http://thehun.net
It's right on his homepage on how to remove something similar to what you have.
Unfortunately there are always scumbags out there that try to screw people as bad as they can. In this case it was someone installing some script to change people's bookmarks. It all prospers on a bug in Microsoft's Virtual Machine. It seems many people do not have the latest security patches installed. I HIGHLY SUGGEST YOU INSTALL THOSE!!! THEY'LL SAVE A LOT OF PROBLEMS!!! Get 'em at MicroSoft.com
Do you have your homepage changed to cool-xxx.net? Here's the fix:
1. Delete WINSYS.VBS (.VBA) from windows directory
2. Delete WIN0.TXT and WIN1.TXT from windows directory
3. Set correct home/search/etc pages (an easy way is ?restore defaults? and then setting the preferred homepage)
4. Run MSCONFIG (on non-2000 boxes) and remove WINSYS.VBA from the Startup tab
5. Reboot
I'll be on the constant lookout for people that try to get away with scripts like these. And I catch 'em I will do anything within my power to stop 'em. In this case we got their page closed in cooperation with their host (thanks for the quick reaction on that guys!). If you don't understand the above steps to remove the virus-script please get someone at your computer that will be able to follow the steps. Unfortunately I can't help everybody personally on this...