Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Additional link:
http://aumha.org/a/quickfix.htm
You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.merijn.org/cwschronicles.html
More: Removal tool:
http://www.merijn.org/files/cwshredder.zip
Read this: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051
--
Also from Mike Burgess.
Some program (usually spyware\parasite) may have overridden the URL prefix
setting?
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
Includes: Repair the corrupted or altered (spyware) HTTP prefixes
See section: Various Registry Fixes = "RepairDefaultPrefix.reg"
[or - manually]
Open Regedit to the following locations and verify the below default
entries:
Start | Run (type) "regedit" (no quotes)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix]
@="http://"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
Note: edit as needed, *always* Export before editing.
_______________________________________
Source: Mike Burgess
http://www.mvps.org/winhelp2002/
Henri Leboeuf
Web page:
http://www.colba.net/~hlebo49/index.htm
===