slate_leeper wrote:

>The other day I brought up SpywareBlaster to check for updates, and
>found the status screen said that one item was unprotected in the
>"restricted sites" section. I paged through the list and found the
>unprotected item was number 1630, "CoolWebSearch 5starvideos.com."
>
>I set protection on for that item, checked for updates, and made sure
>the status screen said that all items were protected.
>
>Then I went to my HOSTS file and added 5starvideos.com and
>www.5starvideos.com. Yesterday when I looked at SpywareBlaster, all
>was well. Today the same item is again unprotected.
>
>AdAware, NOD32 antivirus, and SpyBot SD have all shown nothing. There
>is nothing I don't recognize running in the XP Task Manager list.
>
>Any ideas?

Try CWShredder http://www.intermute.com/products/cwshredder.html I
haven't used it for quite a while but it was specifically designed to
target CoolWebSearch infections. And just because you don't see any
unusual items in the Task Manger doesn't mean that there are not items
running in memory that are not reported by Task Manger. You might
take a look at a highjackthis listing or use AutoRuns to look for
additional files that get loaded at startup.