Hijacked again by coolsearch

Last January my homepage was hijacked by search.paga A.K.A. coolsearch. I followed the tutorial but to no avail. You let me post my HJT log...and we deleted the mother@$#@%%. Now, I have been hijacked again. It does not seem affect the computer when I use Mozilla. However, I have followed the tutorial again and I can't get rid of it. Spybot finds "CoolWWWSearch.Yexe" and CW Shredder finds "CWS.Yexe." Every few times I run HJT I get search.paga.

May I PLEASE post my HJT log? It is not very long. I'm confident I can get rid of it again with your help. THANK YOU!!!

-Pvt Coconut

 

Seeing as how you've taken the steps in the sticky, and have posted before, please post your log!

 

I keep running CW Shredder, Spybot, Pest Patrol...you name it. CoolSearch aka search.paga has gone away for now.[/B].[/B].but having fought this beast once before -- I know it is a sneaky enemy! I'm here reporting for duty and ready for war of the homepage hijacker kind.
-Pvt Coconut

 

Two more things: Do you recommend that I buy DRSPY(Buster) ? I think it's called? Comes with a registry cleaner...it found a lot of bugs on my computer but asked for $ to fix ALL of them. Also, the coolsearch hijacker has not returned and search.paga is not showing up on my HJT...However, sometimes when I go on line my CA antivurus tells me that "winsocks.5" wants to access the internet. I keep denying it, but I can't find this windsocks. The more I learn the less I know! I should be demoted from Private to K.P.

 

Re: Hijacked again by coolsearch, winsocks5.exe

The hijacker is still MIA...I think I got rid of it! When I access the internet with Mozilla my EZ Firewall Alert pops up with "winsocks.5.exe is trying to access the internet...destination IP address 167.206.3.150.DNS" I'm not sure what to do about that
-Pvt Coconut