NOISEY wrote:
> Thanks for the reply, YK.
>
> I deleted xlplugin.dll from c:\winnt\system32 and those hosts.
>
> xlplugin.dll was doing most of the redirecting. There has been no
> redirection on Google to coolwebsearch.com or umaxsearch.com yet.

Glad you found the problem.

> This maybe a new variant, since there was no search reply for it.

Yes it is. Google now has this thread so others can find this new varient.
Both IE-SPYAD and the HOSTS file I use have this site listed now.

> Thanks again,

YAW.

> "YK" <YKnot@home.invalid> wrote in message
> news:<M9Tob.144222$3f.101805@twister01.bloor.is.ne t.cable.rogers.com>...
>> NOISEY wrote:
>>> Here is my Hijack log. I hope this helps.
>> <snip>
>>
>> With all Internet Explorer windows closed delete these:
>>
>>> O1 - Hosts: 213.159.117.51 clicktraq.mtree.com
>>> O1 - Hosts: 213.159.117.51 download.globaldialer.net
>>> O1 - Hosts: 213.159.117.51 dyntraq.mtree.com
>>> O1 - Hosts: 213.159.117.51 network.nocreditcard.com
>>> O1 - Hosts: 213.159.117.51 network.nocreditcard.net
>>
>> These direct to xwebsearch.biz a CWS parasite mutant.
>>
>> I do not see any other evidence of CWS but it is best to consult the
>> experts
>> at http://forums.spywareinfo.com/index.php?showforum=11 but read the
>> FAQ
>> first http://forums.spywareinfo.com/index....ST&f=24&t=5187