CoolWebSearch and Microsoft AntiSpyware

[Kasteo]

Recently, Microsoft AntiSpyware always report when I login to one of the user account on my computer that I have CoolWebSearch and ask me if I want to remove it or not. I click "Remove" and then scan the system. BUT after I logoff then login again, Microsoft AntiSpyware will report me again that I have CoolWebSearch and ask to Remove. No matter how many time I remove it, it will come back again.

I'm also using Spybot Search&Destroy and AdAware to scan. Nothing was found.

If this is a bug with Microsoft AntiSpyware?

[Rudy]

If this is a bug with Microsoft AntiSpyware?

585473135[/snapback]

no

it just keeps reinstalling itself

[Kasteo]

no

it just keeps reinstalling itself

585473141[/snapback]

And then how can I remove it because Microsoft AntiSpyware, Spybot S&D and AdAware can't find anything when scan the system?

[Tungsten T]

CWCleanner

[Andrew179]

Use CWShredder

[Tokar]

try webroot spyware. That detects CWS...

[MrBear5587]

The problem wasn't detection, MSAntiSpyware detects CWS, and uses a hell of a lot less resources that SpySweeper

[insanekiwi]

cwshredder :yes:

[Steffan]

check make sure you don't have a trojan horse..

http://www.symantec.com/avcenter/venc/data/trojan.norio.html

edit: also look for an app called WINPROC32.EXE

[EduardValencia]

maybe it's a trojan,u should check out what procceses u are running.or type "msconfig" and take a look of suspicious processes run on startup

[Dyehouse1]

stop everything THEN run the cleaner then check out whats what in the startup group 'msconfig'

[Caledai]

Spyware, etc are getting smarter.

They keep two processes resident, and use them. They run checks on the other process, if it fails they start another one.

You can use a different process monitor to kill both at once - I use Process Explorer, but even this fails sometimes.

Other times, what It is detecting is a false positive. There may be a trace that has not been removed, but because they are all not there, MS cannot remove it.

I had this with 4 traces with spybot the other day. I removed 2 traces manually - the other 2 didn't exist, and no more problems.'

Boot into safemode. Use Spybot, MS ASB, and Adaware/spywseeper to clean what you can. Then using Hijack This, do the rest by hand.

[PseudoRandomDragon]

CoolWeb is notorious for being difficult to remove.

[Fighter-X]

Disable your System Restore. Right Click My Computer > Properties > System Restore

[Miran]

Disable your System Restore. Right Click My Computer > Properties > System Restore

585485904[/snapback]

Nice sig jackass.

[Xahid]

[off topic]

To Fighter-X !

why don't you attach 1280X1280 Res. pic as your sig ???

its too small to view !! isn't it ??

[Kasteo]

I just want to follow up the problem. I have tried everything but I still can't get rid of this problem. AdAware, Spybot, CWShredder can't detect anything, but MSAntiSpyware still keep inform me everytime I login.

Now, I begin to think it's a bug in MSAntiSpyware. :(