ANYONE Get This Fucking Coolwebsearch POP-UP
 

This fucking thing is a scurge and I hope the Cocksucker that wrote it dies of maggots in his asshole!
It's been on different boards and it's a program ya get doing reviews that writes a redirect pop-up whenever you go to certain sites, might be reading keywords on the site you're going to..
It changes your start page but that's no biggie, even SpyBot doesn't get it out!

HTML I made of the VS of the Pop-Up when using IE
http://www.theouthouse.net/Abuse/CoolSearch.html

I think this is the site that wrote it in with the dialers, anyone see anything to help figure out where the fuck it's at???
This HTML is a copy of the VS that was sent to Cogent...
http://www.theouthouse.net/Abuse/CoolFile2.html

cool

shitty... i have kinda the same problem. i get redirected at random to sexbbc.com. none of the spyware progs seem to pick it up. anyone else getting redirected to sexbbc?

I know their host in Oklahoma, I'll call them Monday and see what I can find out about sexbbc
TYhey were also hosting a Dork that was stealing Gallerys and redirecting them..

Host Name : sexbbc.com
IP Address: 66.159.20.50

OrgName: Williams Communications, Incorporated
OrgID: WLCO
Address: One Williams Center
City: Tulsa
StateProv: OK
PostalCode: 74172
Country: US

NetRange: 66.159.0.0 - 66.159.31.255
CIDR: 66.159.0.0/19
NetName: WCG-BLK-2
NetHandle: NET-66-159-0-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: STLDNS1.WCG.NET
NameServer: TULDNS1.WCG.NET
Comment: TO REPORT ABUSE, PLEASE CONTACT : [email protected]
RegDate: 2002-07-16
Updated: 2002-11-06

TechHandle: CS1473-ARIN
TechName: Smith, Cindy
TechPhone: +1-314-595-6081
TechEmail: [email protected]

TechHandle: TFR1-ARIN
TechName: Friese, Todd
TechPhone: +1-314-595-6093
TechEmail: [email protected]

OrgTechHandle: CS1473-ARIN
OrgTechName: Smith, Cindy
OrgTechPhone: +1-314-595-6081
OrgTechEmail: [email protected]

OrgTechHandle: TFR1-ARIN
OrgTechName: Friese, Todd
OrgTechPhone: +1-314-595-6093
OrgTechEmail: [email protected]

OrgTechHandle: TFR2-ARIN
OrgTechName: Friese, Todd
OrgTechPhone: +1-314-595-6093
OrgTechEmail: [email protected]

I give you a clue
coolfreehost.com
:eatmouse

Thanks, almost the same iP and with cogent....
What do ya know about theM????

This is starting to make more sense now, this IP is someone that steals Gallerys and uploads them on his domains.. Adds new recips and when they show Traffic he turns them into redirect hells..
Host Name : coolfree-porn.com
IP Address: 65.77.83.64

coolfreehost.com own the search engine, they are prolific spammers but do not like to have the connection known publicly.

oops I let out a secret :Graucho

It's funny but if ya track alot of them back they come back here..
Domain: maximumhost.com
Registrant:
HyperSpace Communications Inc
P.O. Box 193
P.S. Champlain
Lasalle Quebec H3P 3J1
CA
Domain: coolfreehost.com
Registrant:
HyperSpace Communications Inc
P.S. Champlain
Lasalle Quebec H3P 3J1 CA

And there's no such town or place as Lasalle Quebec H3P 3J1 CA
That's bad info on a Domain registration and should be reported..LOL:BangBang:

http://reports.internic.net/cgi/rpt_whois/rpt.cgi
sometimes I can be a right bastard :Graucho

yea, I had this thing, my son got rid of it by deleting the files default.css & bootconf.exe, think they were in the windows directory or windows/system32...

He also went to to system tools...startup & deleted the entry for bootconf.exe, then to the registry & deleted all the entries for these 2 files & either deleted or changed the entries for all references to the url

http:// %77%77%77%2e%63%6f%6f%6c%77...67%69?%31%30%30 about :blank

this cleared the shit for me, hope it will help you all...

he said the bootconf.exe was the file that rewrites to the registry on startup & the default.css was the file that triggered the popups when you hit a site with an adult counter such as sextracker.

if you're a little skiddish about deleting the files, until my son came over, I just made the default.css a blank file & changed my home page back to the original. But this is a pain because you have to redo it after each startup

thorn...

I've had dealings with a few more of his Cool domains but this guy is a feal fuckup and hurts all of us..
I may not be the brightest star in the sky but I do know what I'm doing and I've got a pop-up for coolwebsearch that hits me when I use IE like crazy when I go to a different URL or hit refresh!
I ran SpyBot and got rid of a ton of shit but can't find this for shit! No Temps, NO cookies and nothing in search..
If I had to make a guess it hits me with the pop-up or redirects me to a different url depending on the Keywords on the URL I click on..
I figured with all the brains in here SOMEONE would know how ta find this fucking thing!

Thanks for the Heads up on the Host tho.....


IN FACT IF SOMEONE CAN TELL ME HOW TO GET RID OF THE FUCKING THING AND I DO AND BE THE FIRST ONE I'LL GIVE THEM 1 GOOD MAIN PAGE LISTING IN AdultBuffet A WEEK FOR A MONTH!!!

As for Lasalle Quebec......
It does exist. It's a burrough or district on the island of Montreal.
Don't know about the postal code, but seeing that it's a post office or postal station, I'm figuring it's also correct.

Hi
I saw that on another board and ran a search, don't have any of them..

http://www.surfsecret.com/products/s...ent_issue.html
I think that might help you out.

I'm off to bed right now but if you want a little revenge I'll let ya into a few more secrets the next time I spot you on here :)

Don't know if one of these will work for you, but found this link today - my brother has this gift to find nasty virus and spyware all installed and dominating his computer.

http://www.spychecker.com/ I installed x-clearner.......worked for me.

Thanks for the help, email me tomorrow...Send it to
[email protected]
and I'll know it's from you..Thanks Again!

Lasalle Quebec H3P 3J1 CA The CA at the end stands for Californin tho..I saw one the otherday that was from Florida, Bahamas East Indias

If anyone gets that MF Coolwebsearch shit and can't get rid of it most of the SpyBot and other programs DON'T work..It took me 3 days to get rid of that shit without getting it back..
THIS works and it's FREE..Check it out...
And Download THIS
Hijackthis
http://www.spywareinfo.com/~merijn/

Interesting ...
I have installed Sex.com's toolbar.
It said it installed - twice.

I have no idea what it installed.
I have no idea where it is installed.

I see no change to my browsers.

Has anyone installed Sex.com's new toolbar?
Has anyone un-installed Sex.com's new toolbar?

Oh - On a Win95 'puter.

Win 95 !!! That was before Plug and Play, I don't think they even write stelth shit for them anymore...
Download thet "Highjackthis" in my link before and run it, you'd be surprised the shit it finds..

Did you have that same coolwebsearch???
That's the worse shit I've run across in over 6 years..And I'm not going to forget the crap that it put me through..
It would be funny if a few people emailed his host a vidoe around 500meg, or maybe someone spamed a few 100,000 pcs of email all his way by accident..

= = = = = QUOTE = = = = =
Win 95 !!! That was before Plug and Play, I don't think they even write stelth shit for them anymore...
Download thet "Highjackthis" in my link before and run it, you'd be surprised the shit it finds..
= = = = = = = = = = = = = =

Ya - that's what I figured. They don't support 95.

End yep - it's about time I trade the old dinasour in for something portable. I keep stalling until the price of laptops allow me to play more recent games.

It seems laptops out sold desktops recently.
I'll have to check out the prices again.

I know the moneys different in the Frozen North but the price of puters is nothing now days..
I paid almost 3 grand for a tower 4 years ago and I bought one 3 months ago 50 times better for less than 900.00..
You can get a 1.8ghz cpu and 256mg ram with 30 gigs of hd for 500.00 American with a Monitor from Dell now..
You should think twice about getting as laptop tho, takes the fun out of everything..

Ya know I can remember when a Canadian Dollar was worth $1.18 American!

Toker,

I got hit with Coolwebsearch shit last week or so... I agree it's the worst piece of shit I've seen in ages.

I posted on the board - see this thread

http://www.gofuckyourself.com/showth...hreadid=147724

HiJack This did delete most of the nasty files, but you need to hack a bit of the registry to get rid of it fully:-
See the reply in that thread by Mojo Rizin, it worked for me.

This is based on info from last week using the manual fix .. I don't know if the Spybot writers have made an update with an automatic fix in yet.

Do you know how you got it? I'm guessing I picked it up when I reinstalled last week and forgot to set my security settings for ActiveX...DUH!

Cheers,
Dave

hey Toker Im having the same problem... I just downloaded hijack this and Im checking it out if you have any tips hit me up

yea this is one of the worse ones cant seem to get rid of it by normal means very fustrating and I also got it when visiting a gallery that asked for a dailer then everything went to shit after that :helpme

Well Hijackthis did get rid of all of it...I'll post a thread later about the asshole that's spreading it and I got it doing reviews..
It's in ya Documents and temps....

Hijackthis does get it all, ya don't have to do anything yourself..
PS..Thanks for the link to the prev thread tho

Here I made an HTML out of the VS that was one that started it, there's ya Dialer also and the The Asshole that made the pages name is
meta name="author" content="Sebastano Perero
Too bad it didn't list his mothers name and the Dog she fucked to have him in the first place!

Glad to see this thread. I got hit yest6erday too, and could not get rid of it with the other scumware removers.

Im going to try hijackthis right now.

Thanks Toker :)

Sebastano Perero? That's a familiar name--I think he owns a TGP; I could swear I've come across it while submitting.

I finally got rid of it! Thanks for the advise! it was truely eventful :D the net is a wireless jungle!

I'd rather get a dose of the Clap than get anything like that again.. And if you read the other boards alot of people are getting it!
...I looked in every file and folder where it could have been hidden and never found all of it..
I tried 3 different downloads people said would get rid of it and none did..The only was Hijackthis..
This is far from over tho, it's getting to be a bigger topic everyday..
It's a web between Hosting, click for bucks and Lazy Webmaster..
They must be passing this out like trading stamps on Gallery submissions, Cookies (Not Girl Scout) and just you surfing to one of their traps..
I had a list of the different sites it redirected ya to besides the search pop-up..If I get time I'll post it tomorrow..

He sounds like the God Father of Retards and he'll probably read these threads...
Fucking other webmasters tho is worse than Pimping ya sista!

Like anyone wants to hear from a self admitted webmaster that has nude pictures of minors on there site on anything.

JUST IN CASE

Thewww.coolwwwsearch.com is added to the TRUSTED sites.

Also this website name is entirely encoded in
decimal ascii %VAL system, so for example
the www is encoded as %71%71%71.
So it doesn't show up in a normal search.

Glad to here it..I don't think we've heard the end of that shit tho, too many people involved and too much click money!

:(

I've tried EVERY suggestion listed above, and on the other thread.

I still cant get rid of it :(

Hijackthis gets rid of it untill I reboot. There must be a file that needs to be deleted, that Im overlooking.