Spyware, Viruses, & Security forum

General discussion

Spyware ,Adware,malware,

by phil66 / November 5, 2004 11:03 AM PST

Dell l800r w/128ram
OS is Windows Me
Firefox and IE 6 browsers
Avast 4 Home anti-virus

I am trying to clean up 4 years worth of spyware etc.
Upon running Spyhunter and spyferret the following items were detected:

DyFuCa isetup.exe C:\windows\downloaded program files
Cool WWW Search Autorun settings (ini file value)
CWS Register Key
CWS Style Sheet (Register value)
Cws Style Sheet (Register value)
Twain Tech (Register Key)
Xupiter Orbit Explorer (Register Key)

I ran CWShredder and found some ini files not related that needed repairs.
I ran Hijackthis and had Zeros Realm analyize logs all systems clean.
I ran Adware Se only MRU objects
Ran ccleaner no problems
Searched registry found other items but not these.
Ran TweakUI Reg Cleaner it was clean
Ran Spybot search & Destroy only DSO Exploit on list

How do I clean this up or is SpyFerret and Spyhunter
only reporting these to get me to buy their programs.

Thanks for your help

Discussion is locked
You are posting a reply to: Spyware ,Adware,malware,
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Spyware ,Adware,malware,
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Re: Spyware ,Adware,malware,
by roddy32 / November 5, 2004 11:10 AM PST

That would be completly possible Phil both are known for deceptive practices. Click this link and go down the list. Those 2 are together and read the notes on the side right side of each one. This list is used by all the Spyware forums for bad and deceptive applications. Hope this helps.


Collapse -
Re: Spyware ,Adware,malware,
by tobeach / November 5, 2004 2:11 PM PST

Hi, Phill. I second Roddys opinion. I think you've got the cat by the tail this time. Admittedly you've had some of the tougher ones. The Dyfuca (I had a while back) is likely a Dialer. Also check for file under "Money Tree".
Spybot S&D has this covered under its products list (& immunize?). Happy cleaning! Happy

Collapse -
Re: Spyware ,Adware,malware,
by romanicris / November 5, 2004 4:34 PM PST

Thanks for the link.That's the holy grail for me.The warrior answered all my questions in one place.I've spent hours researching.PestScan removed 3800 infected files from my drive.Now i'll try a few other recommended products and hope to keep the *%#@ off my pc.THANKS AGAIN

Collapse -
Re: Spyware ,Adware,malware,
by roddy32 / November 5, 2004 8:11 PM PST

You are welcome Eric Howes is very well respected in the field and he's saved a lot of people a lot of trouble. Hopefully Phil/Ray saw the link before he got duped.

Collapse -
Re: Spyware ,Adware,malware,
by phil66 / November 6, 2004 9:43 AM PST

Hi Roddy

Thanks for the links very interesting and useful info.

I finally after continued searching of the registry found the subject items.

Hkey users\software\microsoft\windows\current version\Internet settings\zonemap\domains.

There were (13) entries with cool web search and cool www search. They did not seem to be spyware as they are mostly com net org extensions. What do you think?

The registry finder did not locate them nor did any programs with the exception of spyferret. And that sounds like a buy me come on.

This leads to another question what is the function of the domain registry. It is full of com and net extenions. I was under the impression they were kept in History.

Again thanks for the info I wish I would of had it weeks ago when I started this project.


Collapse -
Re: Spyware ,Adware,malware,
by roddy32 / November 6, 2004 9:55 AM PST

If it were me, I would get rid of ANYTHING that has anything to do with coolwebsearch Ray but I am a self taughter and I'm not comfortable going into the registry so hopefully, Donna, Marianna, Grif, Brent, or one of the other experts can help you from here Ray. It sounds like you are better off than you were anyway. I would wait for them before you try and delete anything now.

Collapse -
Re: Spyware ,Adware,malware,
by MarkFlax Forum moderator / November 6, 2004 9:57 AM PST

Hi phil

I thought I would jump in before roddy does, Happy

But we have similar minds on this anyway.

You really need a suite of antivirus software. They all do good jobs, but they all miss things that others pick up.

My own suite goes like this;

Firewall - I use ZoneAlarm Pro, but there is a free version

Viruses -I use AVG from http://www.grisoft.com. Free version

Adware - I use Ad-Aware from http://www.lavasoftusa.com

Spyware - I use Spybot Search & Destroy and Spywareblaster. Incidently, Spywareblaster would also have picked up your cool www search items.

Start-up list - I use Start-up Monitor to warn me if anything that is being installed on my computer tries to set it self to start when I turn the computer on.

I regularly update these, and where necessary run complete scans of my hard drive.

I'm sure roddy and others have other ideas for you.


Collapse -
Re: Ohh well.......
by MarkFlax Forum moderator / November 6, 2004 9:58 AM PST

Oops he beat me to it!!!


Collapse -
Re: Ohh well.......
by roddy32 / November 6, 2004 10:04 AM PST
In reply to: Re: Ohh well.......

You gave more info for Ray than I did anyway Mark. LOL Besides that I've been told by 3 of the Mods already that double posts are fine, as long as they agree with each other. LOL And YES, Our minds do work the same on this kind of stuff.

Collapse -
Re: Ohh well.......
by phil66 / November 6, 2004 10:20 AM PST
In reply to: Re: Ohh well.......

Hi Mark Roddy
I have the following software:
Adware Personnel Se build 1.05
Spybot search & Destroy
Crap cleaner
Tweak UI reg cleaner
CW Shredder
BHO Demon
Easy cleaner
MRU Blaster
Avast 4 Home
None of the above caught the cws or xupiter
Have now deleted spyferret and spyhunter

Collapse -
Re: Ohh well.......
by roddy32 / November 6, 2004 10:35 AM PST
In reply to: Re: Ohh well.......

You got a great list there Ray, all good stuff. The only one that I haven't heard of is Easy Cleaner but that doesn't mean anything. I also haven't heard anything bad about it either. I would still wait and see what one of the people I mentioned said. They might have you make a HijackThis log and post it in the appropriate Forum to be sure. I'm afraid that is not done here. Whatever you do though, don't ever fix anything with HijackThis until an expert tells you to, that a great tool but it's got to be used properly.

Collapse -
Re hijackthis log....
by phil66 / November 6, 2004 11:03 AM PST
In reply to: Re: Ohh well.......


I sent three different HJT logs to zero Realms,which is one of the places c/net recommended. Got a clean bill of health.

Still would like to know why all the ancient entries in the domain portion of the registry.

Will try Marks suggestion of the start-up list whenever I find it.

Thanks for all the time and effort you have put forth to this inquiry.


Collapse -
Re: Re hijackthis log....
by roddy32 / November 6, 2004 11:08 AM PST
In reply to: Re hijackthis log....

Anytime Ray, I wish I could have helped you more. I still think that Donna or Marianna or a couple of others that frequent this forum can answer your registry questions if you stop back later. Everybody is in different times zones here. LOL

Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


We are giving away 'Black Panther' swag!

Four lucky readers will be taking home *Marvel*ous "Black Panther" prizes, including magazines autographed by the King of Wakanda himself! Giveaway ends Feb. 25, 2018.