COOLWEBSEARCH

Originated in July, 2003, the CoolWebSearch Spyware tops the list of the most menacing spyware applications and for very good reasons. It's clot factor is said to be at CoolWebSearch: 3. and it is said to be highly intricate, complicated, and deceitful browser hijackers of all. It is actually a group of vicious and various spyware applications. It launches a new variant every other week and they are firstly, difficult to detect and secondly, impossible to uninstall. Only a sophisticated anti-spyware application can be effective at the most.

These are some of the most effective variants of this application: CoolWebSearch/ DataNotary that hijacks the browser to dataNotary.com. it registers the web surfing habit of the user with an eye for adult site. CoolWebSearch/ BootConf also hijacks the browser and installs a bug file called bootconf.exe. CoolWebSearch/ MSInfo bears a similar function as the previous one. The only difference is that it tends to point at true-counter.com. CoolWebSearch/ SvcHost tend to block all reputed search engines and point the user towards slawsearch.com. Whereas, CoolWebSearch/ DNSRelay "hijacks URLs that have been typed without a leading "http://" or "www" to activexupdate.com."

This application is also present under the name Win32.Alureon.B [Computer Associates], Win32/Alureon.B! DLL! Trojan. Other associates of this group of CoolWebSearch.com are CWS, CWS.Aboutblank, CWS.AddClass, CWS.AFF.IEDLL, CWS.AFF.MadFinder, CWS.AFF.ToonComics, CWS.AFF.WinShow, CWS.AlFaSearch, CWS.AlFaSearch.2, CWS.Bootconf, CWS.CameUp, CWS.Control, CWS.Cpan, CWS.Ctfmon32, CWS.Ctrlpan, CWS.DataNotary, CWS.DNSE, CWS.DNSErr, CWS.DNSRelay, CWS.DReplace, CWS.Dwinf, CWS.EHTTP, CWS.Excel10, CWS.Explorer32, CWS.Feads, CWS.GonnaSearch, CWS.GoogleMS, CWS.GoogleMS.2, CWS.GoogleMS.3, CWS.IEFeats, CWS.IEFeats3, CWS.IEFeatsIUpdate, CWS.Image, CWS.Keymgrldr, CWS.Ld, CWS.LoadBAT, CWS.MadFinder, CWS.MSConfd, CWS.MSConfd.2, CWS.MSConfig, CWS.MSInfo, CWS.MSOffice, CWS.MSSearch, CWS.Msspi, CWS.MSTaskm, CWS.MSUpdate, CWS.MSUpdater, CWS.MSwsc10, CWS.MTwirl32, CWS.MUpdate, CWS.Notepad32, CWS.OEMSysPNP, CWS.OleHelp, CWS.OSLogo, CWS.QTTasks, CWS.Quicken, CWS.Rank, CWS.SmartFinder, CWS.SmartSearch, CWS.SoundMX, CWS.Svchost32, CWS.Svcinit, CWS.Sys, CWS.TapiCFG, CWS.TheRealSearch, CWS.Time, CWS.Vrape, CWS.Winproc32, CWS.Winres, CWS.XMLMimeFilter, CWS.XPlugin, CWS.XPSystem, CWS.XXXVideo, CWS.Yexe, DataNotary, RightFinder, 

The common symptoms of CoolWebSearch Spyware includes hijacking of browser, it redirects to an affiliated to this application. It is also responsible of including pornographic sites in the favorite menu. It also inserts a new and unwanted toolbar into the browser. And as a side effect it would slow down your computer causing frequent reboot. They also block access to web sites that deal in anti-spyware applications there-by prevent the user from downloading anti-spyware applications. CoolWebSearch Spyware even directs the user to pornographic sites and it will always stick to a few enlisted sites.

This application is known to endeavor almost 561kb space of the hard disk.

Follow these steps to remove CoolWebSearch from your machine: 

Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

First, to kill the running process use desktopdir+\tbar.exe with taskbar, then you have to un-register the DLLs systemroot+\msew\mssearch.dll, systemroot+\msew\msew32.dll, desktopdir+\asd3.dll, msz{.dll, systemroot+\system32\msqsb.dll, msspi.dll, systemroot+\msew\msiesh.dll, systemroot+\image.dll, systemroot+\system32\seqsb.dll with Regsvr32, before  rebooting.

Also you have to remove the registry item HKEY_CURRENT_USER\software\microsoft\internet explorer\urlsearchhooks\_{cfbfae00-17a6-11d0-99cb-00c04fd64497}.

Lastly, to complete the process you must delete these files
avp32.exe-1432e758.pf
avpupd.exe-009f51bf.pf
cws.txt
desktopdir+\asd3.dll
desktopdir+\tbar.exe
favorites+\!!! exclusive youngest porn !!!.url
favorites+\~ fully categories porn database. enjoy!.url
favorites+\~ new porn pics everyday.url
favorites+\censored youngest porn.url
favorites+\free hidden cams world.url
favorites+\free spy cam.url
favorites+\free web cams chats.url
favorites+\free xxx pics & movies.url
favorites+\fresh xxx pics & movie.url
favorites+\get this 4 free.url
favorites+\super xxx pics.url
favorites+\young masha sucking huge dick until her lips teared open.url
giantantispywaremain.exe-0f089a5a.pf
inst_debug.log
mergecalic.exe-1c19a61e.pf
msspi.dll
msz{.dll
sunasservalert.exe-0421e014.pf
systemroot+\image.dll
systemroot+\msew\msew32.dll
systemroot+\msew\msiesh.dll
systemroot+\msew\mssearch.dll
systemroot+\system32\msqsb.dll
systemroot+\system32\seqsb.dll
tbar.exe-0d36889e.pf with windows explorer. Now, there is a chance your computer system is safe enough for the time being.