This one is definitely a f***er.

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
I found that it installed 4 .exe files (I have win2k, so windows dir is winnt, yours may be just windows).
winnt\seksdialer.exe
winnt\desktop.exe
winnt\system.exe
winnt\downloaded program files\load.exe
It also seemed to install winnt\system32\system32.dll, at least it had a create date as the time this f***er took over. (I was trying to help someone else debug over the phone, went to the website & it's been downhill ever since.) I checked 2 other Win2k systems and they didn't have this file, so I moved it to a floppy. Still not sure if I need it, though windows seems to run without, just without sound at the moment.
I then ran through the registry and replaced or deleted:
secure.html (on another infected pc, it was an ip, so whatever your home page is getting set to - look for that)
load.exe (this is installed into IE, like the google or yahoo toolbars, so everytime you start up IE, it loads itself again) I deleted the branch that held this file.
I didn't find the other .exe's in the registry.
Then I went to control panel -> internet options and changed the home page and deleted all files.
Then to the cookies location (varies per platform) and deleted them all.
Then I ran through Windows Updates (choose from Tools menu in IE) until there were no more CRITICAL updates. I chose to skip the rest.
Then I made sure I had the latest virus defs & scanned (nothing found).
Then I went to webroot.com & installed the trial version of Spy Sweeper & ran that.
For the most part, it seems ok, but now my sound is hosed, and the pc seems much slower.
I saw a mstask.exe as "Guest" mentioned, but I don't seem to have access to get rid of that. So off to find out where that's hiding.
I sent them a nasty message on their site. I also looked them up via whois, but of course the phone # for the contact is disconnected.
Good luck all.