# Who´s responsible for the Cool Web Search trojan? **URL:** \ **Category:** Factual Questions\ **Created:** [August 12, 2004, 3:37am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484 "2004-08-12T03:37:03Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Ale](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@Ale](https://boards.straightdope.com/u/Ale)\ **Post date:** [August 12, 2004, 3:37am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/1 "2004-08-12T03:37:03Z")
I got my PC hijacked by the cybernetic spawn of Satan known as CWS.searchx; now this is not a question of how to remove it because I´m quite determined to delete Windows and install it all over again (thanks Bill!); my question is WHO THE HELL IS RESPONSIBLE FOR THAT FRIGGIN´ PIECE OF SOFTWARE!!!??? I know there must be two parties here, the creators and the costumers for the traffic the nefarious trojan captures, who are these people and why haven´t they put in jail or banned from using a PC again? I mean, just by browsing around it seems quite obvious that this nasty thing has caused millions of headaches and lost man-hours trying to remove it from the infected systems, it´s vandalism, nothing less; why isn´t it banned and the people behind it prosecuted? ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [August 12, 2004, 4:01am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/2 "2004-08-12T04:01:17Z")
I deal with crap like this every day. Your internet connection is down? No, Search Assistance, Coupon Buddy and 100 like programs can’t co-operate on your PC and they’ve broken winsock. Windows Updates causing digital signing errors? Well, half your system files have been taken over by WinTools.A, and MS isn’t expecting to update them, so… This is a question I ask myself lots too. But remember it took a while for spammers to start getting the beats, so I keep my hope alive. 😉 Incidentally, I once phoned the contact number for a search engine “kadoodle” that some search tool was redirecting my brother’s IE browser to (incidentally how I convinced him to use [Firefox](http://getfirefox.com/)), and was told it was because of 3rd party partners, blablabla, try going to [mypctuneup.com](http://mypctuneup.com). I don’t know why I was surprised both that they seemed unexcited at taking action against this “partner” (who’s ID was in the redirected URL), and that [mypctuneup.com](http://mypctuneup.com)’s “removal tool” is said all over the Internet to install more spyware… I eventually used the scanner at [Pest Patrol](http://www.pestscan.com) and removed it manually. ---
**Author:** ![P\_T](https://avatars.discourse-cdn.com/v4/letter/p/a587f6/32.png) [@P\_T](https://boards.straightdope.com/u/P_T)\ **Post date:** [August 12, 2004, 4:55am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/3 "2004-08-12T04:55:56Z")
> [@](#): > > Who´s responsible for the Cool Web Search trojan? If you ever get a good answer to this one, I would REALLY like to know who it is. ---
**Author:** ![Snooooopy](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@Snooooopy](https://boards.straightdope.com/u/Snooooopy)\ **Post date:** [August 12, 2004, 5:13am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/4 "2004-08-12T05:13:26Z")
I don’t think that blaming costumers – or anybody in the fashion or textile industries, for that matter – is really very productive. 😛 ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [August 12, 2004, 10:59am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/5 "2004-08-12T10:59:25Z")
It’s from Russia, so you are going to have a hard time throwing them in the clink. Plus, there are over 1200 affilliates worldwide, so you have lifetime job security. [Here is a website](http://www.webhelper4u.com/CWS/cwswhoisinfo.html) that tracks the info of several of the more egregious variants. ---
**Author:** ![Ale](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@Ale](https://boards.straightdope.com/u/Ale)\ **Post date:** [August 12, 2004, 11:17am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/6 "2004-08-12T11:17:09Z")
> [@P\_T\_](#): > > If you ever get a good answer to this one, I would REALLY like to know who it is. So… have you seen the movie Jay and Silent Bob? 😉 ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [August 12, 2004, 12:36pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/7 "2004-08-12T12:36:39Z")
domain: [coolwebsearch.com](http://coolwebsearch.com) status: production organization: InterWeb Solutions Inc owner: InterWeb Solutions Inc email: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com) address: P.O. Box 362 address: Road Town city: Tortola postal-code: 65113 country: IO admin-c: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com)#0 tech-c: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com)#0 billing-c: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com)#0 nserver: [ns1.maximumhost.com](http://ns1.maximumhost.com) nserver: [ns2.rosexxxgarden.com](http://ns2.rosexxxgarden.com) ---
**Author:** ![BrotherCadfael](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@BrotherCadfael](https://boards.straightdope.com/u/BrotherCadfael)\ **Post date:** [August 12, 2004, 1:19pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/8 "2004-08-12T13:19:53Z")
For what it’s worth, there is a procedure to close your PC’s vulnerability to the major CoolWebSearch variants. I found the procedure described under the “Protect your system against future infections” link at the end of the CWSShredder program. (For those of you not familiar with it, CWSShredder was a program designed to detect and remove many, many variants of CoolWeb Search. The person who wrote CWSShredder finally had to give it up, defeated by the continuing release of new variants and by denial-of-service attacks perpetrated against him by the authors of CoolWebSearch.) Basically, the procedure removes the Microsoft Java VM, and substitutes the Sun Java VM, which isn’t as vulnerable (big surprise, there). I have been including this in my standard workstation build for some time, and have yet to see CoolWebSearch show up on any treated machine. 1. To remove the MS Java VM: Enter the following command at the command prompt: RunDll32 advpack.dll, LaunchINFSection java.inf, UnInstall After the machine reboots, delete the following folders or files: C:\WinNT\Java C:\WinNT\Inf\java.pnf C:\WinNT\System32\jview.exe C:\WinNT\System32\wjview.exe Delete the following registry subkeys: HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Java VM HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Internet\Explorer\AdvancedOptions\JAVA\_VM 1. Download and install the Sun Java VM Go to: [http://java.com/en/download/windows\_automatic.jsp](http://java.com/en/download/windows_automatic.jsp) and follow the directions to download, install, and configure the Sun Java VM. ---
**Author:** ![Colophon](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@Colophon](https://boards.straightdope.com/u/Colophon)\ **Post date:** [August 12, 2004, 2:18pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/9 "2004-08-12T14:18:44Z")
Can anyone tell me what the ill-effects of CWS are? Seems like every time I run AdAware (every month or so) it picks up CoolWebSearch, but I have not noticed any performance problems with my PC - no pop-ups, no hijacked search pages, nothing. Should I still be worried? ---
**Author:** ![badmana](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@badmana](https://boards.straightdope.com/u/badmana)\ **Post date:** [August 12, 2004, 2:29pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/10 "2004-08-12T14:29:29Z")
> [@Colophon](#): > > Can anyone tell me what the ill-effects of CWS are? > > Seems like every time I run AdAware (every month or so) it picks up CoolWebSearch, but I have not noticed any performance problems with my PC - no pop-ups, no hijacked search pages, nothing. Should I still be worried? AdAware cannot remove CWS (from experience). Use CWSShredder (just do a search). CWS does a lot of things including hijacking your browser homepage and even affecting Control Panel (in XP). Very annoying. I didn’t know Sun Java is better at protecting a system so I’ll be switching my GF’s computer tonight (my computer already has been fixed but for an unrelated issue). ---
**Author:** ![Monkeypants](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@Monkeypants](https://boards.straightdope.com/u/Monkeypants)\ **Post date:** [August 12, 2004, 2:58pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/11 "2004-08-12T14:58:33Z")
I spent an hour and a half last night getting the latest variant (the “Search For…” home page) off of my fiancee’s laptop, using a combination of CWShredder, Ad-Aware, Spybot, and RegEdit. I would love to find the kid responsible. Anyway, regarding the discontinuance of CWShredder, from reading the spyware message boards it seems the variants have gotten much more sophisticated recently. They believe that it is no longer some computer-savvy guys making them but that a serious Trojan writer has been enlisted. ---
**Author:** ![P\_T](https://avatars.discourse-cdn.com/v4/letter/p/a587f6/32.png) [@P\_T](https://boards.straightdope.com/u/P_T)\ **Post date:** [August 12, 2004, 3:15pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/12 "2004-08-12T15:15:49Z")
> [@Colophon](#): > > Can anyone tell me what the ill-effects of CWS are? > > Seems like every time I run AdAware (every month or so) it picks up CoolWebSearch, but I have not noticed any performance problems with my PC - no pop-ups, no hijacked search pages, nothing. Should I still be worried? Also the only browser it affects is IE. I use Mozilla Firefox now almost exclusively at home. (Still some sites that just need IE to work properly) Anyway, on IE will hijack your home page, and throw a pop up that says you have spyware on your system, directing you to buy thier cleaner. ---
**Author:** ![mkl12](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@mkl12](https://boards.straightdope.com/u/mkl12)\ **Post date:** [August 12, 2004, 3:30pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/13 "2004-08-12T15:30:12Z")
> [@Colophon](#): > > Can anyone tell me what the ill-effects of CWS are? > > Seems like every time I run AdAware (every month or so) it picks up CoolWebSearch, but I have not noticed any performance problems with my PC - no pop-ups, no hijacked search pages, nothing. Should I still be worried? Some variants are not as obious as **P\_T\_** says. There have been some Pit threads by people who were positve that their browsers were not hijacked, but who complained that Google has more and more advertisements and bad results. In most of these cases (I suspect in all cases, but some could not be convinced) CWS was respnsible. So you should try CWSShredder even if you don’t notice any problems. ---
**Author:** ![Ale](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@Ale](https://boards.straightdope.com/u/Ale)\ **Post date:** [August 12, 2004, 5:50pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/14 "2004-08-12T17:50:57Z")
> [@Colophon](#): > > Can anyone tell me what the ill-effects of CWS are? Well, my printer driver went belly up and I can´t make it work after sucessive re-installation attemps, quite annoying, and Windows freezes up now and then which forces me to reboot and lose whatever job I was working on at that time, that costs me money in a very direct way. Also sometimes programs take an extremely long time to load, seems like a hiccup in the system, things freeze for almost a minute and then go on as usual. All this since CWS has been installed without my consent on my computer, yeah, it pisses me off big time. > [@RealityChuck](#): > > domain: [coolwebsearch.com](http://coolwebsearch.com) > status: production > organization: InterWeb Solutions Inc > owner: InterWeb Solutions Inc > email: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com) > address: P.O. Box 362 > address: Road Town > city: Tortola > postal-code: 65113 > country: IO > admin-c: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com)#0 > tech-c: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com)#0 > billing-c: [admin@iweb-commerce.com](mailto:admin@iweb-commerce.com)#0 > nserver: [ns1.maximumhost.com](http://ns1.maximumhost.com) > nserver: [ns2.rosexxxgarden.com](http://ns2.rosexxxgarden.com) “Country: IO”??? That site is an offense: “Cool Web Search, the search engine you \*\*trust[/]” How can they keep spreading malware like that with impunity? none in power to get things done gives a flip, there are no legal basis for complaint, what gives? ---
**Author:** ![tanstaafl](https://avatars.discourse-cdn.com/v4/letter/t/ba8739/32.png) [@tanstaafl](https://boards.straightdope.com/u/tanstaafl)\ **Post date:** [August 12, 2004, 10:12pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/15 "2004-08-12T22:12:23Z")
> [@Ale](#): > > Well, my printer driver went belly up and I can´t make it work after sucessive re-installation attemps, quite annoying, and Windows freezes up now and then which forces me to reboot and lose whatever job I was working on at that time, that costs me money in a very direct way. Also sometimes programs take an extremely long time to load, seems like a hiccup in the system, things freeze for almost a minute and then go on as usual. > > All this since CWS has been installed without my consent on my computer, yeah, it pisses me off big time. > > “Country: IO”??? > > That site is an offense: “Cool Web Search, the search engine you \*\*trust[/]” > How can they keep spreading malware like that with impunity? none in power to get things done gives a flip, there are no legal basis for complaint, what gives? Tortola is one of the British Virgin Islands. Dunno about “IO” though… ---
**Author:** ![FyreFiend](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@FyreFiend](https://boards.straightdope.com/u/FyreFiend)\ **Post date:** [August 12, 2004, 10:19pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/16 "2004-08-12T22:19:48Z")
> [@tanstaafl](#): > > Tortola is one of the British Virgin Islands. Dunno about “IO” though… IO is the [ISO County Code](http://userpage.chemie.fu-berlin.de/diverse/doc/ISO_3166.html) for British Indian Ocean Territory. ---
**Author:** ![Ruken](https://avatars.discourse-cdn.com/v4/letter/r/f475e1/32.png) [@Ruken](https://boards.straightdope.com/u/Ruken)\ **Post date:** [August 13, 2004, 2:02am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/17 "2004-08-13T02:02:08Z")
How exactly does one get something like CWS on a computer? I’m going to check mine out for any problems, but I was wondering what sort of behavior would make its presence more likely. ---
**Author:** ![RandomLetters](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@RandomLetters](https://boards.straightdope.com/u/RandomLetters)\ **Post date:** [August 13, 2004, 3:23am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/18 "2004-08-13T03:23:19Z")
The biggest thing to avoid doing is using Internet Explorer, and to be careful about what ‘free’ programs you install - often they will be bundled with spyware. ---
**Author:** ![tadc](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@tadc](https://boards.straightdope.com/u/tadc)\ **Post date:** [August 13, 2004, 5:50am UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/19 "2004-08-13T05:50:33Z")
> [@RandomLetters](#): > > be careful about what ‘free’ programs you install - often they will be bundled with spyware. Maybe I’m just lucky, but I find it easy to avoid these things by just clicking the X box on any questionable popup. Not Yes, not No, just X. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [August 13, 2004, 12:13pm UTC](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484/20 "2004-08-13T12:13:42Z")
The problem is that spyware is frequently attached to programs that are highly attractive to young people: free music sharing programs, free games, free desktop utilities. When prompted to agree to the user terms, they don’t realize that they are also giving permission to install all sorts of third-party nastinesss. If they don’t agree, they can’t get the free game. Also, many free software packages won’t work anymore if you remove the spyware with Spybot or Adaware. [Next page](https://boards.straightdope.com/t/who-s-responsible-for-the-cool-web-search-trojan/259484.md?page=2)