John -
Many answers for this:
http://forums.net-integration.net/index.php?showtopic=15538
http://www.computing.net/security/wwwboard/forum/11828.html
Basically, the recommendation is to download, install, run, and immediately
*update* (so you will have the latest version and definitions. It is
currently at ver. 1.97.7) HijackThis (from Merijn).
Now, HijackThis is a *very powerful and potentially dangerous* program if
you do not know what to do with it. Seek help from various Spyware forums to
help you determine what is good and to be left alone, while advising you
what you should have HijackThis remove.
First, a little bit about HijackThis is in order; Must Read!
HijackThis Tutorials - these are all basically the same, but some may be
easier to comprehend.
Note: The author of this program, Merijn, is experiencing difficulties at
his site today, therefore you may have difficulty to access it. It is the
topmost URL listed here.
http://www.spywareinfo.com/~merijn/htlogtutorial.html
http://aumha.org/a/hjttutor.php
http://tomcoyote.com/hjt/
http://www.computercops.biz/HijackThis.html
http://hjt.wizardsofwebsites.com/
http://www.help2go.com/article153.html
You may obtain this program from Merijn (when his site is in order) or from
any of the following:
http://www.net-integration.net/tools/hijackthis.html
http://www.majorgeeks.com/download3155.html
http://www.spychecker.com/program/hijackthis.html
You *are strongly advised* to seek help from websites dedicated to helping
with interpretation of the Scanned log that HijackThis will produce.
Hijackthis doesn't remove *anything* until YOU direct it to do so. So
running it will just show what is on your machine - that's all it will do.
You must select what will be removed before it cleans anything.
Help forums for HijackThis:
Note: SpywareInfo Forums are doing a website maintenance job right now.
Should be back on-line shortly. Ain't that just how things are? ;-))
http://forums.spywareinfo.com/
http://forums.net-integration.net/index.php?c=19
http://forums.tomcoyote.com/index.php?showforum=27
HTH -