CoolWebSearch

From Wikipedia, the free encyclopedia
Jump to: navigation, search

CoolWebSearch (also known as CoolWWWSearch or abbreviated as CWS) is a spyware or virus program that installs itself on Microsoft Windows based computers. It first appeared in May 2003.

Effects[edit]

CoolWebSearch has numerous effects when it is successfully installed on a user's computer.[1] The program can change an infected computer's web browser homepage to coolwebsearch.com, and although originally thought to only work on Internet Explorer, recent variants affect Mozilla Firefox as well as others like Google Chrome. It can also create pop-up ads that redirect to other websites including pornography sites, collect private information about users and slow the speed of infected computers.

Coolwebsearch uses innovative techniques to evade detection and removal, and as such many common spyware removal programs fail to properly remove the software.[2]

Some versions of CoolWebSearch can be installed through drive-by installation, in which a computer browsing a webpage automatically installs CWS. CWS itself attempts to evade others by not labelling its ads, not providing an EULA, not providing any data about itself and not having a website. Certain variants insert links on random text, leading to advertiser websites. Other attempts to access websites are redirected to pay-per-click search engines that may install more malware display ads. Some variants of CWS also add links to pornography and gambling sites to the user's Desktop, Internet Explorer's bookmarks and history.[3] Certain versions attempt to edit users' trusted sites and modify security settings as well as to hide from removal programs. Variants are often named for the effects they have such as msconfig, Msoffice, Mupdate, Msinfo and Svchost32.

CoolWebSearch is very stubborn to completely get rid of from your system. Since it also gets inside with many other potentially unwanted software or add-ons, so computer users should uninstall those unwanted stuff, or CoolWebSearch can come back after you have changed your home page and search engine provider. [4]

Possible creators[edit]

The website claims that they are not responsible for the browser hijacking. They run an affiliate program that pays affiliates to direct others to their site with paid advertising links. Coolwebsearch.com's terms of service use the laws of Quebec, Canada, whilst their DNS registration lists an address in the British Virgin Islands, and their web server appears to be run by HyperCommunications in Massachusetts, USA. CoolWebSearch is also linked to CoolWebSearch.org and appears to be related to webcoolsearch.com. Investigation connected Stanislav Avdeyko, the Koobface hacker, with CoolWebSearch.[5]

Variants[edit]

  1. CWS.Addclass
  2. CWS.Alfasearch
  3. CWS.Bootconf
  4. CWS.CameUp
  5. CWS.Cassandra
  6. CWS.Control
  7. CWS.Ctfmon32
  8. CWS.Datanotary
  9. CWS.Dnsrelay
  10. CWS.Dreplace
  11. CWS.Gonnasearch
  12. CWS.Googlems
  13. CWS.Hiddendll
  14. CWS.Homesearch
  15. CWS.Loadbat
  16. CWS.Look2Me
  17. CWS.Msconfd
  18. CWS.Msconfig
  19. CWS.MSFind
  20. CWS.Msinfo
  21. CWS.Msoffice
  22. CWS.Msspi
  23. CWS.Mupdate
  24. CWS.Oemsyspnp
  25. CWS.Olehelp
  26. CWS.Oslogo
  27. CWS.Qttasks
  28. CWS.Q-url3
  29. CWS.Realyellowpage
  30. CWS.Searchx
  31. CWS.Smartfinder
  32. CWS.Smartsearch
  33. CWS.Sounddrv
  34. CWS.Svchost32
  35. CWS.Svcinit
  36. CWS.Systeminit
  37. CWS.Systime
  38. CWS.Tapicfg
  39. CWS.Therealsearch
  40. CWS.Vrape
  41. CWS.Winproc32
  42. CWS.Winres
  43. CWS.Xmlmimefilter
  44. CWS.Xplugin
  45. CWS.Xxxvideo
  46. CWS.Yexe

Affiliate variants[edit]

  1. CWS.Aff.iedll
  2. CWS.Aff.Madfinder
  3. CWS.Aff.Tooncomics
  4. CWS.Aff.Winshow

References[edit]

  1. ^ "Encyclopedia entry: Spyware:Win32/Coolwebsearch.H". Microsoft Malware Protection Center. 
  2. ^ Russel, Charlie (May 13, 2005). "Dealing with an infected PC". Microsoft. Archived from the original on September 27, 2010. "...many of the Cool Web Search variants can prevent the other anti-spyware programs from doing their job correctly..." 
  3. ^ Vincentas (5 July 2013). "CoolWebSearch in SpyWareLoop.com". Spyware Loop. Retrieved 28 July 2013. 
  4. ^ Get Rid of CoolWebSearch Virus DooHelp
  5. ^ The Koobface malware gang - exposed! Indepth investigation by Jan Droemer and Dirk Kollberg, SophosLabs