I have a somewhat different strain. Mine displays ads coming from http://cdn2.adsdk.com, which is an alias for a1906.g.akamai.net . There are no registry changes that I can detect, and my DNSs remain unmolested according to the ipconfig program. I have looked (particularly in the WINDOWS\Help directory) but I can find no rogue Hosts file, although there must be one somewhere to do the google hijacking.
All of which is to say that I think my infection, although related to the one described on McAfee and in previous posts to this thread, is distinct from it. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html