CoolWebSearch (also known as CoolWWWSearch or abbreviated as CWS) is a spyware or virus program that installs itself on Microsoft Windows based computers. It first appeared in May 2003.

Effects

CoolWebSearch has numerous capabilities when it is successfully installed on a user's computer.[1] The program can change an infected computer's web browser homepage to 'coolwebsearch.com', and though originally thought to only work on Internet Explorer, recent variants affect Mozilla Firefox as well as Google Chrome, and others. Infected computers can create pop-up ads which redirect to other websites, including pornography sites, collect private information about users, and slow the connection speed.

CoolWebSearch uses various techniques to evade detection and removal, which many common spyware removal programs are unable to properly remove the software.[2] Since CoolWebSearch is bundled with other potentially unwanted software or add-ons, users need to uninstall those unwanted programs first, or CoolWebSearch can return, even after the user has changed their home page and primary search engine.

Some versions of CoolWebSearch are installed through what's known as 'drive-by installation', in which browsing an infected webpage can automatically install CoolWebSearch without the user's knowledge. CoolWebSearch attempts to evade detection by not labelling the ads it presents as such, nor does it provide a EULA, nor any data about itself nor is there a website directly associated with it. Certain variants insert links on random text, leading to advertisements. Others attempt to access websites which are redirected to pay-per-click search engines which may install more malware display ads. Some variants of CoolWebSearch also add links to pornography, and gambling sites to the user's Desktop, Internet Explorer's bookmarks and history.[3] Certain versions attempt to edit users' trusted sites and modify security settings as well as to hide from removal programs. Variants are often named for the effects they have such as msconfig, Msoffice, Mupdate, Msinfo and Svchost32.

Possible creators

The website claims that they are not responsible for the browser hijacking. They run an affiliate program that pays affiliates to direct others to their site with paid advertising links. Coolwebsearch.com's terms of service use the laws of Quebec, Canada, whilst their DNS registration lists an address in the British Virgin Islands, and their web server appears to be run by HyperCommunications in Massachusetts, USA. CoolWebSearch is also linked to CoolWebSearch.org and appears to be related to webcoolsearch.com. Investigation connected Stanislav Avdeyko, the Koobface hacker, with CoolWebSearch.[4]

Variants

  1. CSS Cool Search Search
  2. CWS.Addclass
  3. CWS.Alfasearch
  4. CWS.Bootconf
  5. CWS.CameUp
  6. CWS.Cassandra
  7. CWS.Control
  8. CWS.Ctfmon32
  9. CWS.Datanotary
  10. CWS.Dnsrelay
  11. CWS.Dreplace
  12. CWS.Gonnasearch
  13. CWS.Googlems
  14. CWS.Hiddendll
  15. CWS.Homesearch
  16. CWS.Loadbat
  17. CWS.Look2Me
  18. CWS.Msconfd
  19. CWS.Msconfig
  20. CWS.MSFind
  21. CWS.Msinfo
  22. CWS.Msoffice
  23. CWS.Msspi
  24. CWS.Mupdate
  25. CWS.Oemsyspnp
  26. CWS.Olehelp
  27. CWS.Oslogo
  28. CWS.Qttasks
  29. CWS.Q-url3
  30. CWS.Realyellowpage
  31. CWS.Searchx
  32. CWS.Smartfinder
  33. CWS.Smartsearch
  34. CWS.Sounddrv
  35. CWS.Svchost32
  36. CWS.Svcinit
  37. CWS.Systeminit
  38. CWS.Systime
  39. CWS.Tapicfg
  40. CWS.Therealsearch
  41. CWS.Vrape
  42. CWS.Winproc32
  43. CWS.Winres
  44. CWS.Xmlmimefilter
  45. CWS.Xplugin
  46. CWS.Xxxvideo
  47. CWS.Yexe

Affiliate variants

  1. CWS.Aff.iedll
  2. CWS.Aff.Madfinder
  3. CWS.Aff.Tooncomics
  4. CWS.Aff.Winshow

References

  1. ↑ "Encyclopedia entry: Spyware:Win32/Coolwebsearch.H". Microsoft Malware Protection Center.
  2. ↑ Russel, Charlie (May 13, 2005). "Dealing with an infected PC". Microsoft. Archived from the original on September 27, 2010. ...many of the Cool Web Search variants can prevent the other anti-spyware programs from doing their job correctly...
  3. ↑ Vincentas (5 July 2013). "CoolWebSearch in SpyWareLoop.com". Spyware Loop. Retrieved 28 July 2013.
  4. ↑ The Koobface malware gang - exposed! Indepth investigation by Jan Droemer and Dirk Kollberg, SophosLabs
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.