CoolWebSearch Spyware

One of the most complex, sophisticated, and devious browser hijackers ever invented, CoolWebSearch (one word - "cool web search" is technically not correct) is the name given to a range of various browser hijackers. The latest versions have grown increasingly aggressive and complicated and manual removal is virtually impossible. Oftentimes, re-installation of the entire operating system is required, thus use of a reputable spyware remover is highly recommended. New variants of CoolWebSearch are released every few weeks, making it increasingly important to ensure that your spyware remover has the latest updates.

CoolWebSearch Symptoms

* Hijacks to various search engines. Different variants of CoolWebSearch will redirect you to different sites.
* When a URL is mistyped in the browser, CoolWebSearch will redirect the page to affiliate websites as well as CoolWebSearch.com.
* Installs bookmarks to adult websites in the favorites menu.
* Installs toolbars into the browser.
* Slows down PC.
* Can cause reboots.
* Targets anti-spyware websites, usually vendors of spyware removal tools. Once infected with CoolWebSearch, you may be unable to visit these websites to download their products.
* Will open porn popups if it thinks the website being viewed is pornographic in nature.
* Can cause significant slowdowns when attempting to type into a browser.
* Will add CoolWebSearch.com to the trusted sites list.

Removing CoolWebSearch

CoolWebSearch is very difficult to remove manually. The latest versions are virtually impossible to clean short of re-installing the operating system or restoring a previous version of the Windows registry, thus use of a good spyware remover product is recommended.

Unfortunately, most spyware removers will not work against Cool Web Search, so a niche spyware remover called CoolWebShredder is commonly used to destroy this parasite. However, this tool will no longer be updated after the current version (1.59), because the author (who volunteers his time) does not have the tools to remove the latest variants.

Past CoolWebSearch Variants

* CoolWebSearch/DataNotary – hijacks to dataNotary.com and replaces the default stylesheet used by IE. This stylesheet includes javascript that actively watches the currently loaded page and tries to guess when the user is viewing porn sites.
* CoolWebSearch/BootConf – Also replaces the CSS file, hijacks MSN search, and installs a program, bootconf.exe, that resets all hijacked settings every time the computer is restarted.
* CoolWebSearch/MSInfo – Similar to the previous, but points to true-counter.com.
* CoolWebSearch/SvcHost – This variant causes an error when the user attempts to access one of many well-known websites (such as Yahoo search). The error page is then hijacked and the user is sent to slawsearch.com.
* CoolWebSearch/DNSRelay – This variant hijacks URLs that have been typed without a leading “http://” or “www” to activexupdate.com.