CoolWebSearch is a very tenacious hijack program that has gone through a lot of changes since it was first released. Each change is designed to make it harder to detect and remove, and the more recent versions have a backup system to keep you from deleting it completely. Some of the variants even use methods of hiding and running themselves that have never been used before in any other spyware.
CWS uses two different processes that look for each other. If one process is stopped, the other one restarts it. Since it is also set up to load only when Internet Explorer is started, it is very hard to find the program in the 'usual' places (using msconfig.exe, regedit.exe, etc.) in order to remove it.
Fortunately, there is a fix for this problem; CWShredder is available from SpywareInfo.com at http://www.spywareinfo.com/~merijn/downloads.html. (If you can't get to the site that way, try http://216.180.233.153/~merijn/downloads.html. Some CWS variants block the DNS for SpywareInfo). There are a couple of download formats available - as a zip file or an executable, and there is a link for the Microsoft VB6 runtime files if you need to install them (they are required to run the program, but chances are good that you already have them on your system).
The author of CWShredder did not write the CWS hijack program. He even includes the following on the site:
I did not create the Coolwebsearch trojan, nor did I hijack your homepage.
It seems some sleazebags over at CWS think it's funny to redirect all complaints about their trojan to me. To get your homepage back, get my CWShredder. You have my word it will cure your computer and not install more junk.
As someone who has used CWShredder on several computers, I highly recommend it to you if you have a hijacked home page, lots of new bookmarks added to your Favorites list, a problem with search engines being redirected to other search sites, and a host of other IE problems. But to prevent reinfection, you will need to get rid of the Microsoft Java Virtual Machine (MSJVM), which is being exploited by the CWS program.
Microsoft will drop support for MSJVM as of September, 2004 , so it is a security risk just waiting for an exploit to hit it. You can uninstall MSJVM by following the directions at http://www.windows-help.net/WindowsXP/howto-21.html. After you have uninstalled the MS version, you will need to install the Sun Java software to replace MSJVM, and a free and painless download is available from http://www.java.com/en/index.jsp.
If the uninstall does not work, or the entries mentioned are not there, you can install the Sun Java and then cekck to see that it is the default for Internet Explorer. Directions for this are on the Java setup page.
Even if you do not have problems with hijacked homepages, et al, you should uninstall the Microsoft version and install the Sun Java software. A Meg of prevention is worth a Gig of cure!
Thanks to Support Alert Newsletter
http://www.techsupportalert.com for information on this answer!
You have a browser hijacker on your system. This kind of hijacker has changed all of your search options so that you only get to see the search results it wants you to see. Get a Spyware Removal program to correct this.
Checking with your ISP is not a bad idea, just to make sure that your settings are correct. But sporadic page loading indicates that your Internet Settings are fine - something is keeping you from getting to the pages. Chances are good that there are programs trying to connect to other sites without you being aware of it, and they are using up your bandwidth (Internet connection speed).
A Firewall can help prevent these programs from getting Internet access since it will alert you to their existence. But if these programs are are integrated with your Internet Browser, you will need to track them down and get rid of them.
If the popups have a blue title bar and a grey body like a Windows message, then you need to turn off the Messenger Service to stop them. An explanation of this service, and how to disable it, is found here.
There could be a number of things happening here, and the best way to figure out what is slowing things down is to try a two-step approach.
On a blank spot on the Task Bar (that bar at the bottom of your screen) right click to get a popup menu, and left click on Task Manager.
Click on the Processes Tab and then click on the column heading Image Name to sort the list alphabetically. You should see something like this:
There are a lot of processes (programs) running on your PC, and the number of them is not as important as what they are. Go to answersthatwork.com and click on the Task List icon. There is an alphabetical listing of the processes you may find running on your computer. Look at what you have running in Task Manager, and compare that to the list they provide. The descriptions and explanations are very good, and there may be some processes you do not need to run. Pacman's Portal is another resource to use to find any programs that you don't want or need running at startup.
If you have ended the processes, or if the Answers That Work website indicates that you have some nasties installed and running without your knowledge, get SpyBot Search and Destroy and get rid of it (them).
You probably have a Spyware program on your computer. Even tough you are not actively surfing the Net, you are using an 'always on' connection that allows the popups to come to you even when you are not doing anything Internet related.
Get a Spyware Removal Program and run it - you might be suprised at the number of nasties it catches!
You have a Dialer program on your PC. Lucky You!
The purpose of these programs is to call long distance numbers (usually 900 numbers) so that the program's author can get the proceeds while you get stuck with the bill. There are a couple of things you can do to prevent this from happening.
Viruses can be disguised as official-looking messages that claim to have an important security patch. Microsoft never sends patches to users. The only safe way to get a Microsoft patch is from the Microsoft Windows Update web site. Don't be tricked into infecting your own system by these "social engineering" tactics!
