Greetings from a long-time lurker and first-time poster.

When I opened Add/Remove Programs from the Control Panel, I found "Cowabanga by OIN" listed among the software. It wasn't there a week ago. Clicking on the Add/Remove button produced this message: "To confirm your intention to remove this ad supported product, please enter the 4-character code shown below", followed by a set of characters.

If this is malware I don't want to do ANYTHING it says without checking first. A search here on "Cowabanga by OIN" produced nothing relevant, so I appeal to the experts for information on how to safely remove this.

Thank you.

Have you tried AdAware or Spybot to get it out?

Sorry, I should have mentioned that I have both Ad-Aware and Spybot S&D, updated just yesterday (1 July 2006). I used to run AVG Free but since the system recovery last month that won't work on my machine; I think I need to delete it and re-install. Until then I suppose I can do an online free virus scan, like Panda or House Call.

To answer your question, the suspect program didn't show up on either Ad-Aware or Spybot. Will running them in Safe Mode make any difference?

You should ALWAYS run tools like these in safe mode with system restore turned off if you believe you are infected with something, or want a more thorough scan.

Cowabanga

We've heard that a million monkeys at a million keyboards could produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true

Report Offensive Follow Up For Removal

GX1 Man, thanks. I ran both in Safe Mode and each detected one item, but Cowaganga is still on my comp. In fact it was putting up ads while I surfed the links below.

Thank you for the search page, jboy. From what I've read on the linked sites it looks like I need to 1)download and run Highjack This, 2)disable System Restore at some point, and 3) download and run ewido. Number 1 especially looks like a lot of work for this newbie but I'll poke around this site some more for tips.

What I haven't seen addressed, and what I perhaps should have asked in the first place, is what happens if I follow Cowabanga's own instructions for removal? Not that I would, it's malware after all, but I wonder if someone else has.

The saga continues...

Those usually hook you with a further infection, like clicking on OK to an offer to "clean my PC".

Ewido and Hijack seem a reasonable place to go next.

Shouldn't that be Cowabunga dude!? :)

Life is more painless for those who are brainless.

Thanks GX1 Man, that's what I suspected.

As per the suggestions I attempted to install ewido but after thirty minutes of downloading I got this message: "Sorry, ewido anti-spyware needs Windows 2000 and above to be installed." Grrrr.

The GOOD news is, I was able to re-load and run AVG Free. The bad news is that it's finding the Cowabanga (in both Normal and Safe Mode) but can't eliminate it. I'm just going to have to swallow hard, disable System Restore, and try again.

If that doesn't work and I must resort to Highjack This, should I post the log in this thread? If not, should I start another thread in this forum or move to another forum, and in that case, which one?

I thank you all for your replies.

Put it in Security and Virus (at the top).

I've gotten Cowabunga installed several times, and have been trying to figure out how.

I have also gone several times through the little removal confirmation routine mentioned, without incident. If you want to see more, look in program files for the Cowabunga folder. It even has a license agreement describing the software (straight ad ware). The folder does NOT get removed with the uninstall.

It appears to me that Myspace.com, and possibly also Sconex.com (sites my teen son visits) are downloading the software--seemingly from almost any link clicked there. What I'm not sure of is whether they are the whole problem, or just part of it. But after uninstalling Cowabunga, I am clicking on links in MySpace and watching all kinds of bad blank popups and a download window come up, and then I'm finding Cowabunga back again.

I'm thinking it's a relatively benign test for something much nastier to come.

My question for anyone who has the Cowabunga problem is, have you visited MySpace.com or Sconex.com?

Paul Siraisi -
To answer your question, I have never knowingly visited MySpace or Sconex. As best I can tell the first sign of infection was that my ad blocker* ceased working.

"I have also gone several times through the little removal confirmation routine mentioned, without incident [...] The folder does NOT get removed with the uninstall."
Thanks for reporting that.

"I've gotten Cowabunga installed several times, and have been trying to figure out how."
Does that mean you were able to entirely remove Cowabanga each time? I was unable to do so using AVG Free and I'm getting ready to post a Highjack This log, but if you have a less involved solution I would like to hear it. Thanks again.

*Mike's ad blocking hosts file (from http://www.everythingisnt.com/hosts.html)

I first noted cowabanga after visiting myspace.com. It's characterized by blank pop-ups and a myriad of pop-up advertising.

I'll try Highjack. Thanks for all the posts.

In the last week, Cowabanga by OIN has downloaded itself to my drive several times, whenever (and only when) a particular banner ad on the Neopets site comes up. This particular banner, associated with a company deckoutyourdeck.com has been showing for many months, but this problem is new, so it would appear that the ad has been hacked.

I have had no difficulty with uninstalling the program through the Windows Add/Remove Program function, but the program folder is not deleted on reboot.

On one occasion, before I uninstalled the program, several icons on my desktop changed to the icon used by Cowabanga (a red drum).

I hope this information is helpful

Sorry for slow, lengthy replies.

My Squirrel:
Does that mean you were able to entirely remove Cowabanga each time?

PaulSiraisi:
Maybe not, based on at least one reference to "Outer Info" (or OIN) I found yesterday in my registry while beating off a new, more unpleasant problem. Unfortunately, in the thick of things I didn't take note of the exact item, and am not sure of any relationship between Cowabunga and the new problem.

For anyone reading this, I'm not qualified to be mucking around in my registry, and almost destroyed my computer yesterday using Spybot. So, grain of salt.

Spybot has never found Cowabunga, but yesterday it suddenly found many other items, couldn't remove them all, politely asked if it could run on re-boot, then broke my registry, and Windows. Fortunately, c: scanreg/restore resurrected them.

My Squirrel:
"What I haven't seen addressed, and what I perhaps should have asked in the first place, is what happens if I follow Cowabanga's own instructions for removal? Not that I would, it's malware after all, but I wonder if someone else has."

Here I am in all my glory. What I had after removal (including manually deleting the Cowabunga folder), was a seemingly well-behaved computer, until yesterday.

As I said, I'm not positive what I experienced yesterday was the explosion of some kind of Cowabunga/OIN time bomb--but at least one OIN-related registry entry was there, and I came across it while searching for one of the 5 terms below.

So just in case, here are two terms whose related registry entries I had to manually remove (after restoring the broken registry): Augcsv and Wrndu.

This removal was to stop some persistent alien executables that were being created and running in the Windows folder on startup. These were qmsot.exe, sknla.exe and bdcktx.exe. What they do I don't know, but I know they shouldn't be there.

Any Cowabunga victims here have those (qmsot shows running in Task Manager)?

Thank you PaulSiraisi for the update. Myself, I wouldn't know a registry from a hedgerow, and I was able to remove Cowabanga only because I started a new thread (http://www.computing.net/security/wwwboard/forum/18928.html) in the Security and Virus forum. I hope it can be of help to you.

OIN=Outer Info? I'll have to remember that.

tuvamatic posted: "I have had no difficulty with uninstalling the program through the Windows Add/Remove Program function, but the program folder is not deleted on reboot."

I did finally go to Add/Remove Programs and follow the directions to remove Cowabanga, but ONLY after doing what jabuck recommended in the thread I listed above. As far as I can tell the b*gger is actually gone from my machine.

MY KIDS HOOKED ME UP WITH COWABUNGA THREW ONE OF THERE VIDIO GAME CHEAT SITES. HERE IS HOW I GOT RID OF COWABUNGA BY OIN ON WINDOWS XP PRO. FIRST I USED THE AD REMOVE PROGRAMS. I TYPED IN THE THE LETTERS SHOWN FOR MALEWARE ECT.. BUT BEFORE I REBOOTED I ALSO DID THE FOLLOWING, GO TO YOUR PROGRAMS FOLDER IN C:\ DRIVE OR WHAT EVER DRIVE YOUR USING TO HOLD YOUR OPERATING SYSTEM ON FOR ME IT WAS F:\ BUT ANY WAY, IN THE PROGRAMS FOLDER HIGH LITE THE COWABUNGA FOLDER THEN CLICK ON THE TOOLS TAB THEN CLICK ON THE VIEW TAB SCROLL DOWN AND UNCHECK THE BOX THAT SAYS USE SIMPLE FILE SHARING THEN HIT APPLY AND THEN DELETE THE COWABUNGA FOLDER REBOOT AND THEN RECHECK THE USE SIMPLE FILE SHARING BOX. I HAVE REBOOTED 10 TIME SINCE THEN AND HAVNT SEEN IT AGAIN I HOPE IT WORKS OUT FOR EVERY ONE ELSE!

JOHNDEERETECH

The game Cowabanga by Clickspring LLC in conjunction with OuterInfo.com is indeed some malicious malware. Please be advised, though, by using the downloaded uninstall and typing in the characters in the 'Catcha' box (which uses human computational skills a computer cannot match as of yet), you are likely solving the 'Catcha' for opening a new email account. This is then forwarded to the spammers, who have the registration form prefilled out for that particular 'Catcha'. Avoid using this uninstall if possible. I will be reporting this malware to Ad-Aware, and it couldn't hurt for others to do the same. This software does install itself automatically without prompt on ones computer from myspace.com, apparently just from watching videos there. Contacting myspace.com, as cleaning it up from that end would seem the best solution, is an option--although if they get a cut, forget it.

bugs

To follow up, this is an email containing the facts in my circumstance sent to myspace.com customer service:

The game 'Cowabanga' from Clickspring LLC, in conjunction with OuterInfo.com, installs itself automatically without any prompt from some sites on myspace.com. I wish I could give you a specific site or sites, but I had visited a number of sites on myspace.com for humorous videos. I do have a complete listing of shortcuts that comprises all the videos accessed which could help. I could also provide a copy of the associated EULA. Just respond if you need and I will be happy to supply. By the way, I have advanced firewall, virus, and spyware protection, which were all in place and operational at the time. My IE security settings are such that they should have also prevented this malware from installing. Despite years of Internet usage, I have never, ever, had a problem like this before, and, because of my intimate knowledge of my computer setup and software, I noticed the addition of the malware almost immediately.

The reason I can be so sure this malware came from myspace.com is because it can be ascertained this was just recently installed on my computer the other day, when the only sites accessed on the internet were all at myspace.com. Moreover, this is evidenced from my IE History, which also shows no internet usage for several days before, or the day after when discovered, either. I am the only user and the only one with access to this computer. My DSL connection is ALWAYS manually disabled unless actively accessing the Internet. I NEVER visit sites likely to pose a risk. All of that may seem overly cautious, but it probably explains why I have never had any viruses, Trojans, worms, malware, etc. heretofore. In addition, researching this problem reveals myspace.com to be a common factor for most afflicted by this parasite.

This Cowabanga 'game' is a particularly malicious form of malware that adversely effects and is harmful to PC's. It is very difficult to remove/cleanse from one's computer, even with the latest spyware removal programs. Note: the uninstall that is advised in the EULA documentation must be downloaded from outerinfo.com. It employs a 'Catcha', or letter box puzzle like those used for opening new email accounts, and will not proceed with the uninstall until solved. This uninstall is very likely being used to profit from spammers and enable them to illegally or illegitimately open new email accounts with which to spam from. If you are unfamiliar with this practice, it is a fairly new, but apparently not uncommon, development in spamming. Once the 'Catcha' is solved, computer-generated completed email registration forms are submitted to obtain new anonymous, disposable accounts. (Some spammers actually pay low-wage workers in overseas sweatshops to solve these 'Catcha' safeguards specifically designed to thwart them.) Be advised that I have never played the Cowabanga 'game', nor did I proceed with the downloaded uninstall provided from OuterInfo.com. I did use Windows Add/Remove to uninstall the game, but it does not appear to uninstall the malware.

I am writing this because cleaning it up from your end is probably the best solution for all concerned. Furthermore, I am sure you do not want myspace.com's image to be tarnished, your reputation damaged, or your revenues endangered thereby by hosting malware on your site that surreptitiously installs itself. For instance, I will not be visiting any myspace.com sites and will advise all I know to likewise avoid and spread the word, until I am satisfied this problem has been resolved, and that myspace.com is committed to good internet practices and a reasonably safe surfing experience there. Hopefully, the responsible party or parties at myspace.com will be at least removed and barred, if not prosecuted or sued.

It's a shame, because the greed of a few will detrimentally effect not only you, the principal host/owner, but the rest of the hosts and users of that site. Not to mention, of course, the numerous innocent victims like myself, who must waste hours resolving the problem, and/or suffer degraded computer and Internet performance, which may include reduced or undesired functionality, and possible loss of--or harm to--data, operating system and programs.

Thank-you for your attention to this matter, and I look forward to hearing from you. Any info describing how to safely and completely remove this destructive piece of malware from one's computer you may be able to provide would be greatly appreciated and passed on, as well.

bugs