Fairly simple. If you run HijackThis you will see them
under O18. Here is a typical one:
O18 - Filter: text/html - {950238FB-C706-4791-8674-
4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
You can just check the O18s and then hit Fix Checked,
however, if the underlying infection is not gone they will
come back.
Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe
Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment. Put Hijack in the subject
so I'll know it's not spam. I'll be glad to help you with
it.
Ron Kinner
Microsoft MVP 2004 & 2005
(e-mail address removed)