Possible Hijacking Detection By Spybot?

[nanco]

I'm a little confused about this. Checking the startup information using Spybot I have something known as CTFMON32.EXE that is detected. It is regarded as CoolWebSearch hijacking software according to the information provided by Spybot. I can delete the entry however it reappears next time I reboot.

I have searched on the internet for ways to get rid of this (resulting both manually and through various programs and fixes such as CWShredder), however all have reported no detections. I have searched in my system32 folder in Windows (hidden files/folders viewable) where it is reported to be located and there is no such file there. Judging from the symptoms of this particular hijacking software as mentioned on many sites, none have occurred on my computer.

Does anyone have any suggestions how I can get rid of it without formatting my computer? I have all the latest updates for Spybot, Windows, Antivirus etc, so that isnt a problem. Could it just be a registry thing in case I might have removed the software without even knowing I had it?

 

[megamaced]

have a look in your startup directory. Go 'Start' then 'RUN'. Then type 'services.msc'. From here, you can look at all of your running programs, startups etc.

I would recommend you try Ad-aware SE Personal. I'm sure this will track down and destroy any spyware/adware in your PC

 

[nanco]

Thanks for the prompt reply. I tried that exact program you recommended, however it found nothing. I have however narrowed it down a little since then.

The file isnt executed at startup, but when I start Internet Explorer for the first time (the actual browser, not using web related programs like Messenger or just connecting in general). Even then, it is not listed on 'services.msc' but is on the Spybot startup detection menu. I can then delete the file from there and all is fine (I can dis/reconnect without it appearing again, even after clearing cookies and temp internet files etc). However, it does seem to execute again once rebooting and connecting and launching IE again.

Aparently, judging from what I have read about on the net, this particular file changes the IE home page and causes many popups besides hijacking, both of which I have not experienced.

I'm puzzled.

 

[Anti-Trend]

CoolWebSearch is one of the worst ones -- most people faced with its malice choose to simply reformat. I fought with it on a client's system just last week, took me far longer to completely remove that it would have to just reformat. To add insult to injury, Windows failed only a couple of days later and I ended up doing a reformat anyway! Seems to be the general consensus with Windows, and ultimately what I'd recommend. [ot]Thank God my wife runs Linux![/ot]

 

[megamaced]

CoolWebSearch is one of the worst ones -- most people faced with its malice choose to simply reformat.

What is coolwebsearch? Is it adware or spyware? What are implications of having it installed on your PC? Can it hijack your browser with annoying toolbars?