Geek wisdom...

[Margay]

...I need some.
Alright, I have a problem and I was hoping one of you could help me. I knew some kind of malware had tried to make changes in my registry because all of a sudden NTOSKRNL.exe was desperate to do some websurfing of it's own. I ran Spybot Search and Destroy and it turned out to be good old CoolWebSearch (aaargghhhh). But... then when I say 'fix it', Spybot Search and Destroy is asking me if I will allow or deny a registry change.

Is it asking me to allow/deny the changes made by CoolWWW? (->deny)
Or is it asking me to allow/deny any changes that need to be made by Seach and Destroy to undo the changes made by Cool. (->allow)

I humbly kneel before you Geeks, grant me your wisdom.

Margay

[RedjackRyan]

That's spybot asking permission to make changes. You should be alright telling it to go ahead.

Coolwebsearch.. <curses fluently> at least you caught it :)

[John L]

And it may not (because CWS is a nasty one) then I'd try the following:


Download CWS Shredder (http://www.download.com/3000-8022_4-10301587.html)

Boot the system into Safe mode (http://support.microsoft.com/kb/315222/en-us)

Run CWS Shedder from safe mode.

Pray.

[paularoid]

Download XCleaner at:
http://www.xblock.com/download-freeware.shtml
http://www.xblock.com/installer.php
http://www.xblock.com/freeware.php
or let me know and I'll send it to you.

Download A2 (a-squared) at:
http://www.emsisoft.com/en/

Download Ad-aware at:
http://www.lavasoft.de/software/adaware/
or let me know and I'll send it to you.

Don't give up on Spybot. When they updated to version 1.4 they fouled up the allow/deny box and they haven't fixed it yet. :mad: I wish they'd get with the program and fix it already. <grumble>
.

[Margay]

Thanks guys,

I'm bringing in the heavy artillery as we speak. CWS, here I come.

Margay
*screams "Die vermin!" as she gets ready to reboot*