Remove coolwebsearch
How to uninstall & removal cool web search browser hijacker

In this series of our getting rid of Spyware and Adware articles, you shall learn about how to successfully remove and uninstall CoolWebSearch and successfully get rid of cool web search from your system.

Remove Coolwebsearch Introduction

Cool Web Search is a collection of browser hijackers. They all redirect your browser to coolwebsearch.com and other sites affiliated with its operators.

What is Cool Web Search and what exactly does it do?

CoolWebSearch is name given to a wide range of different browser hijackers. Cool web search and their variants are very different in code, but their final result it the same. They all redirect users to coolwebsearch.com and other sites affiliated with its operators. CoolWebSearch exists in the following variant forms.

• DataNotary: This is the earliest known cool web search variant, hijacking to datanotary.com. It drops a CSS stylesheet file in the Windows folder and sets it to be used as the user stylesheet for all web pages viewed in IE. The stylesheet includes embedded JavaScript code and tries to guess when the user is viewing porn sites.

• BootConf: This cool web search is similar to DataNotary in the sense that it also drops a user CSS file in the same way as DataNotary. This file points at www.coolwebsearch.com. It also hijacks the home page and all search settings to point to coolwebsearch, and hacks the DNS Hosts file to redirect access of MSN address-bar search to coolwebsearch.com. A program bootconf.exe is also set in your machine to run on every startup, resetting the hijack settings. Finally coolwebsearch.com is added to the Trusted Sites list.

• MSInfo: This is another user-CSS-hijacker, but it points to true-counter.com, which is reported to redirect to global-finder.com.

• SvcHost: This cool web search variant is a hosts file hijacker, which works in a rather unusual way. Its targeted sites (Yahoo Search, MSN Search and all countries’ versions of Google) are set in the Hosts file to point to ‘localhost’ (127.0.0.1). Since the local host (the computer the browser is running on) is most often not running a web server in case of user computers, this results in an error page. It is in this error page that SvcHost does it action. It hijacks this error page to the CoolWebSearch site slawsearch.com.

• DNSRelay: This cool web search is an address bar search hijacker and is implemented as an IE URL Search Hook. Along with search phrases, entering any site name into the address bar without a leading ‘http://’ or ‘www’ will result in a search aimed at activexupdate.com, which is a CoolWebSearch site redirecting through yellow2.com to allhyperlinks.com.

• PnP: This exists in the form of a search hijacker that hides inside the ‘inf’ folder usually used for storing device driver information. Its hijacker file oemsyspnp.inf is run on each startup, using a slightly different install command each time. This command cycles through install sections 'RunOnce', 'AudioPnP', 'VideoPnp', 'IdePnP' and 'SysPnP', but it does the same thing regardless of which section is used, namely hijacking home page and search settings to point at www.adulthyperlinks.com and www.allhyperlinks.com. It also adds activexupdate.com to the IE ‘Safe Sites’ list, for unknown purposes (this is not the same as the Trusted Sites Zone).

• MSSPI: MSSPI is a search results hijacker implemented as a Winsock2 Layered Service Provider (a fairly low-level networking component, which is tricky to remove). It targets Google, Yahoo and Altavista, opening advertising from unipages.cc.

SPYWARE / ADWARE COOLWEBSEARCH UNINSTALLING & REMOVAL INSTRUCTIONS

How to easily delete uninstall and remove CoolWebSearch and get rid of it for free

Download spy sweeper.to get rid of CoolWebSearch and protect your computer from all such spyware pests which infect your computer. Spy sweeper will scan your computer for Cool Web Search and other adware and spyware and safely remove coolwebsearch. Click Here Now! and download spy sweeper.

How to manually remove CoolWebSearch from your system?

WARNING : Modifying your registry or system files can render your system unusable in case of any error. we strongly recommend you to Download spy sweeper. to safely remove coolwebsearch.

1. Remove coolwebsearch: DataNotary, BootConf and MSInfo variants

• Turn off user-style sheet option at Tools->Internet Options->Accessibility in your Internet Explorer.
• You should now be able to delete the user stylesheet from the Windows folder. With DataNotary it is called 'default.css'; with MSInfo it is called 'oslogo.bmp'; with Bootconf it may be either.

• Delete the line “run=C:WINDOWS..PROGRA~1COMMON~1MICROS~1MSINFOmsinfo.exe” from win.ini file in your Windows folder. This line may be changed a little on different systems, but will always point to msinfo.exe.
• Delete the “c:ProgramFilesCommon FilesMSInfo' folder.

• Open the registry and find the key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
• Delete the bootconf.exe or svchost.exe entry
• You can then delete the bootconf.exe or svchost32.exe file from the System folder (called 'System32' on Windows NT/2000/XP).

• Find the file ‘HOSTS’ with no extension in the driversetc folders in your System folder
• Either edit it to remove the hijacker entries, or simply delete the file.

5. Remove coolwebsearch: PnP variant

• Find the registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
• Delete the SysPnP entry
• Also delete the oemsysinf.pnp file from the 'inf' folder inside your Windows folder.

• This is very tricky to remove by hand as this can result in loosing your internet connection. It is advised that you do not do this by hand.
• Open the registry key HKEY_LOCAL_MACHINESystemCurrentControlSetServicesWinSock2 ParametersProtocol_Catalog9Catalog_Entries
• Delete the subkeys starting with the path of msspi.dll
• Renumber the remaining subkeys, and set the Num_Catalog_Entries value in the Protocol_Catalog9 key to match the highest numbered subkey left.
• Open the registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
• Delete the a msupdate entry if it is there
• Restart the computer and you should be to delete msspi.dll in the System folder (called 'System32' on Windows NT/2000/XP), along with msupdate.exe if it is present.

• Open a DOS command prompt window and enter the following commands:
• cd "%WinDir%System"
• regsvr32 /u dnsrelay.dll
• Restart
• You should be able to delete the file 'dnsrelay.dll' in the System folder (called 'System32' on Windows NT/2000/XP).

Congratulations, you have successfully removed CoolWebSearch from your computer by the remove cool web search uninstalling and removal guide.

In general we strongly recommend to use a anti spy software to remove coolwebsearch or other browser hijackers as manually uninstalling and editing can seriously hurt your system.

Click Here Now! and download spy sweeper. Spy Sweeper wil scan your computer for cool web search and other spyware and adware. Use it to SAFELY remove cool web search and all of its components. Protect your privacy NOW!