Hi,

Download the following exe, run it and safe the file in your desktop.

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

Then check out for lines like below:

R1 - HKCU\Software\Microsoft\Internet Explorer,Default_Search_URL =
http://www.searchnow.ws/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://c:\windows\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://c:\windows\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
about:blank
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP =
about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP =
about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,AutoConfigURL = http://proxy:8080
R3 - URLSearchHook: (no name) - _{6E6DD93E-1FC3-4F43-8AFB-
1B7B90C9D3EB} - (no file)
O2 - BHO: (no name) - {53E10C2C-43B2-4657-BA29-AAE179E7D35C} - (no
file
O2 - BHO: BHObj Class - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} -
C:\WINDOWS\NEM212.DLL (file missing
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -
C:\WINDOWS\WSEM214.DLL (file missing

Even if this doesnt work then start ur system in safe mode and do
same things which I said above. Is your adware & spybot updated. If
not pls do update and scan it again.

Have nice day.


--- In IThelp@yahoogroups.com, "pattu69" <pattu69@y...> wrote:
>
>
> hi people
>
> This is Mukul from India.Some spyware has got loaded in the system.
> I used Ad-aware 6.0 personal and Professional both but couldn't
get
> rid of the problem.
> I also scaned my system with Spybot (latest version).Spybot
detects
> the spywares.Even if i delete the spyware and again scan the
system
> the same spywares r found again.
> The name of the spyware is coolwwwsearch.allcybersearch
> I am not able 2 use IE due to this spyware.Sometimes IE windows go
on
> opening to such a large extent that the systems hangs and i have
to
> restart the system.
> I would be extremely grateful if anybody out there can help me in
> solving this problem.
>
> Mukul.