It's about IE this time... (it really is!)

[KennyR]

Oh, this is nasty spyware called a 'browser hijacker'. It's like a virus. This took me ages to get rid of until I figured it out (with Amiga.org's help). Spybot S&D and lots of other spyware tools won't remove it.

You need AdAware, and cwshredder. Get cwshredder here or just google for it.

Run cwshredder first, and let it do its business. That will kill the trojan. Adaware will just clean up the crap it left behind.

Then go install XP Service Pack 1 if you don't have it, and remove Java VM if you've got it installed. That'll stop it ever coming back.

[KennyR]

Mikeymike wrote:
What's Java got to do with it?

"CoolWebSearch spyware uses the MS Java VM vulnerability [earlier than builds 3810] and installs itself while visiting some rogue websites."

That's here. It's also said in the cwshredder GUI after cleaning and in many other places.

I didn't have MS Java VM installed at all though when I had it, so presumably it's found a new vulnerability to exploit. Well, it's Windows, take your pick.