That can be a really nasty thing. Usually I boot into safe mode and start by running smitfraudfix and vundofix. Then combo it with spybot search and destroy and adaware. Also trendmicro.com has a free online scanner called housecall.