About CoolWebSearch.IEFeats

Also known as: TROJ_IEFEATS.A, CWS.Aff.Winshow.5

Files: IEFEATSL.DLL, MSIESH.DLL, mshp.dll, syskd.dll, winug.dll, iefn.dll, ield32.dll, winkq.dll, IEAL.DLL, wincq32.dll, SYSUT32.DLL, msea32.dll, IEMB32.DLL, SYSBS32.DLL, sysca32.dll, msqx32.dll, winmd32.dll, winph32.dll, winxw32.dll, mshy.dll, iewr32.dll, syssz32.dll, winue32.dll, mspo32.dll, sysqr.dll, mskz.dll

CoolWebSearch.iefeatsl also called TROJ_IEFEATS.A and CWS.Aff.Winshow.5, is a browser hijacker, implemented as two browser helper objects. If your homepage is redirected to 'www.search-aid.com' or if the browser's address bar show 'res://mshp.dll/index.html', you probably have this hijacker on your system.

There are many variants of CoolWebSearch.iefeatsl, trying to hide using pseudo-random names for its files and folders.

Removal Instructions

Automatic Removal:

CWS.IEFeats can be detected and removed Automatically by SpyEraser.

Manual Removal:

Follow these steps to remove CWS.IEFeats from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

1. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
    
2. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {587DBF2D-9145-4c9e-92C2-1F953DA73773}', 
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {FD9BC004-8331-4457-B830-4759FF704C22}',
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {587DBF2D-9145-4c9e-92C2-1F953DA73773}',
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {FD9BC004-8331-4457-B830-4759FF704C22}',
   if they exist.
    
3. Exit the registry editor.
    
4. Restart your computer.
    
5. Delete the directories listed below. It is likely that only one of them will be present:
   %AppData%\IEFEATSL
   %AppData%\syskd
   %AppData%\winug
   %AppData%\iefn
   %AppData%\ield
   %AppData%\winkq
   %AppData%\IEAL
   %AppData%\wincq
   %AppData%\SYSUT
   %AppData%\msea
   %AppData%\IEMB
   %AppData%\SYSBS
   %AppData%\sysca
   %AppData%\msqx
   %AppData%\winmd
   %AppData%\winph
   %AppData%\winxw
   %AppData%\winxw
   %AppData%\mshy
   %AppData%\iewr
   %AppData%\syssz
   %AppData%\IEAL
   %AppData%\winue
   %AppData%\mspo
   %AppData%\sysqr
   %AppData%\mskz
   Note: %AppData% is a variable. By default, this is 'C:\WINDOWS\Profiles\%UserName%\Application Data' or 'C:\WINDOWS\Application Data' (Windows 95/98/Me) or 'C:\Documents and Settings\%UserName%\Application Data' (Windows NT/2000/XP).
   Note: %UserName% is a variable. This is set to your username.
    
6. Start Microsoft Internet Explorer. In Internet Explorer, click Tools -> Internet Options. Click the Programs tab -> Reset Web Settings.

Removal Instructions for Other Adwares & Spywares