adware problems, cant remove
I've run ad-aware and spy sweeper. I'll delete everything it finds, only to run the programs again to find that its all back. I manually remove the traces in the registry, and they pop back in. My homepage keeps getting set to "about:blank" which isn't the real blank page(full of links), and a popup window opens everytime i open a new browser window with the "about:blank", constantly refreshing until i close it. Win2kpro sp4, IE6, all current updates.
Most common things I find are:
Alexa Toolbar
CoolWebSearch (the main problem)
http://searchx.cc (I think the links from the about page come from here, "Best search engine")
I've tried everything short of a drive format. Even did a windows full recovery. And I just formatted this drive a few days ago due to misc problems. I can't find anything in my startups, and no irregular processes running. But something keeps putting this junk right back into my registry. Any help?
Phaelax
Practically a Posting Shark
858 posts since Mar 2004
Reputation Points: 92
Solved Threads: 51
If you have the latest variant of CWS you may have to reformat. In the meantime try the following.
Download CWShredder from here & run it. Select the fix button & it will get rid of everything related to CoolWebSearch in it's database. Close ALL windows, including IE, before running CWShredder.
To help prevent this from happening again, install the patches for the vulnerabilities that this hijacker exploits by going here for your critical updates.
Download & instal Spybot S&D from here Update it B4 scanning. Go into settings & have it check for Beta releases also & download if available.
After the scan is complete, have spybot fix everything marked RED.
On the page that first opens when you start Spybot there is an option to immunise, you should do this. In the immunise section there is also a link to download Spywareblaster. Download that & you can keep it updated by selecting the same link that you use to download it. Reboot
Download HijackThis from here & unzip it into it's own, permanent folder, (not a temporary folder & not on the desktop). Start HJT & press the scan button. When the scan is finished the scan button will change to save. Save the log to a text file, copy the entire contents of the text file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is harmless & even necessary to the running of your system.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
no good. it all keeps getting reinstalled. And i'm doing this offline too.
Phaelax
Practically a Posting Shark
858 posts since Mar 2004
Reputation Points: 92
Solved Threads: 51
no good. it all keeps getting reinstalled. And i'm doing this offline too.
post a hjthis log
caperjack
I hate 20 Questions
13,069 posts since Aug 2003
Reputation Points: 1,064
Solved Threads: 812
ran the programs in safe mode, and it did the trick. And it must be in safe mode. I would recommend keeping one of these related threads at the top of the list, as it appears several ppl have been having this problem lately.
Phaelax
Practically a Posting Shark
858 posts since Mar 2004
Reputation Points: 92
Solved Threads: 51
