Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Hello and I have a problem...


  • Please log in to reply
18 replies to this topic

#1 Guest_yjsk2100_*

Guest_yjsk2100_*

  • Guests
  • OFFLINE
  •  

Posted 13 November 2004 - 06:38 PM

:thumbsup: First time posting here and thought I would say HELLO. I have also posted in Hijackthislogs.com and Castlecops.com but thought I would try this one too. I ran into a problem and it seems that my computer has CWS.Google MS.3 which Pest Patrol Evaluator found. It first started with Spywareblocker from Webroot finding CWS_xplugin. I installed CWShedder and it found no Coolwebsearch or any of it's variants. It may just be a false positive from Pest Patrol but I am not sure. I wasn't sure where to post this so I thought this would be a good place to start and maybe someone there could direct me to the correct posting place. I hope someone can help me with this as I am not very computer literate and it is beginning to drain my brain. Have a great day and THANKS>>>>>

BC AdBot (Login to Remove)

 


#2 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA

Posted 13 November 2004 - 11:06 PM

Hello and welcome to the forum.

Sure I will help you remove your spyware.

Download & Save this to a folder where you can find it then close all open windows and run it.
CW Shredder

Then Download, Update, and run these in this order and delete everything that is found.
Ad-Aware SE Click the download com top rated 5 on the right side of the page.
SpyBot S&D 1.3 Click any of the download now buttons.
TrendMicro Free Virus Scan Click the Scan Now, It's Free.

Post back and let us know how things are now.

#3 Guest_yjsk2100_*

Guest_yjsk2100_*

  • Guests
  • OFFLINE
  •  

Posted 13 November 2004 - 11:41 PM

Hi River_Rat: Thank you for getting back to me so quickly. I already have installed on my computer Ad-Aware SE Personal 1.05, Spybot Search & Destroy 1.3, Spywareblaster, Spywareguard, Hijackthis 1.98.2, CWShredder 2.00.0, WinPatrol 8.0.1.0, Pest Patrol Evaluator, Earthlink spywareblocker by Webroot and Yahoo Anti-spy v1.8. They have all been updated as of today. Yesterday I ran all of them and only the Earthlink spywareblocker found CWS_xplugin. That made me think it was a variant of Coolwebsearch so I then installed CWShredder and clicked Fix. It said I had no Coolwebsearch on computer. I then ran Pest Patrol evaluator and it found CWS.Google MS.3 as well as Winnet. I got rid of Winnet by deleting it. That just left the CWS.Google MS.3

After I posted the first time to this BB, I looked in Spywareblaster and it has xxxtoolbar.com listed as being blocked and that is where Pest Patrol said the CWS.Google MS.3 was located. I then went to registry, found, but didn't know what to do next. I wasn't even sure if I had it or not.

I was told by someone in Hijackthis.com that it could be a false positive reading from Pest Patrol but I am not sure. I tried to run the Micro Trend House Call but for some reason it will not run.

Hope I have explained this well enough. Any thoughts? Do you think I have the CWS.Google MS.3 on my computer and if so, how do I get rid of it for good. My brain is becoming fried with all this so any help would be greatly appreciated.

#4 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:06:27 AM

Posted 14 November 2004 - 12:03 AM

Well the next step would be to go to Folder Options in the Control Panel>View tab>put a dot in Show Hidden Files & Folders then post a HJT Log on this forum and they will check it for you.
http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

#5 Guest_yjsk2100_*

Guest_yjsk2100_*

  • Guests
  • OFFLINE
  •  

Posted 14 November 2004 - 01:13 AM

:flowers: :trumpet: Thanks. Do I post the log in this same thread or start a new one in the Hijackthislog section? I will run HJT now and get it ready so as soon as I hear back from you I will post log. And thanks. Waiting for your reply shortly.... :thumbsup:

#6 Guest_yjsk2100_*

Guest_yjsk2100_*

  • Guests
  • OFFLINE
  •  

Posted 14 November 2004 - 01:54 AM

:thumbsup: Hi. I just posted my Hijackthislog in the Hijackthislog forum section and here is the link in case you need to see it. Thanks for all your help and I will be waiting for someone to get back to me so I will know if I am clean or if I have to do some work to get rid of CWS.Google MS.3

http://www.bleepingcomputer.com/forums/ind...=ST&f=22&t=4761

:flowers:

#7 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA

Posted 14 November 2004 - 10:57 AM

Are people working on your log at any of the other forums? If so I would prefer that you only get help from one forum at a time for the same log as it can get confusing

#8 luci2a

luci2a

  • Members
  • 171 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:London UK
  • Local time:06:27 AM

Posted 14 November 2004 - 12:49 PM

Hi there yjsk2100

I contacted PestPatrol about this, and they advised that this is a false positive, caused by PP flagging the registry entry in Spyware Blaster for xxxtoolbar.com.
If you delete GoogleMS3 in PP, SpywareBlaster then reports as being unprotected from xxxtoolbar.
They recommended that I set PP to "ignore" GoogleMS3, which I felt quite happy to do as scans with Adawre and Spybot S&D were clear.

This has worked for me at any rate!

Luci2a :thumbsup:

#9 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA

Posted 14 November 2004 - 02:56 PM

Are people working on your log at any of the other forums? If so I would prefer that you only get help from one forum at a time for the same log as it can get confusing

Ya Grinler I directed him to post his HJT log in the HJT forum so the people over there help him see if he had something the adware tools wouldn't clean up.
You can go ahead and lock this thread or what ever it is that needs to be done.

#10 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA

Posted 14 November 2004 - 02:58 PM

Hi there yjsk2100

I contacted PestPatrol about this, and they advised  that this is a false positive, caused by PP flagging the registry entry in Spyware Blaster for xxxtoolbar.com.
If you delete GoogleMS3 in PP, SpywareBlaster then reports as being unprotected from xxxtoolbar.
They recommended that I set PP to "ignore" GoogleMS3, which I felt quite happy to do as scans with Adawre and Spybot S&D were clear.

This has worked for me at any rate!

Luci2a :thumbsup:

Thanks Luci I will keep that info for future use.

#11 Guest_yjsk2100_*

Guest_yjsk2100_*

  • Guests
  • OFFLINE
  •  

Posted 14 November 2004 - 03:36 PM

:thumbsup: Hi. I did post in Castlecops.com as well as here because I didn't realize it was wrong to do so. Sorry about that..... Also one question:

I contacted PestPatrol about this, and they advised that this is a false positive, caused by PP flagging the registry entry in Spyware Blaster for xxxtoolbar.com.
If you delete GoogleMS3 in PP, SpywareBlaster then reports as being unprotected from xxxtoolbar.
They recommended that I set PP to "ignore" GoogleMS3, which I felt quite happy to do as scans with Adawre and Spybot S&D were clear.


How do I have PP ignore GoogleMS.3. I looked at PP and did not see where I could do this. Any help before you close this thread? And I will not post in more than one at a time in the future....... So please keep this thread open for now.

#12 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:07:27 AM

Posted 14 November 2004 - 04:36 PM

:thumbsup:    Hi. I did post in Castlecops.com as well as here because I didn't realize it was wrong to do so.  Sorry about that.....   


He wasn't talking about posting in different websites just different forums on Bleeping Computer.
Stick around and chat with everyone and read the tutorials lots of good info and everyone around here will also throw in a little humor every now & then.

#13 luci2a

luci2a

  • Members
  • 171 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:London UK
  • Local time:07:27 AM

Posted 14 November 2004 - 05:13 PM

How do I have PP ignore GoogleMS.3


On the main scanning page of PestPatrol there is an "exclude" button. When a pest which is known to be a false positive comes up, highlight it and just hit that button. The exclusion will then show up in Options > What to exclude.

Cheers
Luci2a :thumbsup:

#14 Guest_yjsk2100_*

Guest_yjsk2100_*

  • Guests
  • OFFLINE
  •  

Posted 14 November 2004 - 05:30 PM

:trumpet: :flowers: luci2a: Hi. Thanks for the quick reply. I understand now. I need to run the scan again and then exclude it from there. I was just looking in the PP program itself and got lost. Will run scan as soon as I send this. Also heard back from PP by e-mail and was told same thing you said earlier - it was a false positive.

Also to River_Rat. I am a she not a he.....ROFL.... And I will continue to use Bleeping Computer and read other posts just to see what everyone has to say. :thumbsup:

#15 sciachir

sciachir

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:27 AM

Posted 14 November 2004 - 06:58 PM

To River Rat: Do you need to run more than one spyware remover? I figured one was sufficient. I currently use Mcfee.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users