3.7  Spyware Removal Problems

You might find that the spyware you just deleted comes back the next day when you run the scan again.

This is most likely caused by a spyware program that recreates it self when deleted such as About:Blank or a spyware program that uses processes that cannot be terminated and deleted during the spyware scan. 

Three of the most common solutions are listed below:

1.     The first step is to reboot your computer into “Safe Mode.” This will prevent your computer from loading any non essential programs.  

To get into safe mode, reboot your computer and continually hit the F8 key while booting up.  You will then be taken to a screen where you can choose to start your computer in safe mode.  Once booted up go to the add/remove programs control panel and make certain there are no strange search tool bars or program listed and remove any that are found.  

Then run the Spyware scan again and delete all Spyware found.  Then reboot your computer and see if this resolved the problem. 

2.     This could be related to a spyware program called CoolWebSearch, this is one of the most difficult spyware programs to catch because the creators updated it so often.  Fortunately there is a very simple to use removal tool that is specifically for CoolWebsearch.

http://cwshredder.net/bin/CWShredder.exe 

3.     This could be a variant of About:blank which is a very difficult program to defeat and unfortunately cannot be removed by any one spyware removal program.    

What makes this particular spyware so troublesome is it uses what is called a respawning file.  When the spyware files are detected and deleted this respawning file automatically regenerates the spyware problem thus reinfecting your system. It is hard to get rid of because this file could be named something as innocent as abcgh.jpg  and would not be detected as spyware.  Each time it is recreated it changes the name of the file.  

The best step by step explanation I could find is here:

http://www.bleepingcomputer.com/forums/topict4210.html

Immune Spyware

Some spyware is immune to most spyware removal tools.  Cleaning these invaders off of your system is therefore very difficult.  One common malicious program is CoolWebSearch. 

This is a very annoying program that can harm your computer in several ways, including redirecting your web browser, slowing your computer, causing popup advertisements, or even forcing your system to reboot.  Unfortunately, CoolWebSearch is very difficult to remove. 

You can use the program in two ways.  You may simply want to verify that you have CoolWebSearch on your system.  If you are infected, you can use CWShredder to remove CoolWebSearch from your computer.

To see if your system hosts CoolWebSearch: 

1.   Click the “Check For Update” button.  If the program determines that you do not have the latest version of CWShredder, follow the program’s instructions to obtain the latest update. 

2.   Click the “Scan Only” button. 

3.   When the scan is finished, click the “Next->” button. 

To scan your system and remove CoolWebSearch if it is found: 

1.   Click the “Check For Update” button.  If the program determines that you do not have the latest version of CWShredder, follow the program’s instructions to obtain the latest update. 

2.   Click the “Fix->” button. 

3.   When the scan and repair is finished, click the “Next->” button.

<< Chapter 3.6 - Spyware Scan: Step By Step | Chapter 3.8 - Log File Analysis >>