Member Avatar for Greenhills

My 56K connection started to slow down. Ran Netstat -a in XP and found lots of TIME_WAIT refs to coolwwwsearch.com. All were on Local
Port 1026 with Foreign Ports in the range 11xx. I think I managed to shut down port 1026 in my firewall but I still get
listed when I run Netstat -a. Can't make this go away despite latest Spy Sweeper removing "Websearch" and "Cool Web Search". Is this
just some sort of false alarm?

  • 2 Contributors
  • 3 Replies
  • 245 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

Short expert summary and a practical checklist that continues the conversation started by and .

This looks like a classic browser‑hijack case: CoolWebSearch (CoolWWWSearch/CWS) is a long‑running family of browser hijackers that change homepages, inject redirects/ads and can be resilient to a single scan. Security vendors document its behavior and persistence. .

Verify the live symptom before heavy changes. Use TCPView (Sysinternals) to see the real process owning any network endpoints and to close suspicious connections — it shows process names and paths, which netstat alone does not. TCPView (Sysinternals). Use Autoruns to find and disable persistence (Run/RunOnce keys, Browser Helper Objects, AppInit DLLs, Winsock LSPs, scheduled tasks). Autoruns (Sysinternals).

Clean in stages and recheck. Run up‑to‑date scanners (Malwarebytes and a second opinion scanner plus your AV); if a cleaner cannot remove an item in normal mode, a Safe Mode scan can allow deletion of files locked by running processes — then reboot and rescan in normal mode to catch leftovers. Malwarebytes guidance and detections for search‑hijackers. After a successful clean, create a fresh System Restore point and remove old restore points so you do not unknowingly restore infected snapshots. (Windows docs explain creating and managing restore points.)

A final note on netstat/TIME_WAIT: many TIME_WAIT entries are normal TCP behavior and can remain for a few minutes after a connection closes; persistent resolved names tied to an active process are the real red flag. Microsoft: TIME_WAIT explanation.

If trouble continues, save an Autoruns or HijackThis log and post it (process names and file paths are the important clues).

Recommended Answers

All 3 Replies

Member Avatar for Greenhills

I think I've got this sorted.

Thanks for the link to thread5690. I used CWShredder *in safe mode* to remove CWS.Smartsearch. Did a full virus sweep and used Adaware, just to be sure I had a clean system. It's worth mentioning that CWShredder didn't find anything in "normal" Windows mode. It needed Safe Mode to fix the problem.

Netstat -a no longer mentions coolwwwsearch, which is great news.

Cheers :)

Member Avatar for dlh6213

... It needed Safe Mode to fix the problem...

Thanks for reminding folks of that -- If you're running any cleaning progams and they don't seem to be getting 'everything,' try running them in Safe Mode! It's also a good idea to keep all temporary files emptied because some 'intruders' like to hang out in these.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.