Editing CoolWebSearch

{{Short description|Spyware program}}
{{more citations needed|date=November 2008}}

'''CoolWebSearch''' (also known as '''CoolWWWSearch''' or abbreviated as '''CWS''') is a [[spyware]] or [[Computer virus|virus]] program that installs itself on [[Microsoft Windows]] based computers. It first appeared in May 2003.

== Effects ==
CoolWebSearch has numerous capabilities when it is successfully installed on a user's computer.<ref>{{cite web |url=http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Spyware%3AWin32%2FCoolwebsearch.H |title=Encyclopedia entry: Spyware:Win32/Coolwebsearch.H |publisher=Microsoft Malware Protection Center}}</ref> The program can change an infected computer's [[web browser]] homepage to 'coolwebsearch.com', and though originally thought to only work on [[Internet Explorer]], recent variants affect [[Mozilla Firefox]] as well as [[Google Chrome]], and others. Infected computers can create [[pop-up ad]]s which redirect to other websites, including [[pornography]] sites, collect private information about users, and slow the connection speed.

CoolWebSearch uses various techniques to evade detection and removal, which many common spyware removal programs are unable to properly remove the software.<ref>{{cite web |url=http://www.microsoft.com/windowsxp/using/security/expert/russel_infectedpc.mspx |archiveurl=https://web.archive.org/web/20100927110809/http://www.microsoft.com/windowsxp/using/security/expert/russel_infectedpc.mspx |archivedate=September 27, 2010 |title=Dealing with an infected PC |first=Charlie |last=Russel |publisher=Microsoft |date=May 13, 2005 |quote=...many of the Cool Web Search variants can prevent the other anti-spyware programs from doing their job correctly...}}</ref> Since CoolWebSearch is bundled with other potentially unwanted software or add-ons, users need to uninstall those unwanted programs first, or CoolWebSearch can return, even after the user has changed their home page and primary search engine.

Some versions of CoolWebSearch are installed through what's known as '[[drive-by installation]]', in which browsing an infected webpage can automatically install CoolWebSearch without the user's knowledge. CoolWebSearch attempts to evade detection by not labelling the ads it presents as such, nor does it provide a [[EULA]], nor any data about itself nor is there a website directly associated with it. Certain variants insert links on random text, leading to advertisements.  Others attempt to access websites which are redirected to [[pay-per-click]] search engines which may install more [[malware]] display ads. Some variants of CoolWebSearch also add links to [[pornography]], and gambling sites to the user's [[Desktop environment|Desktop]], [[Internet Explorer]]'s [[Internet bookmark|bookmarks]] and history.<ref name=AAA>{{cite news |url=http://www.spywareloop.com/infections/c/coolwebsearch|title=CoolWebSearch in SpyWareLoop.com|author=  Vincentas |newspaper=Spyware Loop |date=5 July 2013 |accessdate=28 July 2013}}</ref> Certain versions attempt to edit users' trusted sites and modify security settings as well as to hide from removal programs.  Variants are often named for the effects they have such as [[MSConfig|msconfig]], [[Microsoft Office|Msoffice]], [[Windows Update|Mupdate]], [[System Information (Windows)|Msinfo]] and [[svchost.exe|Svchost32]].

== Possible creators ==
The website claims that they are not responsible for the [[browser hijacking]]. They run an affiliate program that pays affiliates to direct others to their site with paid advertising links. Coolwebsearch.com's terms of service use the laws of [[Quebec]], Canada, whilst their [[Domain Name System|DNS]] registration lists an address in the [[British Virgin Islands]], and their [[web server]] appears to be run by [[HyperCommunications]] in [[Massachusetts]], USA. CoolWebSearch is also linked to CoolWebSearch.org and appears to be related to webcoolsearch.com.  Investigation connected [[Stanislav Avdeyko]], the Koobface hacker, with CoolWebSearch.<ref name=sophos>[http://nakedsecurity.sophos.com/koobface The Koobface malware gang - exposed! Indepth investigation by Jan Droemer and Dirk Kollberg, SophosLabs]</ref>

== References ==
{{reflist}}

[[Category:Spyware]]