http://www.hexblog.com/2005/12/wmf_vuln.html http://isc.sans.org/diary.php?storyid=1010
The desktop hijacker removal utility is called smitrem.exe and you can download it here: http://noahdfear.geekstogo.com/
Its really just a bunch of batch scripts where somebody did all the dirty work for you. You need to run it in safe mode.