CoolWWWSearch

[dweasel]

Spybot detected CoolWWWSearch on my PC today. How does one become infected with this malware? I surf almost exclusively with Firefox; I also run MS Antispyware, Ad-Aware and Spyware Blaster. Prior to doing the Spybot scan, I had no reason to make me believe that anything was amiss. My surfing habits are very conservative.

How can I avoid a re-infection?

[md usa spybot fan]

Please post the actual detection that you received so that we can see what Spybot-S&D found.

If you have not fix the problem, please run the scan again. After you are done, right click on the results list and select "Copy results to clipboard" then paste the clipboard into a new post.

If you have fixed the problem, please post the Fixes.yymmdd-hhmm.log from when the problem was fixed.

Note: By default here are two Checks.yymmdd-hhmm logs produced during a scan. The second Checks.yymmdd-hhmm has the details of what the scan found. A Fixes.yymmdd-hhmm log is produced if you fix or attempt to fix something.

Two methods to copy that information:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the last Checks.yymmdd-hhmm or Fixes.yymmdd-hhmm from when you got the error message. Open it. To copy to the Clipboard > highlight the portion you want to copy (or Right click and select Select All) > Right click > Copy.
Method 2:
The Checks.yymmdd-hhmm and Fixes.yymmdd-hhmm files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Checks.yymmdd-hhmm file. Double click on it and it should open with Notepad. To copy to the Clipboard > highlight the portion you want to copy (or Right click and select Select All) > Right click > Copy.

[dweasel]

Here's my "fix" file:

--- Report generated: 2005-12-05 09:57 ---

CoolWWWSearch: Tracking cookie (Firefox: default) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-11-14 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2005-12-02 Includes\Cookies.sbi (*)
2005-12-02 Includes\Dialer.sbi (*)
2005-12-02 Includes\Hijackers.sbi (*)
2005-12-02 Includes\Keyloggers.sbi (*)
2005-12-02 Includes\Malware.sbi (*)
2005-12-02 Includes\PUPS.sbi (*)
2005-12-02 Includes\Revision.sbi (*)
2005-12-02 Includes\Security.sbi (*)
2005-12-02 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2005-12-02 Includes\Trojans.sbi (*)

Thank you.

dweasel

[md usa spybot fan]

Nothing to really worry about it is just a third-party or tracking cookie similar to the "Avenue A, Inc." tracking cookie that is discussed here:
Avenue A
http://forums.spybot.info/showthread.php?t=631

I suggest that you read the above thread in particular this post:
http://forums.spybot.info/showpost.php?p=2681&postcount=2
And the posts from here to the end of the thread that discuss blocking all tracking cookies in Firefox:
http://forums.spybot.info/showpost.php?p=2743&postcount=5
In particular this post:
http://forums.spybot.info/showpost.php?p=2766&postcount=8

[dweasel]

Dear md usa,

Thank you very much for your informative answer.


dweasel