Spyware that won't go away
 

Tech specs: Win2k and IE.
My friend has web-based school email as his home page. Whenever he logs in, he is taken to an ad screen. If he hits back, he is logged in and on his mail screen(ie, inbox). His homepage is reset by this action to some search engine. We have used both Ad-Aware and another spybot destroyer(in that order, and the second thing found more, which makes me unhappy about ad-aware) but the problem remains. However, it does not happen when he uses another home page, such as Yahoo. Okay, we think, it's the page. Nope. Doesn't happen on mine. So our current hypothesis is that there is an extraneous registry value associated with PHP or some such that the school's web email uses. We are reaching out to other resources, but I thought I'd look here. Thoughts?

might help to konw what search engine the page re-directed to...

Might wanna try CWshredder. You can read about it Here. The link to download it is at the bottom of that page, under Epilogue.

Install an anti-virus program, install Spybot Search and Destroy, reboot in safe mode, and scan with both. If neither of them work, it may be time for a reformat.

Ditto, also run a good anti-trojan like trojan hunter.

Thanks for your help, all.

Try using a program called HijackThis here : http://mjc1.com/mirror/hjt/. It looks at the registry and hard drive and lets you enable/disable certain processes. It also lets you export a text file which contains a list of services. Just post one of those logs onto the forums in the link at the top and people can show you what you need to disable.