Nasty program deleting my IE browser favorites

[Michael]

I was surfing the internet and it appears one of the web sites planted
some software to run in my IE browser. It deletes all of my
favorites. Even after I add back a few favorites, it will pop up 10
or 15 minutes later and delete them again. After that it will put the
link "http://qwertysearch123.biz/?id=1999" to my favorite. It also
updates my home page to the same URL. I try a few things, such as
emptying out all files and cookies in the temporary internet file
folder, but nothing works. Anyone has any idea of how to remove this
program? Thanks.

Michael

 

[SRB]

Seems similar to the problem I was having. Look at my
previous post and try running the program I mentioned

 

[Jurren Bouman]

I was surfing the internet and it appears one of the web sites planted
some software to run in my IE browser. It deletes all of my
favorites. Even after I add back a few favorites, it will pop up 10
or 15 minutes later and delete them again. After that it will put the
link "http://qwertysearch123.biz/?id=1999" to my favorite. It also
updates my home page to the same URL. I try a few things, such as
emptying out all files and cookies in the temporary internet file
folder, but nothing works. Anyone has any idea of how to remove this
program? Thanks.

Michael

Please see this web site:
http://www.mvps.org/winhelp2002/unwanted.htm

Do an online scan at Panda:
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

 

[Mike Burgess]

Michael,
"qwertysearch123.biz" = coolwebsearch trojan

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-19-03]
Please post replies to this Newsgroup, email address is invalid

 

[Michael]

Michael,
"qwertysearch123.biz" = coolwebsearch trojan

How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.

Thanks for the information. I went to the mvps.org web site and
followed the instructions to remove the Coolwebsearch virus. I also
downloaded Windows security patches from Microsoft. Hopefully this is
the end of it.

 

[Mike Burgess]

Michael,
You're welcome .... glad to see you have things resolved.
_____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-19-03]
Please post replies to this Newsgroup, email address is invalid
--

 

[Michael]

Installing the CWShredder program doesn't remove the virus. This
could be a new variant, as the symptom on my PC is slightly different
from the ones described in the CoolWebSearch Chronicles page. I have
sent an email to the author of the CWShredder program and hopefully he
will look into it.

 

[Mike Burgess]

Michael,
Did you follow-up with Ad-Aware\SpyBot as suggested?
This is something you *must* do, as CWShredder only deals with
certain aspects of the trojan, it is NOT a complete removal tool
in itself. Once you run either Ad-Aware\SpyBot then follow-up
with HijackThis.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-19-03]
Please post replies to this Newsgroup, email address is invalid

 

[Michael]

Did you follow-up with Ad-Aware\SpyBot as suggested?

This is something you *must* do, as CWShredder only deals with
certain aspects of the trojan, it is NOT a complete removal tool
in itself. Once you run either Ad-Aware\SpyBot then follow-up
with HijackThis.

I have tried Ad-aware but it didn't work. At the suggestion of
others, I have posted a couple of HiJackThis logs to the Spywareinfo
forum. Based on the replies so far, it appears there is not going to
be a simple fix, such as running a single program. It's an iterative
process, where I follow the instructions from the forum viewers and
then let them know what I find from my computer. If you are
interested, you can look for the thread titled "can't remove the
CoolWebSearch virus".