Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

CWShredder download link not working


  • Please log in to reply
8 replies to this topic

#1 ummhasan

ummhasan

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:06:23 AM

Posted 03 September 2013 - 02:23 AM

Hello all,

 

I'm working on another one of our computers and this one seems to have the CoolWebSearch hijacker on it. The browser keeps redirecting to mysearch.com which appears to be in the list of aliasis for CWS.

 

I've been trying to follow the tutorial of how to get rid of it but it seems that the program is no longer available via trend micro and the link isn't working. I've searched their site too and I can't find a link to download it.

 

I've already ran a Spybot S&D and removed 4 browser spyware problems. Now I'm again running a Malwarebytes scan (did this just a few days ago, probably 5 times until it came up clean). The scan has freshly started and already found 4 items. I don't mind doing the cleanup on my own using tutorials - I just need the tools to work.

 

Any help in how to get it and update it would be great!

 

Thanks



BC AdBot (Login to Remove)

 


#2 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,071 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:11:23 AM

Posted 03 September 2013 - 02:40 AM

CWShredder is a very old tool and as you can see it's no longer around as it is outdated.
If you want to know what tools to run (if malwarebytes doesn't fix it) then post a topic in Am I Infected?.

xXToffeeXx~

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#3 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:06:23 AM

Posted 03 September 2013 - 02:52 AM

Okay, thanks. I found a tutorial (written in 2012) on Bleeping computer telling how to get rid of the Cool Web Search hijacker that lead me to that tool. Maybe the tutorial should be updated - here's the link:

 

http://www.bleepingcomputer.com/tutorials/remove-coolwebsearch-with-cwshredder/



#4 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,071 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:11:23 AM

Posted 03 September 2013 - 02:53 AM

Okay, thanks. I found a tutorial (written in 2012) on Bleeping computer telling how to get rid of the Cool Web Search hijacker that lead me to that tool. Maybe the tutorial should be updated - here's the link:

 

http://www.bleepingcomputer.com/tutorials/remove-coolwebsearch-with-cwshredder/

Written in 2004 so that's why, but yes it does probably need to be updated (last updated 2012). I'll notify Grinler about it for you.

 

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#5 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:06:23 AM

Posted 03 September 2013 - 03:25 AM

Okay, I didn't notice that was the last update instead of the original writing. Thanks for your help.



#6 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:08:23 PM

Posted 03 September 2013 - 06:34 AM

Hello -


I'm working on another one of our computers and this one seems to have the CoolWebSearch hijacker on it. The browser keeps redirecting to mysearch.com which appears to be in the list of aliasis for CWS.

Please note that redirections to mysearch.com are now treated in other ways than the use of CWShredder, as they once were. There are several other, newer, methods that are now used in malware removal for this problem.

The malware is still downloaded as an "Add-on" with other programs, but it is removed often with Junkware Removal Tool by thisisu and even AdwCleaner by Xplode

 

Thank You -

Also scan with SUPERAntiSpyware Free (aka SAS)

 

Reminder to leave a comment at CWShredder directions - - -



#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:23 AM

Posted 03 September 2013 - 08:47 AM

CWShredder was a tool created by Merijn (the original author of HijackThis) for dealing with CoolWebSearch (CWS), an older infection with many variants (i.e. CWS.Aboutblank, CWS.Smartsearch, CWS.Homesearch). This particular malware first appeared in 2003 and was known to hijack the browser, change the home page, install unwanted bookmarks, make changes to the registry and redirect to CoolWebSearch.com. For more specific information, please refer to The CoolWebSearch Chronicles by Metallica.

TrendMicro obtained The rights to CWShredder and hosted the tool on their websites until it became so outdated, the vendor removed the links. That version (2.19) can still be download from MajorGeeks.com which also includes a link to the previous version. However, it was not as effective as the original version released by Merijn and there were many reports of it giving "false positives".

Although CWShredder is still available, I would not recommend using it nor would I trust the scan results.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:06:23 AM

Posted 03 September 2013 - 02:10 PM

Thanks for the update, the help, and the information. I did run rkill then AdwCleaner, reboot, then Malwarebytes. I'll also run the Junkware removal tool and SAS as you suggested. Thanks



#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:23 AM

Posted 03 September 2013 - 05:23 PM

You're welcome on behalf of the Bleeping Computer community.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users