Removing Trojan Search Hijacker

Head Boy · 2005-02-18, 05:22 AM

What's the URL of the new home page?

In support of Robbo's comment - the boards are full of people that have been let down by Norton, but in this case it seems that the transport is via ICQ vulnerabilities.

Stever · 2005-02-18, 05:39 AM

Allowed me to blockem. Did a scan and it found a bunch of dialers did the remove but two werent able to be removed by norton but told me path on registry. Deleted it from registry but it came back.
Hunted deeper into registry and found a duplicate copy elsewere. Zapped it and now so far so good. Still need to shut machine down and restart to be sure.

Fingers are crossed.

Cant remember URL now. If it comes back i will post.

Stever · 2005-02-18, 05:59 AM

Shut down machine and its back. Arrrg!!

Why do these guys bother with this kind of shit. How many people actually use their crappy search thing and end up buyin the crap spyware removal stuff there peddling by infecting you with spyware first. The amount of work involved in designing these sysytems to continually get around security systems, adblockers, adn antispyware could be put towards much better ventures. Idiots!!!!

Hope no one on this board is involved in this kind of crap. I have been infected in the past by similar ones i've caught from surfin porn. Keep your sites clean and you will always make more money than by constantly hitting people with popups or viral crap. When surfers encounter this shit they WILL NOT COME BACK AGAIN! as im sure most of you know.

Sorry for the rant.

Chop Smith · 2005-02-18, 06:44 AM

Quote:

Originally Posted by Stever

Hope no one on this board is involved in this kind of crap.

They would be hunted down and have a 55 gallon drum of whoopass unleashed on them.

docholly · 2005-02-18, 07:16 AM

If it's coolwwwsearch or something like it..it is a MF to get rid of. I got hit in Sept from a submitter and it took me until Dec to get rid of it.

Robbo's suggestions are the ones that did it for me. I used Spybot S&D with hijack this. The Spybot forum is very helpful too. If you post your results from hijack this they can tell you exactly what/where its coming from.

Another point is using IE. There is so much crap that is just targeted for it. I use Mozilla/Netscape for everything except a final check of my sites before submitting.

I hear there is a new MyDoom out as well. In the immortal words of Deadwood: Cocksuckers!!!

Good luck with this.

MadMax · 2005-02-18, 12:43 PM

Quote:

Originally Posted by Stever

Allowed me to blockem. Did a scan and it found a bunch of dialers did the remove but two werent able to be removed by norton but told me path on registry. Deleted it from registry but it came back.
Hunted deeper into registry and found a duplicate copy elsewere. Zapped it and now so far so good. Still need to shut machine down and restart to be sure.

Fingers are crossed.

Cant remember URL now. If it comes back i will post.

I've been hit with these before. For the ones Norton can't delete write down the path to the registry entry, reboot in safe mode and delete them manually in safe mode. For whatever reason, those search hijackers respawn if you delete them when windows is in full operation, but since safe mode has only the critical functions operating they're dormant and don't respawn (at least in my experience). HTH

plateman · 2005-02-18, 03:50 PM

Quote:

Originally Posted by MadMax

I've been hit with these before. For the ones Norton can't delete write down the path to the registry entry, reboot in safe mode and delete them manually in safe mode. For whatever reason, those search hijackers respawn if you delete them when windows is in full operation, but since safe mode has only the critical functions operating they're dormant and don't respawn (at least in my experience). HTH

Ditto On what madmax said I was hit with the coolweb thing and tryed everything and read everything and come across the safe mode try and it took it out and I built 3 or 4 pc for others and gave them cw shredder just in case they got it down the road.. I feel your pain and had reformat in in back of my mind while spending all night trying to zap it..

Stever · 2005-02-18, 06:04 PM

I found some more stuff in registry and zapped it. Now its not coming back. But every time i reboot my machine Norton tells me about 1 or 2 viruses it finds. Seems something is still here triggering them. I also must have a dialer cause i get a little window saying dialer failed. Im on a cable connection so the dialer cant find a phone line to get out with.

Was not CoolWebSearch something different. Had CWS before and had to backup all my important stuff then reinstall windows to get rid of it.

Thanks for the input guys n gals

2005-02-18, 05:39 AM	#2
Stever Ahhh ... sweet pity. Where would my love life be without it? Join Date: Feb 2005 Location: British Columbia, Canada Posts: 208	Norton Notified me as they came in thru ICQ Allowed me to blockem. Did a scan and it found a bunch of dialers did the remove but two werent able to be removed by norton but told me path on registry. Deleted it from registry but it came back. Hunted deeper into registry and found a duplicate copy elsewere. Zapped it and now so far so good. Still need to shut machine down and restart to be sure. Fingers are crossed. Cant remember URL now. If it comes back i will post.

2005-02-18, 05:59 AM	#3
Stever Ahhh ... sweet pity. Where would my love life be without it? Join Date: Feb 2005 Location: British Columbia, Canada Posts: 208	Its Back Shut down machine and its back. Arrrg!! Why do these guys bother with this kind of shit. How many people actually use their crappy search thing and end up buyin the crap spyware removal stuff there peddling by infecting you with spyware first. The amount of work involved in designing these sysytems to continually get around security systems, adblockers, adn antispyware could be put towards much better ventures. Idiots!!!! Hope no one on this board is involved in this kind of crap. I have been infected in the past by similar ones i've caught from surfin porn. Keep your sites clean and you will always make more money than by constantly hitting people with popups or viral crap. When surfers encounter this shit they WILL NOT COME BACK AGAIN! as im sure most of you know. Sorry for the rant.

2005-02-18, 07:16 AM	#5
docholly Nothing funnier than the ridiculous faces you people make mid-coitus Join Date: Aug 2003 Location: Sin-City USA Posts: 4,973	If it's coolwwwsearch or something like it..it is a MF to get rid of. I got hit in Sept from a submitter and it took me until Dec to get rid of it. Robbo's suggestions are the ones that did it for me. I used Spybot S&D with hijack this. The Spybot forum is very helpful too. If you post your results from hijack this they can tell you exactly what/where its coming from. Another point is using IE. There is so much crap that is just targeted for it. I use Mozilla/Netscape for everything except a final check of my sites before submitting. I hear there is a new MyDoom out as well. In the immortal words of Deadwood: Cocksuckers!!! Good luck with this. __________________ Support Indie Porn Sites OMGoddess You know you need some Bling!!

2005-02-18, 06:04 PM	#8
Stever Ahhh ... sweet pity. Where would my love life be without it? Join Date: Feb 2005 Location: British Columbia, Canada Posts: 208	Gone now for most part I found some more stuff in registry and zapped it. Now its not coming back. But every time i reboot my machine Norton tells me about 1 or 2 viruses it finds. Seems something is still here triggering them. I also must have a dialer cause i get a little window saying dialer failed. Im on a cable connection so the dialer cant find a phone line to get out with. Was not CoolWebSearch something different. Had CWS before and had to backup all my important stuff then reinstall windows to get rid of it. Thanks for the input guys n gals Last edited by Stever; 2005-02-18 at 06:08 PM..

2005-02-18, 05:22 AM	#1
Head Boy Hello, is this President Clinton? Good! I figured if anyone knew where to get some tang it would be you Join Date: Feb 2005 Location: England Posts: 442	What's the URL of the new home page? In support of Robbo's comment - the boards are full of people that have been let down by Norton, but in this case it seems that the transport is via ICQ vulnerabilities.