1) Start Windows in Safe Mode by pressing F8 as the computer is booting and choosing Safe Mode
2) Remove the Registry entries
Click on Start, Run, Regedit
In the left panel go to
HKEY_CURRENT_USER>Software>Microsoft>Windows>Current Version>Runonce
In the right panel, right-click and delete the following entry (if it exists)
iefeats1Update = "rundll32 \iefeats1.dll,UpdateDlls"
Close the Registry Editor
3) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well)
Click Start, point to Find or Search, and then click Files or Folders.
Make sure that "Look in" is set to (C:\WINDOWS).
In the "Named" or "Search for..." box, type, or copy and paste, the file names:
IEFEATSL.DLL
MSIESH.DLL
SUBMITHOOK.DLL
UNINSTALL.EXE
UNINSTALL.INI
MSHP.DLL
Click Find Now or Search Now.
Delete the displayed files.
4) Reset Internet Explorer Homepage and Search Page
Close all Internet Explorer windows.
Open Control Panel. Click Start>Settings>Control Panel.
Double-click the Internet Options icon.
In the Internet Properties window, click the Programs tab.
Click the ?Reset Web Settings?? button.
Select ?Also reset my home page.? Click Yes.
Click OK.
4) Reboot the computer and download and run CWShredder http://www.spywareinfo.com/~merijn/junk/CWShredder.exe (remove any spaces)
5) Run a thorough virus scan using your favorite antivirus program or Housecall, Trend Micro's online virus scanner
