Hi; Previously in this forum "Phil" asked a question about CWS Scan Only, and "safeTsurfa" provided a very concise answer about the information contained in the log. I decided to try it myself, and based on what safeTsurfa said, and what I find in my log, I'm a little concerned about the CWS entries. The odd thing is, I show up as being clean when doing CWS Fix. So, if someone can provide me with the following: 1) Am I infected? and 2) If so, what do I do? Thanks Pat Found Hosts file: C:\WINDOWS\hosts (116 bytes, A) Found CWS.Control (if filesize is over 50k) file: C:\WINDOWS\control.exe (2112 bytes, A) CWS.Oslogo (if value is 2) Registry value: Domains: *.coolwebsearch.com [*] dword:4 CWS.Oslogo (if value is 2) Registry value: Domains: *.coolwwwsearch.com [*] dword:4 CWS.Googlems.2 (if value is 2) Registry value: Domains: *.xxxtoolbar.com [*] dword:4 CWS.Googlems.4 (if value is 2) Registry value: Domains: *.teensguru.com [*] dword:4 Registry value: DefaultPrefix (should be http://) [] http:// Registry value: WWW Prefix (should be http://) [www] http:// Registry value: Mosaic Prefix (should be http://) [mosaic] http:// Registry value: Home Prefix (should be http://) [home] http:// Found Win.ini file: C:\WINDOWS\win.ini (8762 bytes, A) Found line in Win.ini: load= Found line in Win.ini: run= Found System.ini file: C:\WINDOWS\system.ini (2417 bytes, A) Found line in System.ini: shell=Explorer.exe

hi swinny, i have the same results on my machine after a scan so as i see it the results you see are the default settings for your computer. i am not infected in any way so i would not be worried about your results. all the best, murve

Thanks Murve; That's good to hear. I was concerned about the 4 entries starting with "CWS", that make reference to registry entries related to: "coolwebsearch", "xxxtoolbar", and "teensguru". Should I be concerned with these, and if so what to do about them? I guess part of my problem, is not knowing exactly what the log is telling me. Thanks again! Pat

hi swinney, i wouldn't worry about it. this is default for your computer. "CWS.Oslogo (if value is 2) Registry value: Domains: *.coolwebsearch.com [*] dword:4 CWS.Oslogo (if value is 2) Registry value: Domains: *.coolwwwsearch.com [*] dword:4 CWS.Googlems.2 (if value is 2) Registry value: Domains: *.xxxtoolbar.com [*] dword:4 CWS.Googlems.4 (if value is 2) Registry value: Domains: *.teensguru.com [*] dword:4" are you using spyware blaster? if so, you will find these entries in your restricted sites in your internet options. these are sites that spyware blaster protects your machine against. as for the cws program when i scan with it i have the exact same entries in my machine, and am not infected. for your assurance i would scan with adaware, and also with spybot and see what you come up with. all the best, murve

Hi Murve; Whew...thanks a lot for the advice. Yes I do use all those programs, and in fact am just now doing an online scan from Symantec. That's I was wondering how I could be infected. Best to be safe....especially these days, but the progs you mentioned.....adaware, spywareblaster, stinger, etc., and the great advice from forums like these, really help and seem to keep the hounds at bay. Cheers, and thanks again!! Pat