Cool Web Search - Spyware

[RaGe]

Gday all,

A friend contacted me yesterday explaining that his Internet Explorer had been hijacked after one of his flatmates visited a website and sadly clicked YES when prompted by a popup window. His computer is now over-run with "search portal hijack" and "coolwebsearch".

What does this do?

Basically it hijacks your internet explorer so that the cool web search portal becomes your homepage. You can change your homepage, and coolwebsearch will change it back.

Also it launches Internet Explorer on start-up to run iexplore.exe in the background regardless of wether you have an internet explorer window open or not. You can kill iexplore.exe through your task manager and it will restart itself so that as soon as you kill the process, another iexplore.exe appears in the task manager processes window, scant seconds later.

Spyware removal software will detect and remove both coolwebsearch and search portal hijack, but if you run another scan straight after removing them, one or both will have returned immediately.

You can remove all traces of Internet Explorer in the registry, and coolwebsearch will reinstate it scant seconds after you remove it.

Has anyone else encountered this hijacking software? If so how did you remove it SAFELY from the system?

I am aware of a program called CWSshredder which supposedly removes it, but I'm interested in other opinions before implementing that option...

cheers

[susieq]

RaGe, unsure if you'll see this post.....I hope so:)

Your picture of Shallow Crossing, is something else!!!!

We have a section here on site       http://forum.weblamp.net/index.php?topic=2371.0 that would really appreciate your picture of Shallow Crossing, actually I have been there a few times, having lived in Batemans Bay area for four years...BTW do you have any pictures of Runnyford?  which was acquired by a local well-known business man.

[RaGe]

Hehehe thanks Susieq, Shallow Crossing is amazing, its not so much the photographer, as the scenery that makes the shot good. I'm amateur at best.

It was my first time there, we had the camping ground at the far end, and it was packed. We stayed around 5 days. We did spend a few mornings visiting Batemans Bay to pick up supplies (the tackle shop for bait, supermarket etc) and wander around. Very lovely.

We didn;t go to Runnsford wheres that?

Pebbly beach was amazing though... tucked away in the bottom of that national park. exquisite. I'm jealous that you lived (lived) in that area. I live in Hornsby near Sydney, and I want to be away from this city its too full-on.

As for the photos, I have promised Denis I would post some, I just need the time to sort through and do it. Give me a few days I've got some very important clients I have to present web designs to, but sometime next week I should be ready to drop some photos on here hehehe

 

[susieq]

Hello RaGe,
The subject you mentioned  above (spyware)  is scary, especialy when you  say how hard it is to get rid of it.....So for otheres, do be extremely careful, when pop-ups are on screen.  Hope this would soon be solved for you, and someone will come up with solution......maybe Islanding (webmaster@mtrcom.net)??

Living now in Richmond, Sydney, but there's no-where quite like the Bay is there?

[Hope]

Everyone needs to read the boxes that pop-up. Some of this lovely scumware is doing some tricky wording now. They are starting to word it so that if you click "no" it installs and if you click "yes" it doesn't. Read carefully or you might get crap on your machine.

[susieq]

Hope, thankyou for this 

Some of this lovely scumware is doing some tricky wording now. They are starting to word it so that if you click "no" it installs and if you click "yes" it doesn't

Those few wise words, I'm sure will help newbies and maybe some others who are totally un-aware of the trickery going on here.
Thankyou

[susieq]

Found this, re-iterating that, which already has been said

US cracks down on spyware
Correspondents in Washington
OCTOBER 14, 2004 
 
THE US government has moved for the first time to block unsolicited circulation on the internet of spyware.

Spyware refers to a type of software that can inundate web users with pop-up ads, secretly take control of their computers and spy on their online activities.
The Federal Trade Commission announced here today that it had used existing fair trade laws in asking a federal court to shut down some of the leading distributors of this cyberspace tool.

"Consumers dont deserve to be pestered and spied on by people who illegally hijack their computers,' said the acting director of the FTCs Bureau of Consumer Protection Lydia Parnes. "Were putting purveyors of spyware on notice: This is our first spyware case, but it won't be our last."

According to legal experts, there is no guarantee the trade legislation would be enough to clean the internet of the scourge of spyware that experts say may cause computers to malfunction, slow down, or even crash.

But US officials are said to be emboldened by recent advances of anti-spyware legislation in congress and the growing consumer sentiment in favour of curbing the practice.

The complaint targets Seismic Entertainment Productions and Smartbot.Net, as well as the man behind them: Sanford Wallace.

Court documents allege the defendants have operated web sites that distribute spyware since last December, using a variety of tricks to direct consumers to them.

A contact with these sites usually resulted in spyware being sneaked into personal computers unbeknownst of their owners, the complaint said.

The spyware changed people's home pages, search engines, exposed them to an avalanche of pop-up ads and caused their computers to slow down or crash, resulting in a loss of data.

To add insult to injury, the companies then offered to fix the problem by selling affected consumers anti-spyware packages manufactured by another company for about $US30 ($41) a pop, officials said.

The spyware gurus benefited by receiving a commission for each sale, the government alleged.

The commission charged the spyware providers engaged in unfair trade practices by downloading their product onto private computers without authorisation, causing serious harm, and then forcing consumers to pay to fix it.

Agence France-Presse

http://australianit.news.com.au/articles/0,7204,11061597%5E15318%5E%5Enbv%5E15306,00.html

Found it in the local (Aussie IT) news

[Hope]

The problem with this idea of the US Feds trying to clean up the spyware is that people willingly install it. They want the "freeware" that has bundled it, so they install it willingly. They agree to the terms and conditions of installing. People are prompted to install the software when they go to some sites and people allow it to be installed. If someone willingly installs the software, then there is little the courts will do. Gator is a prime example of this. They have won several cases based on the willingness of people to install the product.

Until people become educated on this subject, there will be spyware companies. It is the same with virus, they will be a problem until people learn. There is little that can be done about it except education.

[susieq]

Yes, Hope when people can see it through proper perspective, it is definite eye-opener! Having mentioned Gator, reminded of these posts    http://forum.weblamp.net/index.php?topic=121.0     which I found quite interesting to browse through, again, from another perspective.....but all encompassing pop-ups

[Hope]

The gator lawsuites were based off of lost revenue because of the gator popups. These were produced from the software that people "willingly" installed. It is a shame that people don't understand the nature of these programs before they install them. So many of these programs are nearly impossible to remove once they are installed. I have had to go into the regestry of more than one computer to completely remove the crap from a machine  completely.