More here .
http://www.spywareinfo.com/bhos/
http://www.pacs-portal.co.uk/startup_pages/startup_full.htm
---------
http://www.spywareinfo.com/articles/hijacked/
1.The very first thing you need to do is download and run HijackThis. Put a check mark next to every search and start page setting it lists which you haven't put there yourself and choose fix. Do the same for any hosts file entries. If it lists anything as O5, O6, or O7*, fix those as well. Please ask for advice at the forums before using HijackThis to change anything else.
*Note: Spybot S&D, Start Page Guard, Settings Sentry, and similar programs may provide options to lock settings against unauthorized changes. If you have these options enabled, HijackThis will detect that as a restrictions hijack. Disable those options before scanning with HijackThis.
2. Second, you have to get Internet Options back into the control panel. Do a file search and look for a file named "control.ini". Open it in Notepad. You may see something like this:
[don't load]
inetcpl.cpl=yes
Delete the "inetcpl.cpl=yes" line under "[don't load]". Save and close the file, then try control panel again. If it's still not there, restart your machine and it should be there.
For Windows 2000 and XP, you will need to edit the registry to do this. Go to the start menu > RUN command > type REGEDIT and press enter. Navigate through the registry keys until you get to HKEY_CURRENT_USER\Control Panel\don't load\. Look and see if inetcpl.cpl is listed. If it is, delete the entry for it and log off.
See the list at the bottom of this page to identify other entries. Thanks to Corné de Leeuw for this information.
3.Run a search on your hard drive for any files ending with *.hta or *.js. If you find any, open them in notepad or some other text editor and look for the URLs that you have been hijacked to. Any file with those URLs, delete them. Also delete all *.tmp files on your drive; some of them contain malicious code (for e.g. browser hijacks or malware (re)installations). Besides, deleting *.tmp files doesn't hurt, unlike dll's which are also used sometimes for this purpose. (Thanks to cexx.org for the additional info in this step).
4.HijackThis will list any BHO installed on your computer. Check the BHOs listed against the list of all known BHOs mainained at this site by a member of our support forums. If you find one listed as some sort of spyware/malware/hijackware, run HijackThis again and find that BHO in the list. Check its box and have HT fix it.
If you find a BHO that is not included in the list, please make a post in the Browser Hijackings section of our support forums with the HijackThis log pasted in along with an explanation of your problem. Please wait for replies before deleting this BHO, as it may be a new one which I can have added to various spyware/malware cleaning programs. It may also be an innocent file that is not causing your problem, so please wait for advice before deleting it.
5.Now you need to see if there is a startup entry for your hijacker file. The next time you reboot, the hijack might possibly come right back. The reason for this is most likely an entry in the run section of the registry.
If you have fixed your hijack, only to have it return the next time you restart your computer or log on, it means that something is loading at startup that is reinstating the hijack. Open HijackThis again. Press "Config" > "Miscellaneous Tools", and press "Generate Startuplist Log". This will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more. Check the entries listed against Pacman's List. If you find entries in your log that are not listed, you can report them at the forums.
Again, it will be absolutely necessary for you to close all open Internet Explorer windows before any of these changes will take effect. Some changes may even require a log off or even a reboot before they have any effect.
