One day when I was on my computer (using Spyware Blaster) some popups began to appear with not so good sites (s_x sites - sry but i had to say this) , my homepage was hijacked to www.coolsearch.biz,  www.amazingsearch.com, www.searchexe.com and some more.. (it changed every 5 min), spyware and adware began to be installed in my PC at least 10 were installed in a day and Spybot Search and Distroy can't find a thing!! Strangew sounds begin to play on my computer, my favorites are filled with things i dont want to, the html of a page in IE is changed so that the links all go to www.sexocean.biz - dont go there its a spyware site - so i had to start using Mozilla, my internet explorer settings are changed, some shortcuts are added to my desktop that lead to some sites, and some files with names like iloveyou.exe or sexxxxx.exe or dialer.exe appear in my Windows/System as a Dos .exe (as im here a popup appears) and performs illigal actions (that is what windows tells me!!)

I use Windows XP Home Edition SP1 Norton Antivirus Do you want anything else? Oh I have all the updates for all the programs above!!!

Please help!!

First of all, you must remember to update ur Spybot.

You can try running Ad-Aware (also update it!) but do it in Save Mode (hold f8 while booting ur pc).

Next to that, -ing for your problem also gives some good advises.

First of all, i found this:

CWShredder Remove Coolsearch

A small utility for removing Coolsearch (aka CoolWwwSearch, YouFindAll, White-Pages.ws and a dozen other names). Spybot SD tends to forget essential parts of the hijack, so until it updates, you can just this to completely remove the hijack. Updated to remove the new variants once they come out.

So download CWShredder HERE! and see if that worked. If that doesn't work, try HijackThis and repair all your IE settings and delete the run key from a program called REG33.EXE or REG32.EXE, which is the hijack.

After you've done this, clean up the mess by running Spybot AND Ad-aware once.

thanks it allways work

gonna use now the CWS remover becouse the other one (ad-aware) only removed the html changin, using ie now, but my home page still is hijacked..

EDIT!!!! ---------- I think CWS Remover did the trick, at least it looks like!!! Its all allright now..

Thank you very much, I was getting tired of this! I had it for a month or more!!

And onther thing is you can download the sister tool for spybot s&d I find it A MUCH BETTER one than Spybot S&D....If you would like to download it go to www.lavasoftusa.com ...Tis a nice program!!

My Fav of all time is:

I've used that a few times...But sometimes tis get stuck on a few 6 meg files i got but yes tis a nice one 2

I had that same thing awhile ago, spyware S&D didn't help, ad-aware didn't help, hijackthis didn't even help. All I could do was remove all the files it created, use ad-aware to remove the few things it does pick up, and hope no one reboots my comp. And if they did, I would have to do the whole process over again. The whole thing went on for 2 days, while I was constantly googling, and eventually came across CWS Shredder....Miracle program, the creator is a god in my eyes.

And it was that *unfortunate* incident that made me switch to mozilla(although since mozilla is much better, I guess you could say it was fortunate)

Thank you all but CWShredder did the work, but I'll stay with IE, I think its better (dont't know why, but I dont really like Mozilla) so it had nathing to do with fortunate, just one thing, today(one day after running CWShredder) i runed it again and it deleted the same viruses as yesterday! but they didnot do a thing... Strange..

EDIT: It looks like i'm infected with the CWS.Yexe and the coolsearch affiliate Toolband, everytime i reboot im reinfected!! How can i remove it for good?

Dude.. do you attract Spyware or do you click yes on every download screen you see?

On this PestPatrol site it says it's a large spyware thing. I guess ad-aware should be able to handle it, but i guess CWShredder should be able to kill it to. Start up in save mode and run CWShredder, Ad-Aware and Spybot. That's the best you can do i think...

btw.. do you have a virusscanner?

Yes, I have Norton Antivirus 2003 Proffesional with all the updates, checked myself for virus yesterday, I had none, It looks like a lot off ppl that are using CWShredder are also having the new virus at reboot problem and there are a lot of ppl asking for help on the Merjin.org forum (merjin is the site that created CWShredder) but no answers...

EDIT: Pest Patrol says that dnetc.exe is a pest, it was a normal process but a while ago it started using all my CPU..
Pest Patrol says that it cant delete it but i deleted it manually. anybody got a real dnetc.exe installer?

EDIT2: It looks like I ain't infected now (at least CWShredder says that) but each time i reboot my home page is www.searchexe.biz/passthrough.php?=http://www.msn.com    (msn.com is my default homepage)

Who can help me?

Get a copy of Adaware, update it to the latest definitions and scan your entire system. If you're homepage is still being hijacked, then it is a sign that spyware may still exist on your PC. Adaware is very powerful and will detect a lot of spyware, adware, malware, cookies and dialers. I've always used it and i find it always does the trick when it comes to spyware and such.

I've used Spybot before and I find it's not as good for finding spyware. I had spyware once, Spybot detected nothing, and adaware detected about 30 components.

And when surfing for s*x sites, think before you click

If spybot detected nothing then up your settings on it...The first time i scanned I had over 300+ things to delete