start run regedit, go to:
hkey local machine, software, microsoft, windows, url, prefixes.
this is where the coolwebsearch changes the default page etc.
ftp should be ftp://
gopher should be gopher://
home should be http://
mosaic should be http://
be http://
cws shredder will fix it if its a hijack, but if it's something on some legitimate software you installed I'm not sure it will pick it up.
I usually find the fix for these types of programs to be:
1. close all application, terminate any suspicious services (i.e. "sirvices.exe" or "svchost1.exe")
2. look at your root (c:/) and delete suspicious executables, such as ***.htx, or search.exe
3. update antivirus definitions and run a full scan
4. update spybot search and destroy and run a full scan
5. update adaware and run a full scan
6. update cws shredder and run a scan/repair
7. reboot and it should be fixed.