwebsearch.com]]
http://www.spywareinfo.com/articles/cws/

--
Hope this helps. Let us know.
Wes

In Cooter <[email protected]> hunted and pecked:
On a few occasions when I run my spyware detection program (Scan
Spyware) it complains about a file named 'nsreg.dat' and appears to
associate it with Cool Web Search and/or Market Score, based on its
log file:

Pest: CWS - CoolWebSearch
Type: Registry Value
Value:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\quicktime

task
Pest: MarketScore
Type: File
Value: C:\WINDOWS\nsreg.dat

I can delete the file and a subsequent scan shows it is gone. A
search on Google for 'nsreg.dat' shows it as a Netscape profile
file. The above registry key seems to think it is a QuickTime file.
I can't find any files normally associated with Cool Web Scan, nor
do I have any known symptoms of such an infestation.

Can anyone shed some light on this? Any and all help appreciated.

 

[Wesley Vogel]

You betcha!

--
Hope this helps. Let us know.
Wes

In

I found the same info on nsreg.dat via Google but forgot to mention
it in my post. The odd thing is that I don't have Netscape installed.
At any rate I am using Ad-Aware and SpyBot S & D and problems seem to
have been corrected. Thanks again.

Cooter.

Did a little Searching on the web...
NSREG.DAT is Netscape Communicator's Registry File.
It should be located in C:\Windows.
Seems to be related to Netscape for Windows 9x.

You really need more than one antiscumware utility,
See my other post in this thread.

Keep having fun!! ;-)

--
Hope this helps. Let us know.
Wes

In

Thanks for your help Wes. Seems that Scan Spyware is the problem.
Prior to reading your reply I checked to see if nsreg.dat was on my
system - it was, as a 0-byte file. I then ran Ad-Aware, Spybot S &
D, SpyRemover and Scan Spyware. Only Scan Spyware reported a
problem - the same one. After reading your post and following the
various links I did a system search on the various files associated
with CWS and found none on my system.

Needless to say, I am dumping Scan Spyware, but will run CWShredder
just for safety. Thanks again for your help.

Cooter

ScanSpyware is listed @
Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

[[ScanSpyware
scanspyware.net
aggressive advertising (1); false positives work as goad to
purchase; Ad-aware knockoff ]]

Get rid of ScanSpyware .

Download this, install it, run it, update it and run a scan!!!

CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

============

CoolWebSearch info >>
The CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

CoolWebSearch
http://www.doxdesk.com/parasite/CoolWebSearch.html

[[The following web sites have been found in log files of people
infected with this trojan. To our best knowledge, they are all
affiliated with coolwebsearch.com]]
http://www.spywareinfo.com/articles/cws/

--
Hope this helps. Let us know.
Wes

In Cooter <[email protected]> hunted and pecked:
On a few occasions when I run my spyware detection program (Scan
Spyware) it complains about a file named 'nsreg.dat' and appears
to associate it with Cool Web Search and/or Market Score, based
on its log file:

Pest: CWS - CoolWebSearch
Type: Registry Value
Value:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\quicktime
task
Pest: MarketScore
Type: File
Value: C:\WINDOWS\nsreg.dat

I can delete the file and a subsequent scan shows it is gone. A
search on Google for 'nsreg.dat' shows it as a Netscape profile
file. The above registry key seems to think it is a QuickTime
file. I can't find any files normally associated with Cool Web
Scan, nor do I have any known symptoms of such an infestation.

Can anyone shed some light on this? Any and all help appreciated.