Sorcha – if you're still having problems, or others with similar probs:

A Google on the phrase "Toolbar Hijack" got quite a few hits, but 3 of the sites on the first couple of pages of results popped up Norton warnings of virus hits while the pages were loading – apparently from infection of the pages "advertising" knowledge about this phenomenon. This is unusual, at least in my experience. I've had the impression that Google checks before listing, just based on my never having been "hit" by a page from a Google search.

Keep your AV up.

No real help, but I do find "spyblocs" advertised at a couple of reputable magazine sites. The ads make it appear that the program is legit, but I queried the discussion group at one of these sources to see if anyone else has had a problem with the program.

First reply follows:

From COMPUABLE

Tell your friend Check the add/remove programs for SpyBlocs and remove if present. Then tell your friend to go to this site and download HijackThis 1.98.2 from the Merijn website. A rudimentary HijackThis log tutorial by me is available here. The official HijackThis QuickStart for posting on the SpywareInfo forums is available here.

Another great and helpful site to check out would be That Computer Guy's Help Forum Viruses and Spyware/Adware/Malware section to assist with using HijackThis.

Notes Regarding SpyBlocs Malware: This is ScumWare: Instead of removing spyware, they install it. Some of these types of malware will even attack whatever genuine protection your computer may already have, leaving it wide open to hackers, viruses, spyware and every other kind of malware imaginable.

It is most likely that your 'friend' or someone else who has access to her computer; accidentally or otherwise clicked on the "Click Here - To Download Free Scanner" link, which accompanies many popups from music download sites like KaZaA, iMesh and others, adult sites (or others who use her PC to visit adult sites). Also SpyBlocs can be inadvertently installed by downloading from some free screensavers sites or by downloading many non-reputable freeware or shareware applications.

Often unsuspecting Internet users inadvertently download this malware. This is a product associated with the pro-spyware people. The program is owned by the nefarious eBlocs Spyware Remover Company (brought to you by the spyware-proliferating monster called 'Network Dynamics Corporation Inc') and CLAIMS to rid your computer of malicious content that can harm your computer security as well as break your Internet privacy.

Actually, in reality SpyBlocs is usually bundled in numerous drive-by-downloads and bundles itself in/with other spyware and adware software. It's positively designed to screw up your system. SpyBlocs uses shady practices to entice users to install and purchase the software.

Tell your friend to use Ad-Aware SE Personal edition or Spybot - Search & Destroy 1.3 (or both) instead of SpyBlocs malware.

End Reply.

Pretty much what we've all agreed here, except for the links. If you're using Spybot, the tutorial may be helpful. Merijn, TomCoyote, and computerguy, the links given in the reply, are regularly mentioned favorably by other sources that I generally consider reliable, and the threads I've looked in on appear to bring some good talent into the solutions. I haven't had occasion to post to any of them, so can't offer personal experience; although I note that they all request that you read the FAQ and guidelines before posting. If you ask them for help you should follow their rules.

Also, Just received on slightly different subject – may be of interest to those running into Bagle worms:
Bagle Status Report. This is from eWeek, which is usually pretty reliable. New variants discovered within the past week with new nasties inside.