# How to Stop Browser Hijacks by CoolWebSearch **URL:** \ **Category:** Factual Questions\ **Created:** [June 27, 2004, 7:41pm UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432 "2004-06-27T19:41:34Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [June 30, 2004, 3:08am UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/21 "2004-06-30T03:08:59Z")
> [@Algernon](#): > > A followup question: If I were to switch to Firefox immediately, would the problem be “fixed”? No, once you are infected, changing browsers will **not** fix the problems you are having; changing browsers will only prevent infection, not cure it. You are the lucky recipient of a new generation of CWS variants that **cannot** be removed with HijackThis or CWShredder alone. In fact, Merijn (the guy that wrote CWShredder) has thrown in the towel and will not be updating that tool any longer, in part due to the virulent nature of the new CWS variants: [http://www.spywareinfo.com/~merijn/](http://www.spywareinfo.com/~merijn/) > [@](#): > > **Q. CWShredder isn’t fixing my problem!** > > \*\*A. \*\* While it’s been easy and even fun keeping CWShredder up to date, the recent variants are a living hell. The people who wrote the latest variants of the trojan surpass the older variants by far. > > - Resident DLLs from the about:blank, res://xxxx.dll or invisible variants cannot be removed by CWShredder or HijackThis. > > - Variants like f0r0r that are protected by Hacker Defender cannot be removed by CWShredder or HijackThis. > \*\* > Q. When will CWShredder be updated again?\*\* > **A.** It won’t be again, probably. I have a few bugs to fix, but after that there’s not much left to do - I simply do not have the tools to remove the latest variants, they are too agressive or complicated to allow automated removal by CWShredder. The procedure to remove this variant is complicated, and you would have the best results if you posted your HJT log over at the [forums at SpywareInfo](http://forums.spywareinfo.com/index.php?showforum=18). They have posted a procedure for removing this variant [in this thread](http://forums.spywareinfo.com/index.php?showtopic=8847), but people are having varying results. Try it, and be careful to follow the instructions precisely; YMMV. ---
**Author:** ![BonoVox](https://avatars.discourse-cdn.com/v4/letter/b/7cd45c/32.png) [@BonoVox](https://boards.straightdope.com/u/BonoVox)\ **Post date:** [June 30, 2004, 4:31am UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/22 "2004-06-30T04:31:19Z")
Why is spyware even legal? ---
**Author:** ![Polycarp](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@Polycarp](https://boards.straightdope.com/u/Polycarp)\ **Post date:** [June 30, 2004, 4:32am UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/23 "2004-06-30T04:32:46Z")
Well, here’s a solution of sorts: Once you have identified what file or files is causing homepage hijacks: 1. Note down the file name, and the directory it’s located in. 2. Run REGEDIT and use Control-F to search for that filename (omit the extension; it sometimes shows up as a reference without extension). Delete it when found. Be sure to continue the search until you get a “Not Found” response – it may be in there two or three times. (Easiest way to run REGEDIT is Start/Run/type in REGEDIT and click on OK.) 3. Then, using Windows Explorer or such other directory displayer as may float your boat, delete the file from the directory it’s in. You need to get it out of the registry first, or it either won’t delete or will immediately reload. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [June 30, 2004, 10:08am UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/24 "2004-06-30T10:08:21Z")
> [@Polycarp](#): > > 1. Then, using Windows Explorer or such other directory displayer as may float your boat, delete the file from the directory it’s in. You need to get it out of the registry first, or it either won’t delete or will immediately reload. The files in question have somehow been altered so they do not show up in Windows Explorer, or under a Windows search. This is not related to folder options (Hidden Files or Show Extensions). Very sneaky, they. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [June 30, 2004, 10:13am UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/25 "2004-06-30T10:13:59Z")
> [@BonoVox](#): > > Why is spyware even legal? Because there is no such thing as the Internet Police, with world-wide powers necessary to enforce such a law. What are you going to do against companies in South Africa or Indonesia? ---
**Author:** ![Algernon](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Algernon](https://boards.straightdope.com/u/Algernon)\ **Post date:** [June 30, 2004, 1:18pm UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/26 "2004-06-30T13:18:18Z")
> [@Fear Itself](#): > > You are the lucky recipient of a new generation of CWS variants that cannot be removed with HijackThis or CWShredder alone. I’d like to get lucky in some other way. ☹ > [@](#): > > The procedure to remove this variant is complicated, and you would have the best results if you posted your HJT log over at the [forums at SpywareInfo](http://forums.spywareinfo.com/index.php?showforum=18). I’ve posted there as you’ve suggested. This stuff is rampant. My post there after 8 hours is already on page 7. Sheesh. ---
**Author:** ![Rex\_Fenestrarum](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rex_fenestrarum/32/7265_2.png) [@Rex\_Fenestrarum](https://boards.straightdope.com/u/Rex_Fenestrarum)\ **Post date:** [June 30, 2004, 2:56pm UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/27 "2004-06-30T14:56:28Z")
> [@DougC](#): > > - > - > - But you see, the folly of your request is that, generally speaking, _ **no other browser and mail client** _ suffers the security problems that IE and Outlook do. If you wish to avoid the security problems that only IE and Outlook have, then you must avoid using them. > ~ Thanks for your _very helpful_ post! :rolleyes: ---
**Author:** ![Futile\_Gesture](https://avatars.discourse-cdn.com/v4/letter/f/f05b48/32.png) [@Futile\_Gesture](https://boards.straightdope.com/u/Futile_Gesture)\ **Post date:** [June 30, 2004, 2:58pm UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/28 "2004-06-30T14:58:12Z")
Bad news, [CoolWebSearch has won the battle](http://www.theregister.co.uk/2004/06/29/cws_shredder/), the writer of CWShredder is calling it quits. He just doesn’t have the time to continually update shredder to kill an increasingly hostile and devious bit of spyware. The article linked to suggests the only way to be rid of it is to revert to a previous copy of your registry. We will never be rid of spyware until browsers make it impossible for applications to be installed without the user being fully aware that they are trying to install themselves and what they will do once they are there. This isn’t an easy task, but the architecture of Internet Explorer makes it very, very, very difficult to achieve. Particularly when it’s full of bugs that can be exploited. It’s hard to believe, but Microsoft approached the development of an internet browser without considering the possibility of internet sites being fraudulent and internet users being computer novices. Bingo, you have a situation ripe for an internet site being able to wrestle control of a computer off the legitimate owner, without them even being aware its happened. Switching to Firefox won’t rid you of the spyware once you’ve got it (although it may not be quite so visible and intrusive) but it will go a long way to ensuring you don’t get any more. Plus, as has repeatedly been pointed out :), Firefox is simply a better product. It’s not perfect, has a few rough edges, but still leaves IE standing. ---
**Author:** ![Algernon](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Algernon](https://boards.straightdope.com/u/Algernon)\ **Post date:** [June 30, 2004, 3:04pm UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/29 "2004-06-30T15:04:04Z")
> [@Futile Gesture](#): > > Firefox is simply a better product. It’s not perfect, has a few rough edges, but still leaves IE standing. Except for the security issues, I disagree. There a few things that Firefox can’t do that IE handles just fine. I have to revert to IE when I run across them. That doesn’t mean I won’t use Firefox as my primary browser, but my experience does not support the proposition that it leaves IE standing in the dust. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [June 30, 2004, 4:19pm UTC](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432/30 "2004-06-30T16:19:33Z")
The latest definitions for Ad-Aware (June 27 or later) will clean the about:blank variant of “CWS.” It’s not easy – you have to configure Ad-Aware properly to get it done ([instructions are here](http://forums.spywareinfo.com/index.php?showtopic=8847), and it’s a good idea to do it in safe mode, but it looks like Ad-Aware does the job. [Previous page](https://boards.straightdope.com/t/how-to-stop-browser-hijacks-by-coolwebsearch/252432.md?page=1)