Found this on the web... see if it will help you...
G'day,
Unfortunately, this is becoming more and more of a problem. I still have problems with these "low lifes" imposing their crap on my machine, despite the fact that I have all the current tools (zonealarm, adaware, AVG, spybot, homepage defender,bazooka, spyware blaster, webwasher, trojan detector...the list goes on)But I guess they are only effective against the then known threats- new ones pop up all the time. And if you followed the excellent links provided by abnormal (it may have fallen off the main page...)you will realise that to have any real fun or usefullness out of your internet experience you need activeX scripts enabled for IE5 and above- and that's where the problem starts.
So, here are a few tips (which will no doubt be expanded upon by other learned people on this forum):
1. always look at your startup programs ie click on start,click on run and type in msconfig and press ok. Select the startup folder. This is a place where programmes and scripts etc are loaded every time your computer boots up (that's why when you delete everything: it just pops up again when you next start your computer). You will see check boxes next to each one for the purpose of selecting or de-selecting. If you don't have a good feel for what should or shouldn't be there, then write down the list and post it here. A good guide for this is; if it just a hijack attempt, is that the offending url will be on there (ie www.casino or whatever it is called).
2 look at the boot options :
ie inb the same place click on the win.ini tab and click the [windows] listing. You will see entries like load= and run= : they should both contain empty strings.
3 Cross to the system.ini tab and select the [boot] option. Here the point of interest is that the shell=Explorer.exe line should be just that ..and not something like shell=explorer.exe msapp.exe %1 or similar.
4 if you do find names of files in these places, then run them through a good search engine like google and you will be surprised with all the help you will get from the hits.
5 A bit of detective work goes a long way.. I once solved a hijack for a friend by getting him to tell me when his problem started: we then used windows explorer to find files created and/ or modified on that date/time. Once isolated (renamed to *.old) the problem was near to being solved (*.hta files are a dead giveaway here)
