Can someone give me a merry christmas by telling me how to get rid of
Cool Web Search's Svchost32 and Bootconf variations?  Yes, I all ready
have CWShredder, and CoolWebSearch shuts it down everytime I time I
open shredder.  I've used Spybot, AdAware, and Norton Anti-virus, but
it won't get rid of this crappy pest, because the processes are still
running.   When I try to shut down the processes by hitting Ctrl, Alt,
Delete, I get a message saying that the operation is denied!!!!
So, if I can't stop the processes I can't remove it manually either. 
If someone knows of another piece of (FREE) software that I can use to
get rid of this godforsaken piece of malware, it would be extremely
helpful.  HELP!!!!

Hi nockmdead!!

First of all you must read the following notice from the author of CWShredder:
"This removal tool will be updated for any new variants of
CoolWebSearch, as well as new affiliates that are sighted. It can
remove all of the variants mentioned above.
Note that CWShredder is update very often. If you have a copy that's
more than a week old, check for an update first before emailing me
it's not working well."
http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder


You can find the lastest version after the folowing links:
Official link.
http://cwshredder.net/bin/CWShredder.exe 

Official mirror:
http://aumha.org/freeware/freeware.php#cwshred


Some additional notes:
At "THE PARASITE FIGHT" page under "Scan your system regularly"
section I found the following info:
"One variation of the CoolWebSearch parasite has been responsible for
the IEDLL.EXE and PSAPI.DLL problems many Windows users have
experienced; and there are many other variations. If you have the
variation of CWS that removes the General tab of Internet Properties,
remove the parasite then, to restore the tab, use MS-MVP Kelly
Theriot?s patch:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg  "

"Another recent variant, can disable CWShredder and other leading
antiparasite programs. If CWShredder freezes or hanges on you, first
clear your Temp and Temporary Internet Files caches and try again. If
the problem persists, use the CWS.SmartKiller utility:
http://www.safer-networking.org/files/delcwssk.zip    "

From "THE PARASITE FIGHT" at "Windows Support Center - aumha.org" site:
http://aumha.org/a/parasite.php


If you cannot get rid of CWS with the lastest version of CWShredder,
please use HijackThis and (without fixing anything - just post the
log, do not chack to fix any item -) post a log here using the
clarification feature, I will check on it and advice you about which
items must be fixed. Note that HijackThis lists system items and pests
together, so you must know what item are pests and which other are
part of Windows or good programs installed by you (for example related
to antivirus or hardware).

You can download HJT from here:
http://www.spywareinfo.com/~merijn/files/HijackThis.exe
or
http://www.majorgeeks.com/download3155.html

You can find a HijackThis tutorial here:
"Hijack This Tutorial":
Please read this before use HJT.
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42


I hope that this helps you.
Feel free to request for further assistance on this topic. I will be
glad to bring you more help before you rate this answer.


Best regards and Merry Christmas.
livioflores-ga

---

Clarification of Answer by livioflores-ga on 25 Dec 2004 11:31 PST

Hi again!!


The following page could be highly useful to solve your problem:
"doxdesk.com: parasite: CoolWebSearch":
http://doxdesk.com/parasite/CoolWebSearch.html


Hope this helps!!!

---

Clarification of Answer by livioflores-ga on 25 Dec 2004 12:07 PST

Note that the "doxdesk.com: parasite: CoolWebSearch" gives you
instructions on manual removal of variants Svchost and Bootconf. If
you cannot perform one step continue with the others. Then start in
safe mode and try to complete the procedure with the skipped steps.
Also in Safe Mode try to find and delete in the C:\windows\system32
folder a file named kalv****.exe (* = random char), this file is
sometime associated with CWS infection (they come together).

"Getting into Windows Safe Mode":
http://www.computerhope.com/issues/chsafe.htm


Some other guides that will help you:
"Editing the Registry":
http://www.winguides.com/registry/article.php?id=1&page=3

"How To Search for Files and Folders in Windows XP":
http://support.microsoft.com/default.aspx?scid=kb;en-us;308895&sd=tech


Any help that you need with any task, do not hesitate to ask me for it
via the clarification feature.

It's gone now.  Thank you.