Qoolaid.adware

  • Thread starter Thread starter Ray
  • Start date Start date
R

Ray

Can anybody please tell me how to get rid of Qoolaid.
Norton Systems Works will not remove it and beta doesn't
seem to be able to find it.
 
I checked out the links you suggested. They were very
informative but I counldn't find anything on QoolAid. I'm
99% sure I don't have CoolWebSearch because my homepage
isn't affected. Just these annoying pop ups all the
time. Thank you for your reply.
 
Hello again Ray:

I hope this info. is util to you.


Adware.QoolAid
Last Updated on: March 05, 2005 02:28:43 PM

Type: Adware

Publisher: qoologic.com
Systems Affected: Windows 2000, Windows 95, Windows 98,
Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, Novell
Netware, OS/2, UNIX, Windows 3.x

Risk Impact: High


Intelligent Updater Definitions*
June 19, 2004


LiveUpdateT Definitions **
June 23, 2004


*
Intelligent Updater definitions are released daily, but
require manual download and installation.
Click here to download manually.

**
LiveUpdate definitions are usually released every
Wednesday.
Click here for instructions on using LiveUpdate.


This risk can be detected only by Symantec products that
support security risks. For more information on security
risks, please go here.




Behavior
Adware.QoolAid displays advertisements when you are
browsing the Internet.

Symptoms

Pop-up advertisements are displayed.
Your Symantec product detects Adware.QoolAid.

Transmission
This adware program must be manually installed.



File names:
wtmp.exe
sccmgr.exe

When Adware.QoolAid is run, it does the following:


Drops the file %Temp%\wtmp.exe.


-----------------------------------------------------------
---------------------
Note: %Temp% is a variable. The adware locates the
temporary folder. By default, this is C:\Windows\TEMP
(Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).
-----------------------------------------------------------
---------------------


Drops the file, %System%\sccmgr.exe


-----------------------------------------------------------
---------------------
Note: %System% is a variable. The adware locates the
System folder. By default, this is C:\Windows\System
(Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000),
or C:\Windows\System32 (Windows XP).
-----------------------------------------------------------
---------------------


Displays advertisements when you are browsing the Internet.




The following instructions pertain to all Symantec
antivirus products that support Security Risk detection.


Update the definitions.
Restart the computer in Safe mode.
Run a full system scan and delete all the files detected
as Adware.QoolAid.

For specific details on each of these steps, read the
following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec
program and run LiveUpdate.

2. To restart the computer in Safe mode
Shut down the computer and turn off the power. Wait for at
least 30 seconds, and then restart the computer in Safe
mode or VGA mode. For instructions, read the
document, "How to start the computer in Safe Mode."

3. To scan for and delete the files
Start your Symantec antivirus program, and then run a full
system scan.
If any files are detected as Adware.EnergyPlugin, click
Delete.


-----------------------------------------------------------
Note: If your Symantec antivirus product reports that it
cannot delete a detected file, note the path and file
name. Then use Windows Explorer to locate and delete the
file.
-----------------------------------------------------------

Good luck

Engel

P.D. See the last Note
 
Back
Top