CoolWWWSearch.SmartSearch

[Kerim]

Hi,

A few days ago, SSD has detected, on my other PC running XP SP2, "CoolWWWSearch.SmartSearch" in C:\autorun.exe. So, I let SSD scan again at system startup to fix it more freely. After fixing and by scanning again, that CoolWWSearch seemed to be gone.

Today and after updating SSD, I tried another scan (as I used to do after each update) to find out that our dear autorun.exe has reappeared. For instance, the System Restore is off. Actually I am not sure how harmful that autorun.exe might be (I also noticed other autorun files at the C root having other extension than exe). Because apparently the PC is fine now. But in case it is not a false positive I wish someone here will help me remove it completely. Thanks in advance for any support.

Kerim

[Kerim]

Hi...
Just to say that I still hope to know here anything on that "autorun.exe"

While searching, I found out that "CoolWWWSearch" has relatively too many variants that are day after day harder to be detected.

I take the opportunity to add that since many years I have depended on "SpyBot Search&Destroy" to protect my 2 PCs (a PC for the guests ) Now I have no doubt that SS&D is one of the most professional programs in its field... Cheers to its creator and developpers.

Kerim

[tashi]

Hi there.

Please run SpyBot.
Check for problems, when finished right click and choose copy results (not the full report) to clipboard and post that back here please.

Or, we could take a different look at the system if you start a topic here: Malware Removal Forum

Read the instructions "BEFORE you POST" -Preliminary Steps for producing a HJT log after running an on-line anti virus scan.

A helper would then advise you as soon as available.

Cheers.

[Kerim]

Thank you Tashi for your kind reply.

This time, as in the previous scan, I didn't fix it.
But I did it once, when SSD has detected it for the first time.


CoolWWWSearch.SmartSearch: Executable (File, nothing done)
c:\autorun.exe

--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2007-02-21 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-01-15 advcheck.dll (1.2.1.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-03-21 Includes\Cookies.sbi (*)
2006-12-08 Includes\Dialer.sbi (*)
2007-03-21 Includes\DialerC.sbi (*)
2007-03-21 Includes\Hijackers.sbi (*)
2007-03-21 Includes\HijackersC.sbi (*)
2006-10-27 Includes\Keyloggers.sbi (*)
2007-03-21 Includes\KeyloggersC.sbi (*)
2007-03-21 Includes\Malware.sbi (*)
2007-03-21 Includes\MalwareC.sbi (*)
2007-03-21 Includes\PUPS.sbi (*)
2007-03-21 Includes\PUPSC.sbi (*)
2007-03-21 Includes\Revision.sbi (*)
2006-12-08 Includes\Security.sbi (*)
2007-03-21 Includes\SecurityC.sbi (*)
2007-03-21 Includes\Spybots.sbi (*)
2007-03-21 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-03-21 Includes\Trojans.sbi (*)
2007-03-21 Includes\TrojansC.sbi (*)

[tashi]

Kerim,

Could you go ahead and start a topic in the malware forum so that a HJT log can be analysed.

Preliminary Steps Malware Removal Forum

Thanks.

[Kerim]

After reading the links you have proposed, I will start the topic in the malware forum. Thank you... tashi.