I spent 4 hours last night trying to remove CoolWebSearch from a friend’s roomate’s computer and eventually had give up and go home and sleep. This Evil program installs its self by taking advantage of one of the many IE/Windows security flaws.
This PC did not have windows update running so it had all of the exploits available. I first installed the updates, there were 18 of them, and then preceded to try and remove the CoolWebSearch. I tried cwShredder which had worked for me on my Father-In-Law’s PC but no luck this time. CoolWebSearch had installed a keylogger and about every kind of porn dialer, favorite, and spyware. After many many many runs of Spybot Search and Destroy and manual attempts I was unable to fully remove all of the many instances of this. It works its evil by making multiple copies of its self to make sure that if you don’t get all 20+ copies one of the remaining .exe or .bat files will reinstall. You can tell you have this many ways but in this case the homepage was set to about:blank and every time you browsed with IE it opened up a different pop-up window or search page etc. Also they had a keylogger which was recording their passwords etc. I had them change them right away (but not with that pc of course). Anyways this PC was so infected that the best route will be to wipe the PC and reinstall the OS etc.
Moral of the story: ENABLE AUTOMATIC WINDOWS UPDATE to protect your pc. Spyware is not only annoying but it can ruin your life and credit by transmitting all of your personal information and passwords through a backdoor to anyone who knows where to look. Also to protect yourself even further, throw away IE and Outlook and browse with Firefox and check your mail with Thunderbird.
Good luck out there!
