thats because its running in memory and recreates itself.
try running your ant-malware apps in safe mode.
also figure out which process is doing it, and shut it down before
removing its files

"Max" <Max@discussions.microsoft.com> wrote in message
news:89429D2D-FCDF-4BB2-8C73-35BEF40AB80B@microsoft.com...
> Everytime I run cwshredder it never finds anything and when I run other
> adware programs they always find coolwwwsearch and delete it but it keeps
> coming back.

Tried safe mode, booted up properly, and they always come back. How do I find
out what's bringing them back and delete it forever.

From: "Max" <Max@discussions.microsoft.com>

| Tried safe mode, booted up properly, and they always come back. How do I find
| out what's bringing them back and delete it forever.

Download and execute HiJack This! then create a log file.
http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Post the log file in one of the following...

Forums where you can get expert advice for HiJack This! (HJT) logs.
NOTE: Registration is REQUIRED before posting a log
NOTE: Web sites NOT listed in any particular order

http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/security
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/forumdisplay.php?f=24
http://www.cybertechhelp.com/forums/...splay.php?f=25
http://www.geekstogo.com/forum/Malwa..._Here-f37.html
http://gladiator-antivirus.com/forum...?showforum=170
http://forum.iamnotageek.com/f-130.html
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://boards.cexx.org/viewforum.php?f=1
http://www.malwarebytes.biz/forums/i...hp?showforum=5

{ borrowed from the alt.privacy.spyware News Group }


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

I started a thread over at www.bleepingcomputer.com but it has been no help.
no matter what I do coolwwwsearch.wcadw is always there.

linkage: http://www.bleepingcomputer.com/foru...howtopic=38364

From: "Max" <Max@discussions.microsoft.com>


| linkage: http://www.bleepingcomputer.com/foru...howtopic=38364

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\j2re1.4.2_03\bin\npjpi142_03.dllO9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

Please remove this version of Sun Java and install the latest version of Sun Java.

Reboot the PC and install JRE Version 5.0 Update 6
http://www.java.com/en/download/manual.jsp
The version you have has vulnerabilities that are presently being exploited by
adware/spyware.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm