CoolWebSearch
CoolWebSearch is a family of extremely persistent malicious programs which install themselves on Windows computers running the Internet Explorer web browser and then redirect the browser's home page to the search engine at coolwebsearch.com. They first appeared in May 2003.
The software uses innovative techniques to evade detection and removal; indeed many common spyware removal programs fail to properly uninstall all versions of CoolWebSearch. Initial installation (which often happens when people surf for internet pornography) is in most cases facilitated by two bugs in Microsoft's Java virtual machine; fixes for these bugs are now available.
Coolwebsearch.com claims on their website that they are not responsible for the browser hijacking. They run an affiliate program which pays affiliates whenever they direct a user to the coolwebsearch web site and that user then goes on to click on an advertising link (all links there are paid advertising links). Their terms of service use the laws of Quebec; their DNS registration lists an address on the British Virgin Islands, while their web server appears to be run by HyperSpace Communications in Massachusetts.
External links
|
