Have been hijacked by Coolsearch

Problem removing cws/coolwebsearch/coolsearch.biz

Hi,

I was working on my friend's computer and got very frustrated. The details are below so that other user's won't waste time and maybe make some progress. Note that I had no success but you might find the information below useful.

I didn't successfully remove coolsearch.biz aka coolwebsearch aka cws spyware, however I made some progress towards removing it.

These are the steps that I took.

1) Ran Adaware 6.0: no effect
2) Ran Spybot Search and Destroy: no effect
3) Ran cwshredder version 1.591: destroyed one version of coolsearch.biz but it came back in another variant
4) Ran cwshredder version 2.00: no effect
5) Ran spysubtract: no effect, computer did not install spysubtract
6) Rebooted into safe mode by pressing F8 a few times upon startup.
7) Ran spysubtract again: This time it got installed. This is the only spyware removal tool that I have seen that actually detected (supposedly) all the registry entries for coolsearch.biz (I am aware that cwshredder is packaged into this tool).
8) Deleted the registry keys/files that spysubtract suggested as well as some other spyware: media tickets etc.
9) Rebooted the computer
Coolsearch.biz came back. At this point I wanted to tear my hair out!

Notes:
--------

Interesting behaviour I discovered about coolsearch.biz. If it is already loaded in a browser window, you can surf the sites that it previously redirects. If you close the browser and reopen it those sites will once again be redirected to coolsearch.biz. If you surf those sites in the same browser window as coolsearch.biz has been opened in then it won't redirect you to other sites. After a while however, it will try to redirect you to a porn site 0402 something? which is where I think coolsearch.biz got onto my friend's computer in the first place because it then tried to plant some trojan horses onto my friend's computer; several of them.

Andrew.