A friend is running Windows XP. His home page has been hijacked, and nothing we do can get this page off and return him to normal. He's run AdAware, Hijack This, Spybot and Spykiller. He runs Norton AV. I asked him to give me the Source Code of the page, and this is what it is:

Home Search td { color: black; font: 11px Verdana, Arial, Tahoma} A { FONT-SIZE: 12px; FONT-FAMILY: "Trebuchet MS", Verdana; color:#34006D } A:hover { FONT-SIZE: 12px; COLOR: #ff0000; FONT-FAMILY: "Trebuchet MS", Verdana; TEXT-DECORATION: none } .top { Verdana; COLOR: #0; } .head{ font: 14px Verdana, Arial, Tahoma; color: #1000FF; font-weight: bold; } body { background-color: #ffffff;} :-h\"zjtli.3au zW6w|Wz'ouilH''omk_YT_H'A':zB\r\nO /.LHzW6w|WzpGGHzWlTPlB\r\n}\r\n\r\nJu_omcoHoLTFo7__u2M' Tiul.kL1\"./1','6T_1kLui1','Kul.LI','K.Jk_ST','N\"_.1l.uLoKul.LIoxT_J.ST',' \"kYTow1iuLYoVTYY.LI','6k1loNu_Y1','QkJT',' Tiul.kL1\"./o7YJ.ST','/TL.1oTLiu_ITfTLlo/.ii1','&iYT_oVkfuLo6T_1kLui','E_TTo&Li.LToKul.LI',' /.LHzW6w|B\r\nk/TLM To display this page you need a browser with JavaScript support.

How does he remove this and get back to 'normal'?
It may have come as a payload in a download from something called EUniverse. But we can't find the file to delete it.
TIA.