|
starting IE, home page is always www.coolsearch.co |
Post a Reply |
From: john on 10/01/2003
My equipment: P2-350 with XP Pro+SP1 with IE 6.0+SP1 etc.
For approx 1 week now, everytime I start IE my homepage is www.coolsearch.com/%%%%etc, etc.
I go to my ISP home page, then goto internet Tools and change my default site and apply and OK!
next time I start up, same problem.
Can anyone please suggest a fix?Thanks very much! john
| |
Votes:
Rating: 0
Delete: 0
|
|
--- Replies to this Problem ---
From: Michelle on 03/16/2006
What I want to know is this, if you are usually really careful and dont go to porn sites etc ... how can you still get a browser hijacker that redirects you to porn sites?
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Arun on 06/24/2004
For this problem, go to Add/Remove and remove any kind of searchbar or toolbar.
download and run the "spybot search and destroy 1.3" from www.download.com....Install and Run it
Go to Download.com again and download the "Hijackthis" software which is the fix for this hijack situation
I'm sure it is going to work
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Michael on 06/23/2004
Fixed this problem by running "Spybot" to remove spyware, and "CWshredder" to remobe coolsearch in particular.
Very easy, no skill required,but do note Spybots cautions and tips!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Christy on 06/22/2004
CoolwwwSearch has added some additional annoying features.
When Spybot fails to fix the problem, even though you have immunized the system:1. Go to tools, internet options, security and click on default--then slide the bar up one better. (while you are there add coolwwwsearch.com and www.lookfor.cc as a restricted site) Change the default page to "use blank". Go ahead and delete the files while you are there. 2. Use the task manager (ctrl alt Del, Task Manager) to end the iebk32.exe process, but this is more effective when you reboot into safe mode first. (reboot then hit the f8 key as it is coming up and pick safe mode 3. Search for vhzcy.dll and sdkbf.dll and delete those files (they usually put them under c:\winnt or c:\windows (if your worried about deleting the files, make a backup first. 4. Run regedit and look for 27859 (some use other numbers, but this was the latest) and delete those entries. (don't do this unless you know what you are doing) (It would be better to be sure what number it is using. Use http://www.spywareinfo.com/downloads.php?cat=sp#det to download hijackthis and scan your computer for free. When it finishes remove any of the entries that have 27859 in them. (or any numbers that show up for the internet explorer). 5. OR Do the easy way and just install the new microsoft toolbar from http://toolbar.msn.com/ and their annoying script will wipe out coolsearch's annoying script!!! (but it is best if you go ahead and get rid of the bad files) Have a great day.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Gonza(Peru) on 05/28/2004
I am from peru, I Got that virus the last week, i reset my pc because i was looking for all the antivirus- but no one helped me!!!1
| |
Votes:
Rating: 0
Delete: 0
|
|
From: psant on 05/16/2004
Since they are using a program to change our registry entries, it would be nice to back trac this and sick every known hacker out to destroy their stinking invasion crap. I would like to see them pay for doing this.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: coolKiller on 05/14/2004
the program is called REG33.EXE or REG32.EXE Runs when rebooting your computer. GOTO http://www.mlin.net/ and under software links download
Mike Lins Start Up control panal program. FIND REG33.exe, right click your mouse, choose delete, ITS GONE. the program is FREE and a tip to Mike is a good jesture.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Chris on 05/08/2004
HI there. I had the same problem and, after hours of searching i came across a program that someone has developed just to combat the annoying coolsearch search engine. Goto www.Merijn.org and download a small program called "CW Shredder". It should download really quickly. Go through the motions the program asks for than check your internet options to see if coolsearch has gone. If it is still there replace it with your preffered search engine and bobs your uncle. Hope it works as well for you as it did for me! Chris
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Abye - London on 04/29/2004
I agree that there must be a class action against Coolsearch and it must be soon before they disappear or go behind any legal cover. They are laughing at all this and enjoying at web users temporary helplessnes. They must be punished and us all should cause to make law to clamp down such scums for future.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: FawkCoolSearch on 04/16/2004
I came home today to find out that my pc has been infected by this ( crap ). I'm not too worried about these guys. They'll definetly get what coming to them. =) As for fixing the problem.. all i did was use spybot and it's gone. I've restarted my pc a couple of times and it no longer comes up.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Tomas on 04/11/2004
As it was mentioned below, I did have a same problem with SpyBot1.2, i.e., it would not be able to cure the computer of this virus anyway, enven after downloading all the updates. So I tried CWShredder and it worked perfectly. You would see that the next time you start your IE it would go to coolsearch.com, but this would be their last time. From then on I receive nice and clean About: Blank! :) This time shredder did it, but I will nonetheless keep both programs, SpyBot "fished-out" some 188 problems!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Jason on 04/06/2004
I think I finally killed it!I love spybot but in this case it failed me and yes I have the most recent updates occording to the web the most recent update for spybot included the coolsearch antidote but coolsearch has stayed a step ahead with a varient blah blah blah so what did I do to fix it? Well I'm lucky enough to have WinXP and I just did a system restore to 3 days before I contrated this lovely new bug. Instant happiness! I would also reccommend as a procaution deleting all cookies temp internet files and history and reseting the home page back to google (or whatever you use) before the system restore so you don't reinfect yourself. As a further procaution I would update my virus protection software and use the imunize feature on spybot e-ya later
browsen@aol.com
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Himax on 03/30/2004
You can block the changing of home page from spybot search and rescues immunize feature but if you are using any other IE varient like Avant Browser it will not work.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Nightowl on 03/01/2004
Thanks, Teddy and Markinthedark for the name of the scumbag company that puts out Coolsearch and their phone number. It's been fun calling them. Told them since they wasted so much of my time, it's time for me to waste some of their time. CWShredder works for me, too.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: John on 02/23/2004
Check out the Russian bad people, Commies!!!
This domain is NOT Available
Enter another domain to check.
www. .com.info.us.net.org.biz.ws.tv.cc.de.jp.be.at.co.uk.me.uk.org.uk.co.nz.net.nz.org.nz
The data contained in Go Daddy Software, Inc.'s WHOIS database,while believed by the company to be reliable, is provided "as is"with no guarantee or warranties regarding its accuracy. Thisinformation is provided for the sole purpose of assisting youin obtaining information about domain name registration records.Any use of this data for any other purpose is expressly forbidden without the prior writtenpermission of Go Daddy Software, Inc. By submitting an inquiry,you agree to these terms of usage and limitations of warranty. In particular,you agree not to use this data to allow, enable, or otherwise make possible,dissemination or collection of this data, in part or in its entirety, for anypurpose, such as the transmission of unsolicited advertising andand solicitations of any kind, including spam. You further agreenot to use this data to enable high volume, automated or robotic electronicprocesses designed to collect or compile this data for any purpose,including mining this data for your own personal or commercial purposes. Please note: the registrant of the domain name is specifiedin the "registrant" field. In most cases, Go Daddy Software, Inc. is not the registrant of domain names listed in this database.Registrant: TROODEIISP Vvedensky 7 St-Petersburg, St-Petersburg Region 190013 Russian Federation Registered through: GoDaddy.com (http://www.godaddy.com) Domain Name: COOLSEARCH.COM Created on: 05-Aug-97 Expires on: 04-Aug-05 Last Updated on: 16-Jan-04 Administrative Contact: Dimasov, Dimas dimas@mail.ru TROODEIISP Vvedensky 7 St-Petersburg, St-Petersburg Region 190013 Russian Federation 8123261780 Technical Contact: Dimasov, Dimas dimas@mail.ru TROODEIISP Vvedensky 7 St-Petersburg, St-Petersburg Region 190013 Russian Federation 8123261780 Domain servers in listed order: PARK9.SECURESERVER.NET PARK10.SECURESERVER.NET
| |
Votes:
Rating: 0
Delete: 0
|
|
From: John on 02/23/2004
SPYWARE! LOL! Download Spybot Search and Distroy, run the program, and it will rid you of the evil vermin. And stay away from yuppie slime sites! Haaaa Haaaaa!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Brett on 02/22/2004
Anyone know how to fix this problem, but don't tell me to go use someone else's program. Everywhere I look for this problem people keep singing praises of CWshredder. I'm beginning to wonder if the authors are the same people who have hijacked my browser, and if that's the case I won't use their tool. I'm looking for someone who can give me a definitive answer as to what files or registry entries I have to get rid of to stop this hi-jacker. Thanks.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Friend on 01/11/2004
Yes...Gone....Hahahahaha
Go there...It really worked
http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Teddy on 01/08/2004
Yet another testimonial for CWShredder. It knocked those cheeseballs right outta my life....for now. Shredder also teaches you how to avoid future infections. HEY EVERYONE be sure to call 1-212-378-4108 for this is the phone number of the slime marketing company who does this crap. Have fun!!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Markinthedark on 01/05/2004
I too have been a victim of this scum bag web site. Spybot took care of it for me. I thought y'all might like to know who is behind this. Here ya go give em hellcoolsearch.com
Registrant:
Data Art Corp. (COOLSEARCH-DOM)
475 Park Ave South, 9th floor
New York, NY 10016 Domain Name: COOLSEARCH.COM Administrative Contact, Technical Contact:
DataArt Enterprises, Inc. (DA23199-OR) dnsmaster@DATAART.COM
475 PARK AVE S FL 9
NEW YORK, NY 10016-6901
US
(212)378-4108 fax: (212)376-6782
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Marc on 01/03/2004
It seems very difficult to get rid of COOLSEARCH but there is something that you can do.What I did is simple to correct the situation. 1. Log onto the homepage that you would like to see. 2. Right clickon it and choose " create shortcut". 3.Once you have the ICON on your dessktop delete your old ICON. This won't get coolsearch out of your computer but it will get rid of your frustration. If there is ever a class action suite against COOSEASRCH count me in. They have got alot of nerve to do what they are doing.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Peter on 01/03/2004
Yes, CWShredder clears coolsearch with the power of a petard up coolsearch's proverbial. Thank you to cwshredder\s creator.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Peter on 01/02/2004
Go to http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredderIt did the trick for me! I hope that the developers of this sick trash will get a nasty illness. I really do! Good luck!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Ray on 01/02/2004
The coolsearch.com people are scum suckers that should be eliminated from the face of the Earth. I just finished having the same problem corrected and now these assholes have infected my system. I wouldn't buy shit from any site these idiots guide me to. Sorry cyber-bros!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Mike on 01/01/2004
I too have encountered the same problem. When scanning through the files contained in regedit, I found the cool search files to be in HKEY_LOCAL_MACHINE. I continued browsing the other files and found more with similar number strings. They appear to be distinctly different from valid files. Is it safe to delete all of these files? Does anyone know if reputable software uses filenames like these?Thanks, Mike
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Vincent on 01/01/2004
ttp://www.spywareinfo.com/~merijn/files/cwshredder.zip
was a good solution, don't search further.I also like regcleaner where you can see and control the programs that run when windows starts up. For such problems it's often best to remove the program from the startup list, then remove the website from the windows register and then restart (make sure the irritating virus is not running, because then it will insert the irritanting web site again before you restart)
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Tim on 01/01/2004
Go in the regedit to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
and remove the line containing: windows\update911.js.
Now look at your windows folder and delete the file update911.js.The Problem is away now. Good luck
Tim P.S.: If you open the file with an editor you will see why no programm can find this. (if you know a little bit js)
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Sat on 12/30/2003
Hi, I have the same problem, well actually it's called track.cc and tracked back to cool search. I am wondering if I can sue this company
for invasion, I wasted about one week of my time tracking that trash down, If there are any attoneys out there that can, put those guys of of business, let me know.I am Tried of this Trash.
Sat.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Javier on 12/27/2003
I found Spybot Search and Destroy v1.2 finds registry entries from hijacker programs like Coolsearch, and can delete them. You also need to check for recently created files in your WINDOWS\SYSTEM directory. One file which was placed in my startup list without my knowledge is called CTRLPAN.DLL, which was created after a coolsearch variant took over my homepage. I renamed the new .DLL to .DLX, and moved it to a special holding folder rather than delete it (just in case I am wrong).Spybot Search and Destroy also has an option in the first category (Search and Destroy, Recovery, Immunize), under the Immunize portion. At the bottom of that window, there are three checkboxes. One of these boxes allows you to lock your homepage against any changes. Be careful, since it also keeps anyone from accessing the "Internet Options" while using your browser. You have to undo the lockout from Spybot S&D's "Immunize" window to regain access. You can still make changes to other options by right clicking the IE icon on your desktop, and choosing "properties". However, your homepage will remain locked even then, until Spybot is used to unlock it. I hope this helps.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: George on 12/19/2003
I had the same problem and downloaded the CWShredder. You can read about the issue and download a fix at the following website:http://www.spywareinfo.com/~merijn/cwschronicles.html Good Luck!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Fernando on 12/08/2003
look for a file called sys.reg. That file has all the registry entries related to coolsearch, including the one that makes windows to reload the entries even if you delete them. Just go to the registry and delete every entry noted on the sys.reg file, specially the last one.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Melanie on 11/26/2003
Sounds like Rapid Blaster to me. Try searching the web for that. I have found RBKILLER.EXE sometimes works or an adware killer called hijackthis but that one requires you to understand what should and should not be in your registry.
| |
Votes:
Rating: 0
Delete: 0
|
|
From: Mark on 11/11/2003
This is a nasty implementation of a add in explorer tool bar (similar to a yahoo bar or a google bar - not a mars bar).To delete this problem you will have to open regedit (start - run - regedit) if you are new to it be carefull as you can kill your computer. Browse to the following key (folder) my computer\hkey_users\(long number string here)\software\microsoft\internet explorer\explorer bars. You will see some folders with long numbers - look for the cool-search stuff in one of these and delete the explorer bar folder with the number (deletes cool-search bar). Another method is to go to find and paste cool-search and this will take you to the same key. Good luck!
| |
Votes:
Rating: 0
Delete: 0
|
|
From: denny on 11/09/2003
I have the same problem, can you please email me
the solution you found?
email: webDennis@mail.comon one hand you said you solved it, but at your
last line you said the coolSearch is still there.
So did you solve it or not?
-------------------------------
Your message: In addition, I've just corrected the promulgate problem on my system.
I have run updated antivirus killer, msblast remover and w32.welchia remover.
coolsearch is still there. --------------------------
Thanks
email: webDennis@mail.com
| |
Votes:
Rating: 0
Delete: 0
|
|
From: john on 10/02/2003
Just wanted to say the problem is gone. I ran ad-aware and spy-bot, and this problem disappeared.thanks to all, anyway
| |
Votes:
Rating: 0
Delete: 0
|
|
From: john on 10/01/2003
In addition, I've just corrected the promulgate problem on my system.
I have run updated antivirus killer, msblast remover and w32.welchia remover.coolsearch is still there. thanks
| |
Votes:
Rating: 0
Delete: 0
|
|
|
