coolwwwsearch

[SRotblat]

I constally get IE windows popping open with adds, and I dont even use IE (firefox). They seem to be related to cool

http://wwwsearch,

which netstat -a is saying has two ports with established connections from my bomputer (ports 3680 and 3681). I also seem ahve have 3 other ports which have some IP address listed with established connections. I've tried using Spybot 1.3, Adaware, CWShredder and some others without success to get rid of this

Any ideas???

 

[smah]

Run CWShredder with Windows in Safe Mode. There are some variants of cws that can only be removed in safe mode.

 

[carrr]

AND...if you're running ME or XP, disable system restore BEFORE running any and all removal tools, else you'll simply repopulate on reboot.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[confusedlady]

I was just wondering about disabling system restore a lot. How much harm is done by just leaving it disabled? A lot of my apps are scheduled to run automatically. I'm finally upgrading to XP (still w/ 98) next week, so I thought I'd ask now.

TIA

 

[carrr]

Basically, if you leave system restore OFF, you'll have nothing to restore TO in the event that something critical happens and you need to revert to a previous GOOD install.
Keeping it running is advisable, but disabling it when doing virus/malware cleanup is imperative.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[SRotblat]

I've never used system restore, some may think differnt, but I've yet to have anything serious happen to my machine in in almost 1.5 years (knock on wood ). For me after haiving the install running this long, and with the machine on 24/7 I'd use it as a excuse to do a reinstall.

I'll try the safe mode scan tonight -- thanks

 

[diogenes10]

Since system restore is being discussed here-I dont use XP so I have no way to work with this.

In reading about system restore, I saw that disabling system restore destroys previous restore points. Worrying about backups, and figuring that in a crisis a backup with a virus is better than nothing-Im concerned.

When advising on a hijackthis log & I tell someone to do the following:

Disable system restore
Run HijackThis
etc etc etc
Reboot to safe mode
delete etc etc etc
Reboot, reenable system restore

Am I telling them to destroy backup data and should I be doing something different?

Is there a distinction between restore points and backups that I need to understand here?

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[diogenes10]

In regard to coolsearch, some of the newer ones work off hidden dll's and are not removable with cwshredder
( thread760-851798 ) you'll just have to start the process and see what happens.

Also, if you do use this as an excuse to reformat and reinstall, mirroring the install with Ghost or equivalent is handy for future reinstalls.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[diogenes10]

Starting point for cool

http://wwwsearch

research here.

http://www.spywareinfo.com/~merijn/cwschronicles.html

This and HijackThis will give you some idea of the variant you're dealing with. Searching on specific coolsearch entries from your hijackthis log and checking posts at sites like computercops, wilders, spywareinfo, gladiatorsecurity, and broadband reports will give you ideas about the current fixes being applied to your particular problem.

Also in getting link above I see cwshredder has been updated this week so be sure you're working with current version ( 1.59 ).

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[onrdbandit]

Howdy,

I don't honestly see how system restore serves any really benefitial purpose, especially w/ the resent rise of the spyware terror that is plauging the web nowadays. It seems far more likely that a typical user will be infected with a new spyware/malware/virus and have to destroy their restore points (if they even have any), before they actually have to use their restore points...

That's just me, king of pessimism, talking.

onrdbandit

No! Try not. Do, or do not. There is no try. - Yoda

 

[jrbarnett]

The main point of system restore is to be able to roll back registry settings, DLLs and other major configuration changes if system changes cause problems.

John

 

[smah]

FWIW, Windows System Restore is not a backup of important data. It only works on/with a select group of Windows system files.

http://www.microsoft.com/technet/prodtechnol/winxppro/plan/faqsrwxp.mspx

 

[2ffat]

We really ought to start another thread about this but here's my 00 (two bits) worth. If you really would like to use the restore, only turn it on before you install any software, make major changes, etc. Turn it off otherwise. That way, only the changes you make are caught.

Personally, I've never found this feature useful. If I have to use it, I've personally found it better to do a full restore from a backup.



James P. Cottingham
[sup]
There's no place like 127.0.0.1.
There's no place like 127.0.0.1.
[/sup]