The first variant of CoolWebSearch wasn't even identified as such. There only were several threads of users experiencing enormous slowdowns in IE when typin messages into text boxes. Delays of over a minute before the typed text appeared were reported. Also some redirections to
www.datanotary.com were reported.
The solution to this problem took a while to surface, but after a few weeks (which is pretty long) someone reported the problem going away when going into IE Options, Accessability and disabling the 'Use My Stylesheet' option. After that, the fake stylesheet file could be deleted.
The hijack installed a stylesheet that used a flaw in Internet Explorer and allowed a .css stylesheet file to execute Javascript code. The code in the file was encrypted, and spawned a popup off-screen that did the redirecting. However, this file was called on almost every action taken in IE, slowing it down - this was the most obvious when typing text.