Cool Web Search

[Yinyang4evry1]

Does anyone know a reason that when I reinstalled my system and used my trial trend micro that I detected to CoolWebSearches?

That's pretty creepy,
having coolwebsearch preinstalled...
or maybe a corrupt partition

cheers,

tim

[Eddy]

Let me guess, you went online without proper protection.

[Yinyang4evry1]

i was looking deep into the situtation and i saw a pattern everytime i would change my startup using msconfig, when I don't restart it detects coolwebsearch, but when I restart it then nothing wrong happens. I also notice that every time i change msconfig and scan right after that,before turning off my pc, it detects coolwebsearch.
Anyone have any idea?

cheers,

tim

[Eddy]

What is the filename and location that is reported?

[Yinyang4evry1]

microsoft antispyware says it allowed the startup program ms configuration
path:  c:\windows\pchealth\helpctr\binaries\msconfig.exe
trend micro antispyware says the path is no available
name: CWS.MSConfig
database ID -50000 or maybe it could be a false positive?
four months ago mcafee says it detected suspicious script some path that had something to do with pchealth but it only showed that everytime i would close the Compaq help and support center

thanks for such a quick reply,like three minutes!
here's something i thought was funny: i hope it appears down there

cheers,
tim

[Eddy]

PChealth from Compaq is flagged many times as malware.
One thing is for sure, you don't need it to have it loading at boottime.
I suggest you disable it from loading.
If needed/wanted you can also add it to the exclusion list in Avast.

My personal opinion is: Remove it. But it is up to you ofcourse.

[DavidR]

If CoolWebSearch was truely on your system I think you would know it.

Download this CWS killer (CWShreadder), it will confirm one way or another if you do have CWS and shread it if you have.
CWShredder

[Yinyang4evry1]

thanks for the replies

I already have CWS shredder built in to my trial trend micro antispyware which was originally intermute spysubtract

but is this a sign of spyware ?
sometimes my whole screen will disappear and reappear back except with some missing icons in the taskbar

cheers,
tim

[DavidR]

but is this a sign of spyware ?
sometimes my whole screen will disappear and reappear back except with some missing icons in the taskbar

I really have no idea, I haven't heard of this sort of behaviour in spyware.

Also useful as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2
For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
OR HiJackThis Log file - On-line Analysis 2

Or visit Eddy's Website click the "HiJackThis Section" and also the "Malware removal instructions and applications" section, and follow the directions there and get back to us if you need more help....

[Yinyang4evry1]

i dont think im advanced enough to deal with hijack this :'(
got a lot to learn...

tim

[DavidR]

Which is why I gave links to two tutorial pages (blue text) and a link to Eddy's web site.

Take a step at a time, don't try to do the journey in one step. Print out the information at the various pages and use it to follow a step at a time.
We can't do it for you, but we can help if you need it.