Suggest you get this removal tool. CWS is very nasty.
More: Complete list by variant with up-to-date information.
http://www.merijn.org/cwschronicles.html
More: Removal tool:
http://www.merijn.org/files/cwshredder.zip
--
You may want to check this. Quoted from an other post.
Some program (usually spyware\parasite) may have overridden the URL prefix
setting?
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Includes: Repair the corrupted or altered (spyware) HTTP prefixes
See section: Various Registry Fixes = "RepairDefaultPrefix.reg"
[or - manually]
Open Regedit to the following locations and verify the below default
entries:
Start | Run (type) "regedit" (no quotes)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
Note: edit as needed, *always* Export before editing.
_______________________________________
Source: Mike Burgess
http://www.mvps.org/winhelp2002/
Henri Leboeuf
Web page:
http://www.colba.net/~hlebo49/index.htm
===