Huntbar,popups, No Roadrunner Connection

Just found this great site - hopefully you can help as I'm lost, as is my ISP provider (RoadRunner). Had RoadRunner hooked up a few weeks ago, was working fine with Internet Explorer, now can't connect to the internet (get error page stating - page cannot be displayed). Have updated and run SpyBot and Ad-Aware, even downloaded FireFox but can't connect with that either. (presently still using dial-up AOL until I gte this straightened out.)
SpyBot cleans up everything except for HUntBar - so I'm wondering if this parasite is the culprit.
Here's my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 2:27:04 AM, on 3/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe
C:\WINDOWS\system32\omsb\sfrkr.exe
C:\WINDOWS\system32\ubrst\ykwdnoyw.exe
C:\WINDOWS\system32\pioi\xbdlymi.exe
C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
C:\WINDOWS\System32\secure.exe
C:\WINDOWS\system32\dssd\fnhdlyku.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\vcdres.exe
C:\WINDOWS\System32\umllwab.exe
C:\WINDOWS\System32\w?nlogon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\WINDOWS\System32\myuoiflj\luiqfho.exe
c:\windows\system32\wumpucpr.exe
c:\windows\system32\packager.exe
C:\WINDOWS\System32\rihr\vvsevq.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\Pynix.dll
O2 - BHO: (no name) - {00E8A818-77C5-EA87-C823-7D18005467A9} - C:\WINDOWS\System32\vmtyjvon\aayngbmk.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1FAA202C-70D9-25C3-54E8-1BCDC99473DD} - C:\WINDOWS\system32\hmnmjoaq\lkfaoepi.dll
O2 - BHO: (no name) - {4116F50C-8D4A-310D-198B-F956C95E4C4C} - C:\WINDOWS\System32\uskufivj\ijyqxqks.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {5CF39F2B-21B3-2D4F-9476-0F15746CEBB8} - C:\WINDOWS\system32\iworznin.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: (no name) - {A9ECD61E-38C5-EDA7-994A-E18B363176DE} - C:\WINDOWS\System32\dnprujki\pxtjekup.dll
O2 - BHO: (no name) - {D800E034-5E8E-5C57-D393-00A2DED06FE0} - C:\WINDOWS\System32\qkecewt.dll (file missing)
O3 - Toolbar: (no name) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - (no file)
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [soexa] C:\WINDOWS\System32\jfnpvjet\soexa.exe
O4 - HKLM\..\Run: [wulxwdjo] C:\WINDOWS\System32\jeui\wulxwdjo.exe
O4 - HKLM\..\Run: [crggn] C:\WINDOWS\System32\ytxau\crggn.exe
O4 - HKLM\..\Run: [bvvldjf] C:\WINDOWS\System32\yxpvvgd\bvvldjf.exe
O4 - HKLM\..\Run: [nuebmahv] C:\WINDOWS\System32\uvwmpynu\nuebmahv.exe
O4 - HKLM\..\Run: [vvsevq] C:\WINDOWS\System32\rihr\vvsevq.exe
O4 - HKLM\..\Run: [odqfddrg] C:\WINDOWS\System32\manv\odqfddrg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [luiqfho] C:\WINDOWS\System32\myuoiflj\luiqfho.exe
O4 - HKLM\..\Run: [cjjhunk] C:\WINDOWS\System32\ukktdv\cjjhunk.exe
O4 - HKLM\..\Run: [abvegwux] C:\WINDOWS\System32\xmfjiovx\abvegwux.exe
O4 - HKLM\..\Run: [bcoqc] C:\WINDOWS\System32\rrdy\bcoqc.exe
O4 - HKLM\..\Run: [xbadrchg] C:\WINDOWS\System32\olkcccn\xbadrchg.exe
O4 - HKLM\..\Run: [oxgvclx] C:\WINDOWS\System32\hsufdhb\oxgvclx.exe
O4 - HKLM\..\Run: [BPT] "c:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [gprdluky] C:\WINDOWS\System32\psejw\gprdluky.exe
O4 - HKLM\..\Run: [wuqa] C:\WINDOWS\System32\uvdodw\wuqa.exe
O4 - HKLM\..\Run: [vreksk] C:\WINDOWS\System32\bndm\vreksk.exe
O4 - HKLM\..\Run: [vgbbv] C:\WINDOWS\System32\sglethn\vgbbv.exe
O4 - HKLM\..\Run: [twscvsh] C:\WINDOWS\System32\ykonyrc\twscvsh.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\dealhelper.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\secure.exe
O4 - HKLM\..\Run: [Makarzy] C:\WINDOWS\nyei.exe
O4 - HKLM\..\Run: [wumpucpr] c:\windows\system32\wumpucpr.exe
O4 - HKLM\..\Run: [wohawn] C:\WINDOWS\System32\xygbnk\wohawn.exe
O4 - HKLM\..\Run: [jbhy] C:\WINDOWS\System32\ogokert\jbhy.exe
O4 - HKLM\..\Run: [jyswiyuk] C:\WINDOWS\System32\djotupu\jyswiyuk.exe
O4 - HKLM\..\Run: [ultch] C:\WINDOWS\System32\hhlrs\ultch.exe
O4 - HKLM\..\Run: [abqs] C:\WINDOWS\System32\ekqxs\abqs.exe
O4 - HKLM\..\Run: [uinjdx] C:\WINDOWS\System32\jegyoic\uinjdx.exe
O4 - HKLM\..\Run: [msgvyphq] C:\WINDOWS\System32\eiqv\msgvyphq.exe
O4 - HKLM\..\Run: [qqjkcruu] C:\WINDOWS\System32\jyngjobh\qqjkcruu.exe
O4 - HKLM\..\Run: [yplduvw] C:\WINDOWS\System32\wejei\yplduvw.exe
O4 - HKLM\..\Run: [thcmr] C:\WINDOWS\System32\ylonvyy\thcmr.exe
O4 - HKLM\..\Run: [xpvth] C:\WINDOWS\System32\glpyfcgm\xpvth.exe
O4 - HKLM\..\Run: [rcpf] C:\WINDOWS\System32\iiwn\rcpf.exe
O4 - HKLM\..\Run: [hklsfsj] C:\WINDOWS\System32\dngltry\hklsfsj.exe
O4 - HKLM\..\Run: [omdmwd] C:\WINDOWS\System32\pdrtn\omdmwd.exe
O4 - HKLM\..\Run: [wfnfkf] C:\WINDOWS\System32\qeggss\wfnfkf.exe
O4 - HKLM\..\Run: [ejyyflhe] C:\WINDOWS\System32\brntwxl\ejyyflhe.exe
O4 - HKLM\..\Run: [hwlh] C:\WINDOWS\System32\teirot\hwlh.exe
O4 - HKLM\..\Run: [ndewwr] C:\WINDOWS\System32\dqjbb\ndewwr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ykwdnoyw] C:\WINDOWS\system32\ubrst\ykwdnoyw.exe
O4 - HKLM\..\Run: [fnhdlyku] C:\WINDOWS\system32\dssd\fnhdlyku.exe
O4 - HKLM\..\Run: [eegrjd] C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe
O4 - HKLM\..\Run: [yjjjlnu] C:\WINDOWS\system32\etlbb\yjjjlnu.exe
O4 - HKLM\..\Run: [refigwdg] C:\WINDOWS\system32\fcvough\refigwdg.exe
O4 - HKLM\..\Run: [xbdlymi] C:\WINDOWS\system32\pioi\xbdlymi.exe
O4 - HKLM\..\Run: [sfrkr] C:\WINDOWS\system32\omsb\sfrkr.exe
O4 - HKLM\..\Run: [BPCv2] c:\Program Files\bpc_search\bpcv2.exe
O4 - HKLM\..\Run: [33EP35g] vcdres.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\RunOnce: [BPCv2_re] c:\Program Files\Common Files\Java\bpc2_re_inst.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [I0xFRRMse] umllwab.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Peter\Application Data\eetu.exe
O4 - HKCU\..\Run: [Aro] C:\WINDOWS\System32\w?nlogon.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7BEC965-8019-46F1-855C-B31ACB970D42}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: luiqfhomyuoiflj - Unknown owner - C:\WINDOWS\System32\myuoiflj\luiqfho.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: vvsevqrihr - Unknown owner - C:\WINDOWS\System32\rihr\vvsevq.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe" "WMP54Gv4.exe (file missing)

Any help on what to delete would be appreciated, and if you have any other ideas or can point me to another forum as to the internet connection problem, I'd be very appreciative!
Thanks so much.

Hello again "BobDylan"

We have a lot of work to do to get you clean,
So hang in there, we will get your machine back.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s)

(1)
Please download and run the following programs. Please be sure you have the up-to-date versions of Spybot and Ad-aware. All are free and available below.
To set the programs up correctly,
Go here for tutorial:
http://www.bleepingcomputer.com/forums/tut…43.html#install

Download Spybot install and update. Then download Ad-aware, install, and update.

Spybot:


Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED"(RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Reboot to regular mode.

(2)
Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

(3)
Reboot to regular mode
Go to control panel then Add/Remove Programs.
Then Remove these Programs:

O4 - HKLM\..\Run: [BPT] "c:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
These two are associated with Delfin Media Viewer and should be removed from the Add/Remove Programs Panel

Go to control panel then Add/Remove Programs.
Then Remove this Program:

O4 - HKLM\..\Run: [BPCv2] c:\Program Files\bpc_search\bpcv2.exe
This is associated with BroadcastPC,

(4)
Now you need to start your computer in SAFEMODE.
Use the following Instructions.
To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

(5)
Close all Browser Windows (including this one)
Run hijackthis and tick to fix (check the box next to) the list below.
When all are ticked (checked) click the Fix Checked button at the bottom.


O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\Pynix.dll
O2 - BHO: (no name) - {00E8A818-77C5-EA87-C823-7D18005467A9} - C:\WINDOWS\System32\vmtyjvon\aayngbmk.dll
O2 - BHO: (no name) - {1FAA202C-70D9-25C3-54E8-1BCDC99473DD} - C:\WINDOWS\system32\hmnmjoaq\lkfaoepi.dll
O2 - BHO: (no name) - {4116F50C-8D4A-310D-198B-F956C95E4C4C} - C:\WINDOWS\System32\uskufivj\ijyqxqks.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {5CF39F2B-21B3-2D4F-9476-0F15746CEBB8} - C:\WINDOWS\system32\iworznin.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: (no name) - {A9ECD61E-38C5-EDA7-994A-E18B363176DE} - C:\WINDOWS\System32\dnprujki\pxtjekup.dll
O2 - BHO: (no name) - {D800E034-5E8E-5C57-D393-00A2DED06FE0} - C:\WINDOWS\System32\qkecewt.dll (file missing)
O3 - Toolbar: (no name) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - (no file)
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM\..\Run: [soexa] C:\WINDOWS\System32\jfnpvjet\soexa.exe
O4 - HKLM\..\Run: [wulxwdjo] C:\WINDOWS\System32\jeui\wulxwdjo.exe
O4 - HKLM\..\Run: [crggn] C:\WINDOWS\System32\ytxau\crggn.exe
O4 - HKLM\..\Run: [bvvldjf] C:\WINDOWS\System32\yxpvvgd\bvvldjf.exe
O4 - HKLM\..\Run: [nuebmahv] C:\WINDOWS\System32\uvwmpynu\nuebmahv.exe
O4 - HKLM\..\Run: [vvsevq] C:\WINDOWS\System32\rihr\vvsevq.exe
O4 - HKLM\..\Run: [odqfddrg] C:\WINDOWS\System32\manv\odqfddrg.exe
O4 - HKLM\..\Run: [luiqfho] C:\WINDOWS\System32\myuoiflj\luiqfho.exe
O4 - HKLM\..\Run: [cjjhunk] C:\WINDOWS\System32\ukktdv\cjjhunk.exe
O4 - HKLM\..\Run: [abvegwux] C:\WINDOWS\System32\xmfjiovx\abvegwux.exe
O4 - HKLM\..\Run: [bcoqc] C:\WINDOWS\System32\rrdy\bcoqc.exe
O4 - HKLM\..\Run: [xbadrchg] C:\WINDOWS\System32\olkcccn\xbadrchg.exe
O4 - HKLM\..\Run: [oxgvclx] C:\WINDOWS\System32\hsufdhb\oxgvclx.exe
O4 - HKLM\..\Run: [BPT] "c:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [gprdluky] C:\WINDOWS\System32\psejw\gprdluky.exe
O4 - HKLM\..\Run: [wuqa] C:\WINDOWS\System32\uvdodw\wuqa.exe
O4 - HKLM\..\Run: [vreksk] C:\WINDOWS\System32\bndm\vreksk.exe
O4 - HKLM\..\Run: [vgbbv] C:\WINDOWS\System32\sglethn\vgbbv.exe
O4 - HKLM\..\Run: [twscvsh] C:\WINDOWS\System32\ykonyrc\twscvsh.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\dealhelper.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\secure.exe
O4 - HKLM\..\Run: [Makarzy] C:\WINDOWS\nyei.exe
O4 - HKLM\..\Run: [wumpucpr] c:\windows\system32\wumpucpr.exe
O4 - HKLM\..\Run: [wohawn] C:\WINDOWS\System32\xygbnk\wohawn.exe
O4 - HKLM\..\Run: [jbhy] C:\WINDOWS\System32\ogokert\jbhy.exe
O4 - HKLM\..\Run: [jyswiyuk] C:\WINDOWS\System32\djotupu\jyswiyuk.exe
O4 - HKLM\..\Run: [ultch] C:\WINDOWS\System32\hhlrs\ultch.exe
O4 - HKLM\..\Run: [abqs] C:\WINDOWS\System32\ekqxs\abqs.exe
O4 - HKLM\..\Run: [uinjdx] C:\WINDOWS\System32\jegyoic\uinjdx.exe
O4 - HKLM\..\Run: [msgvyphq] C:\WINDOWS\System32\eiqv\msgvyphq.exe
O4 - HKLM\..\Run: [qqjkcruu] C:\WINDOWS\System32\jyngjobh\qqjkcruu.exe
O4 - HKLM\..\Run: [yplduvw] C:\WINDOWS\System32\wejei\yplduvw.exe
O4 - HKLM\..\Run: [thcmr] C:\WINDOWS\System32\ylonvyy\thcmr.exe
O4 - HKLM\..\Run: [xpvth] C:\WINDOWS\System32\glpyfcgm\xpvth.exe
O4 - HKLM\..\Run: [rcpf] C:\WINDOWS\System32\iiwn\rcpf.exe
O4 - HKLM\..\Run: [hklsfsj] C:\WINDOWS\System32\dngltry\hklsfsj.exe
O4 - HKLM\..\Run: [omdmwd] C:\WINDOWS\System32\pdrtn\omdmwd.exe
O4 - HKLM\..\Run: [wfnfkf] C:\WINDOWS\System32\qeggss\wfnfkf.exe
O4 - HKLM\..\Run: [ejyyflhe] C:\WINDOWS\System32\brntwxl\ejyyflhe.exe
O4 - HKLM\..\Run: [hwlh] C:\WINDOWS\System32\teirot\hwlh.exe
O4 - HKLM\..\Run: [ndewwr] C:\WINDOWS\System32\dqjbb\ndewwr.exe
O4 - HKLM\..\Run: [ykwdnoyw] C:\WINDOWS\system32\ubrst\ykwdnoyw.exe
O4 - HKLM\..\Run: [fnhdlyku] C:\WINDOWS\system32\dssd\fnhdlyku.exe
O4 - HKLM\..\Run: [eegrjd] C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe
O4 - HKLM\..\Run: [yjjjlnu] C:\WINDOWS\system32\etlbb\yjjjlnu.exe
O4 - HKLM\..\Run: [refigwdg] C:\WINDOWS\system32\fcvough\refigwdg.exe
O4 - HKLM\..\Run: [xbdlymi] C:\WINDOWS\system32\pioi\xbdlymi.exe
O4 - HKLM\..\Run: [sfrkr] C:\WINDOWS\system32\omsb\sfrkr.exe
O4 - HKLM\..\Run: [BPCv2] c:\Program Files\bpc_search\bpcv2.exe
O4 - HKLM\..\RunOnce: [BPCv2_re] C:\Program Files\Common Files\Java\bpc2_re_inst.exe
O4 - HKLM\..\Run: [33EP35g] vcdres.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKCU\..\Run: [I0xFRRMse] umllwab.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Peter\Application Data\eetu.exe
O4 - HKCU\..\Run: [Aro] C:\WINDOWS\System32\w?nlogon.exe
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O23 - Service: luiqfhomyuoiflj - Unknown owner - C:\WINDOWS\System32\myuoiflj\luiqfho.exe
O23 - Service: vvsevqrihr - Unknown owner - C:\WINDOWS\System32\rihr\vvsevq.exe[/.b]

(6)
Stay in SAFE MODE.
Then enable your system to show all hidden files
SHOW HIDDEN FILES AND FOLDERS

* Click on MY COMPUTER
* Then on your C: Drive
* Then to TOOLS/ FOLDER OPTIONS/ VIEW
* Choose the radio button to SHOW HIDDEN FILES AND FOLDERS
* Take the checkmark out of HIDE EXTENSIONS FOR KNOWN FILE TYPES
* Then APPLY/ OK
* Don't forget to reverse this once your computer is clean

(7)
Do a search find and delete these Files and then Foldres.(If they are still present)
C:\Documents and Settings\Peter\Application Data\eetu.exe
C:\WINDOWS\System32\vcdres.exe
C:\WINDOWS\System32\w?nlogon.exe
C:\WINDOWS\System32\dealhelper.exe
C:\WINDOWS\System32\secure.exe
C:\WINDOWS\System32\wumpucpr.exe
C:\WINDOWS\nyei.exe
C:\WINDOWS\farmmext.exe
Folders:
C:\Program Files\Bpt
C:\Program Files\bpc_search
C:\Program Files\COMMON FILES\WinTools
C:\WINDOWS\System32\vmtyjvon
C:\WINDOWS\system32\hmnmjoaq
C:\WINDOWS\System32\uskufivj
C:\WINDOWS\System32\dnprujki
C:\WINDOWS\System32\wsxsvc
C:\WINDOWS\System32\jfnpvjet
C:\WINDOWS\System32\jeui
C:\WINDOWS\System32\ytxau
C:\WINDOWS\System32\yxpvvgd
C:\WINDOWS\System32\uvwmpynu
C:\WINDOWS\System32\rihr
C:\WINDOWS\System32\manv
C:\WINDOWS\System32\myuoiflj
C:\WINDOWS\System32\ukktdv
C:\WINDOWS\System32\xmfjiovx
C:\WINDOWS\System32\rrdy
C:\WINDOWS\System32\olkcccn
C:\WINDOWS\System32\hsufdhb
C:\WINDOWS\System32\psejw
C:\WINDOWS\System32\uvdodw
C:\WINDOWS\System32\bndm
C:\WINDOWS\System32\sglethn
C:\WINDOWS\System32\ykonyrc
C:\WINDOWS\System32\xygbnk
C:\WINDOWS\System32\ogokert
C:\WINDOWS\System32\djotupu
C:\WINDOWS\System32\hhlrs
C:\WINDOWS\System32\ekqxs
C:\WINDOWS\System32\jegyoic
C:\WINDOWS\System32\eiqv
C:\WINDOWS\System32\jyngjobh
C:\WINDOWS\System32\wejei
C:\WINDOWS\System32\ylonvyy
C:\WINDOWS\System32\glpyfcgm
C:\WINDOWS\System32\iiwn
C:\WINDOWS\System32\dngltry
C:\WINDOWS\System32\pdrtn
C:\WINDOWS\System32\qeggss
C:\WINDOWS\System32\brntwxl
C:\WINDOWS\System32\teirot
C:\WINDOWS\System32\dqjbb
C:\WINDOWS\system32\ubrst
C:\WINDOWS\system32\dssd
C:\WINDOWS\system32\vlgtdpjh
C:\WINDOWS\system32\etlbb
C:\WINDOWS\system32\fcvough
C:\WINDOWS\system32\pioi
C:\WINDOWS\system32\omsb

(8)
Go here and run online scans, “Do at least (1) ONE; (2) Two would be better.

TrendMicro HouseCall
http://housecall.trendmicro.com/housecall/start_corp.asp

Panda ActiveScan
http://www.pandasoftware.com/activescan/co…n_principal.htm

(9)
Then go here http://www.trojanhunter.com/ TrojanHunter Free Trial and download and run the free trial of Trojan Hunter.

And here http://www.windowsecurity.com/trojanscan/ Online Trojan Scan and run the free online Trojan Scan

If there should be anything found that it couldn’t clean, please WRITE DOWN the FULL PATHS AND FILENAMES.

Note anything that can't be fixed
Reboot when done.

(10).
Start > Run and type CLEANMGR. Click OK and when presented with a list of options, check the following boxes: Temporary Internet Files, Temporary Files, Recycle Bin and click OK.

(11)
Go Here to learn about How to free up Windows XP system resources:
http://service1.symantec.com/SUPPORT/tsgen…002010712042239

(12)
Once done reboot into Normal Mode Rescan and post a new HijackThis log file to confirm what was removed and if it's clean or not. Also please describe how your computer behaves at the moment.
Marty

Hi Marty - hope you're still around as I 'm having some problems still! I deleted most of the things as you suggested, but I wasn't able to do any of the virus scans or Trojan searches that you mentioned at the end. Only because I wasn't able to download the necessary items on those sites with my AOL connection - would either run for hours, and then not install right because of 'corrupted files'. I did run the AVG virus scan which cleaned up 18 viruses that it found (all of which were of a Trojan Horse downloader Agent type - if that means anything.) I'm getting less pop-ups, but still can't connect to RoadRunner with either IE or FireFox browsers - although interestingly, I can connect with those if I'm signed on with AOL at the same time (but the down;oad and overall speed is still quite slow.) I just ran the AVG scan, Ad-Aware, Spybot and CWShredder and this is the new HJT log. I see a lot of things that I deleted are back on there - I was going to delete them again, but I figured I would wait til I here from you. And I hope it doesn't mess up anything - but I did add AVG virus scan and ZoneAlarm since the last post. Logfile of HijackThis v1.99.1 Scan saved at 2:31:42 AM, on 3/24/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\WINDOWS\System32\LXSUPMON.EXE C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\dssd\fnhdlyku.exe C:\WINDOWS\system32\RUNDLL32.exe C:\Program Files\mjifvg26\mjifvg26.exe C:\WINDOWS\SysCheckBop32.exe C:\WINDOWS\system32\pioi\xbdlymi.exe C:\WINDOWS\system32\ubrst\ykwdnoyw.exe C:\WINDOWS\ms05127409-1266.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\certmgr3.exe C:\Program Files\Media Access\MediaAccK.exe C:\Program Files\Media Access\MediaAccess.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\interMute\SpySubtract\SpySub.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe C:\WINDOWS\System32\ScsiAccess.EXE C:\PROGRA~1\Toolbar\PIB.exe C:\WINDOWS\system32\omsb\sfrkr.exe c:\PROGRA~1\Toolbar\radio.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\mjifvg26\mjifvg261\mjifvg261.exe C:\Program Files\mjifvg26\81058280.exe C:\PROGRA~1\Toolbar\TBPS.exe C:\Program Files\America Online 9.0\waol.exe C:\Program Files\America Online 9.0\shellmon.exe C:\Program Files\America Online 9.0\aolwbspd.exe C:\Program Files\Internet Explorer\iexplore.exe C:\HJT\HijackThis.exe Thanks! Pete

Sorry Marty - that wasn't the right HJT log - here's the correct one:
Logfile of HijackThis v1.99.1
Scan saved at 3:03:21 AM, on 3/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\dssd\fnhdlyku.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\Program Files\mjifvg26\mjifvg26.exe
C:\WINDOWS\SysCheckBop32.exe
C:\WINDOWS\system32\pioi\xbdlymi.exe
C:\WINDOWS\system32\ubrst\ykwdnoyw.exe
C:\WINDOWS\ms05127409-1266.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\certmgr3.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\PROGRA~1\Toolbar\PIB.exe
C:\WINDOWS\system32\omsb\sfrkr.exe
c:\PROGRA~1\Toolbar\radio.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\mjifvg26\mjifvg261\mjifvg261.exe
C:\Program Files\mjifvg26\81058280.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [C:\WINDOWS\qzwdredfp.exe] C:\WINDOWS\qzwdredfp.exe
O4 - HKLM\..\Run: [yguinpxd] C:\WINDOWS\System32\qumwflm\yguinpxd.exe
O4 - HKLM\..\Run: [nrpiwxxt] C:\WINDOWS\System32\cyam\nrpiwxxt.exe
O4 - HKLM\..\Run: [dfes] C:\WINDOWS\System32\ddpmxjo\dfes.exe
O4 - HKLM\..\Run: [mteowff] C:\WINDOWS\System32\wpug\mteowff.exe
O4 - HKLM\..\Run: [vytptoj] C:\WINDOWS\System32\ndhrw\vytptoj.exe
O4 - HKLM\..\Run: [fdgxmla] C:\WINDOWS\System32\aejlee\fdgxmla.exe
O4 - HKLM\..\Run: [uonl] C:\WINDOWS\System32\rduvthr\uonl.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdt.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [mjifvg26] C:\Program Files\mjifvg26\mjifvg26.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitevnc32.exe
O4 - HKLM\..\Run: [ms05127409-1266] C:\WINDOWS\ms05127409-1266.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [ykwdnoyw] C:\WINDOWS\system32\ubrst\ykwdnoyw.exe
O4 - HKLM\..\Run: [sfrkr] C:\WINDOWS\system32\omsb\sfrkr.exe
O4 - HKLM\..\Run: [eegrjd] C:\WINDOWS\system32\vlgtdpjh\eegrjd.exe
O4 - HKLM\..\Run: [fnhdlyku] C:\WINDOWS\system32\dssd\fnhdlyku.exe
O4 - HKLM\..\Run: [xbdlymi] C:\WINDOWS\system32\pioi\xbdlymi.exe
O4 - HKLM\..\Run: [54ec883dfe14] C:\WINDOWS\system32\certmgr3.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\system32\ap9h4qmo.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\Tcaexr.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpyS

Hi Marty, QuietFusion and anyone else who's working with you!
Quiet - thanks for the last set of instructions, I've just finished them and will post the new HJT log and the Add/Remove Programs Panel that you asked for.
I was able to finally download the Panda Active scan, which I just completed, and it removed 6 infections. I still can't get a good clean download of the TrojanHunter scans, so I haven't been able to run those - but the RoadRunner people are coming tomorrow, so hopefully I can get those scanners going if they can get me connected to broadband.
I did run the KillBox as directed and the Clean Up also. I think we're getting there as I ran Ad-aware again and only one item came up this time as opposed to a couple hundred, and the SpyBot still has the Huntbar that it won't get rid of but that's it. And I've been online now for a bit - and no pop-ups!, and it definitely seems to be running smoother, so hopefully just a few more fixes will get things back to where they should be.
So, here's the Add/Remove Programs Panel from HJT:

3D Landscape for Everyone
Ad-Aware SE Personal
Adobe Download Manager 2.0 (Remove Only)
Adobe Photoshop Album 2.0 Starter Edition
Adobe Reader 6.0.1
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20030807.3)
aspi
AVG Free Edition
BCM V.92 56K Modem
Broadcom 802.11 Driver
Broadcom Management Programs
CCHelp
CCScore
CleanUp!
Dell Digital Jukebox Driver
Dell Media Experience
Dell Solution Center
Dell Support
DMVlite
DS21Patch
EarthLink Setup Files
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSTUTOR
ESSvpaht
ESSvpot
Futuremark Measurement Services Client
Greetings Workshop
HijackThis 1.99.1
HLPCCTR
HLPIndex
HLPPDOCK
IE Host R3
Intel® Extreme Graphics Driver
InternetOffers
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2
Kodak EasyShare software
KSU
Learn2 Player (Uninstall Only)
Lexmark Supplies Monitor
Lexmark Z23-Z33
Linksys Wireless-G PCI Adapter
Media Access
Microsoft .NET Framework 1.1
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Office 2000 Premium
Microsoft Publisher 98
mkw Audio Compression Toolkit
mkw Runtime Libraries
Modem Helper
Mozilla Firefox (1.0.1)
Mr. Potato Head Uninstaller
MUSICMATCH® Jukebox
My Search Bar
Notifier
NVIDIA Drivers
OTtBP
PCDLNCH
QuickTime
RealOne Player
SFR
SFR2
Shockwave
Skateboard Park Tycoon 2004
Snowboard Park Tycoon
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Spybot - Search & Destroy 1.3
SpySubtract
SpywareBlaster v3.3
System Monitor for Windows 98/NT/XP/2000/2003
The Sims House Party
VCAMCEN
Viewpoint Media Player
VPRINTOL
WebSearch Toolbar
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinZip
WordPerfect Office 11
ZoneAlarm

And here's the latest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 3:58:20 AM, on 3/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\mjifvg26\mjifvg26.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Toolbar\PIB.exe
c:\PROGRA~1\Toolbar\radio.exe
C:\Program Files\mjifvg26\mjifvg261\mjifvg261.exe
C:\Program Files\mjifvg26\81058280.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [mjifvg26] C:\Program Files\mjifvg26\mjifvg26.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ykwdnoyw] C:\WINDOWS\system32\ubrst\ykwdnoyw.exe
O4 - HKLM\..\Run: [sfrkr] C:\WINDOWS\system32\omsb\sfrkr.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitevnc32.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7BEC965-8019-46F1-855C-B31ACB970D42}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: bvvldjfyxpvvgd - Unknown owner - C:\WINDOWS\System32\yxpvvgd\bvvldjf.exe (file missing)
O23 - Service: fdgxmlaaejlee - Unknown owner - C:\WINDOWS\System32\aejlee\fdgxmla.exe (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: mteowffwpug - Unknown owner - C:\WINDOWS\System32\wpug\mteowff.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: sfrkromsb - Unknown owner - C:\WINDOWS\system32\omsb\sfrkr.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: vytptojndhrw - Unknown owner - C:\WINDOWS\System32\ndhrw\vytptoj.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe" "WMP54Gv4.exe (file missing)

Thanks in advance for the next set of suggestions when you get the chance!
Pete

Hi Marty, QuietFusion, etc. - sorry I didn't get back to you sooner. Couldn't post a reply on this site yesterdayfor some reason, but it seems to be working okay now.
I've done your last set of instructions Quiet and things are getting real close I think. I'll post the new Add/Remove programs Panel and the new HJT log at the end, but first I'll let you know the status of my PC and how the last round went.
First, I still can't remove the DMVLite from the Add/Remove Programs - now it says the file isn't there I think. Second, I was able to finally do the TrojanHunter scan and the TrendMicro Housecall scans as initially instructed by Marty - it wasn't a matter of accessing the website, moreso a matter of not being able to download the scans on the dial-up. But after I did the last set of instructions, RoadRunner was working great and I accessed those sites and ran the scans.
Marty had asked to write the names of any files that couldn't be fixed with those scans and these were the only 2(from TrendMicro Housecall):

TROJ DLOADER.DH C:\WINDOWS\TEMP\THI3D29.tmp\farmmext.cab
TROJ DLOADER.DH C:\WINDOWS\TEMP\THI3D29.tmp\farmmext.exe

Ad-Aware also comes up with only one file each time -a WinUpdate file which is deleted by the utility, and Spybot keeps coming up with the Huntbar as the only item it can't fix - this is the registry item it gives for HuntBar:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersions\Explorer\VolumeCaches\ContentIndexerCleaner

Interestingly, I found a site that has a Huntbar removal site - but after it scanned my whole system it didn't find anything to remove, yet the SpyBot keeps coming up with that item and can't fix it every time - not sure what all that means.

One last thing which I was a little worried that I di the wrong thing was that I removed a program called win-dh from my Add/Remove program - that was before the logs I sent you - I thought it was related to a program I didn't need, but now I see those DLOADER.DH files that came up in the HouseCall scan and hope they aren't related in any way - any idea what that program was that I deleted and should I try to get it back?!

Finally, I did get temporary connection to RoadRunner after the last HJT fix. The RR guy came to the house just as I completed it and of course it was working fine so he didn't really do anything. But when I signed off and tried to get back on it wouldn't connect again, so there must be something left on the HJT that is still interfering with my connection I'm wondering - so hopefully we can get it permanently cleaned up this time as it's almost there. Otherwise there haven't been any pop-ups at all, and the PC is running good, so thanks for everything so far.
Sorry to be so wordy about all that, but hope it helps, and here's the latest HJT logs for Add/Remove and the regular one:

3D Landscape for Everyone
Ad-Aware SE Personal
Adobe Download Manager 2.0 (Remove Only)
Adobe Photoshop Album 2.0 Starter Edition
Adobe Reader 6.0.1
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20030807.3)
aspi
AVG Free Edition
BCM V.92 56K Modem
Broadcom 802.11 Driver
Broadcom Management Programs
CCHelp
CCScore
CleanUp!
Dell Digital Jukebox Driver
Dell Media Experience
Dell Solution Center
Dell Support
DMVlite
DS21Patch
EarthLink Setup Files
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSTUTOR
ESSvpaht
ESSvpot
Futuremark Measurement Services Client
Greetings Workshop
HijackThis 1.99.1
HLPCCTR
HLPIndex
HLPPDOCK
IE Host R3
Intel® Extreme Graphics Driver
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2
Kodak EasyShare software
KSU
Learn2 Player (Uninstall Only)
Lexmark Supplies Monitor
Lexmark Z23-Z33
Linksys Wireless-G PCI Adapter
Microsoft .NET Framework 1.1
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Office 2000 Premium
Microsoft Publisher 98
mkw Audio Compression Toolkit
mkw Runtime Libraries
Modem Helper
Mozilla Firefox (1.0.1)
Mr. Potato Head Uninstaller
MUSICMATCH® Jukebox
Notifier
NVIDIA Drivers
OTtBP
PCDLNCH
QuickTime
RealOne Player
RollerCoaster Tycoon® 3
SFR
SFR2
Shockwave
Skateboard Park Tycoon 2004
Snowboard Park Tycoon
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Spybot - Search & Destroy 1.3
SpySubtract
SpywareBlaster v3.3
System Monitor for Windows 98/NT/XP/2000/2003
The Sims House Party
TrojanHunter 4.2
VCAMCEN
Viewpoint Media Player
VPRINTOL
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinZip
WordPerfect Office 11
ZoneAlarm

And the present HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:21:57 PM, on 3/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\mjifvg26\mjifvg26.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\mjifvg26\mjifvg261\mjifvg261.exe
C:\Program Files\mjifvg26\81058280.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Dell\Support\Alert\bin\rng.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [mjifvg26] C:\Program Files\mjifvg26\mjifvg26.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3FDA720-1368-419B-A1E2-9E2897AF91F6}: NameServer = 24.92.222.176,24.92.226.52,24.92.226.40,24.92.226.186
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7BEC965-8019-46F1-855C-B31ACB970D42}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe" "WMP54Gv4.exe (file missing)

One last thing I just remembered - I didn't run the one windowsecurity Trojan scan that Marty had mentioned - as it said I need to download an Active X file to run it I think - but I wasn't sure if I should do that, as I kept seeing that tag at the end of your posts Quiet about 'disabling ActiveX and javascript if I want security' - but if it's okay to do it sometimes, I'll go ahead and run it with ActiveX.
Thanks again and I anxiously await your input as I think we're almost there!
Pete

Thanks again Quiet - I've completed all the instructions, and here's the newest Hijackthis log and the FindIt log:

Logfile of HijackThis v1.99.1
Scan saved at 12:02:22 AM, on 3/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [CleanUp!] C:\PROGRA~1\CleanUp!\CleanUp.exe /WindowsRestart
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.rr.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3FDA720-1368-419B-A1E2-9E2897AF91F6}: NameServer = 24.92.222.176,24.92.226.52,24.92.226.40,24.92.226.186
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7BEC965-8019-46F1-855C-B31ACB970D42}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Adapter\WLService.exe" "WMP54Gv4.exe (file missing)


FindIt log:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running from: C:\unzipped\FindIt_NT-2K-XP\Find It NT-2K-XP

——- System Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is B488-6DCF

Directory of C:\WINDOWS\System32

03/20/2005 01:39 PM DLLCACHE
03/01/2005 10:25 AM 417,792 w?nlogon.exe
12/04/2003 01:17 PM Microsoft
1 File(s) 417,792 bytes
2 Dir(s) 23,554,670,592 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is B488-6DCF

Directory of C:\WINDOWS\System32

03/28/2005 11:04 PM 890 vsconfig.xml
03/22/2005 12:07 AM 4,212 zllictbl.dat
03/20/2005 01:39 PM DLLCACHE
03/17/2005 02:40 AM 749 wuaucpl.cpl.manifest
03/17/2005 02:40 AM 749 cdplayer.exe.manifest
03/17/2005 02:40 AM 749 sapi.cpl.manifest
03/17/2005 02:40 AM 749 ncpa.cpl.manifest
03/17/2005 02:40 AM 749 nwc.cpl.manifest
03/04/2005 04:11 PM 110,592 sysmonnt.exe
03/01/2005 10:25 AM 417,792 w?nlogon.exe
01/22/2005 03:33 PM vmss
09/03/2002 09:57 AM 488 logonui.exe.manifest
09/03/2002 09:57 AM 488 WindowsLogon.manifest
11 File(s) 538,207 bytes
2 Dir(s) 23,554,666,496 bytes free

———— Files Named "Guard" —————

Volume in drive C has no label.
Volume Serial Number is B488-6DCF

Directory of C:\WINDOWS\System32


—— Temp Files in System32 Directory ——

Volume in drive C has no label.
Volume Serial Number is B488-6DCF

Directory of C:\WINDOWS\System32


—————— User Agent —————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""


————- Keys Under Notify ————-

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


————- Locate.com Results ————-

——– Strings.exe Qoologic Results ——–

C:\WINDOWS\SYSTEM32\pav.sig: Qoologic
C:\WINDOWS\SYSTEM32\pav.sig: Qoologic

——— Strings.exe Aspack Results ———

C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack
C:\WINDOWS\SYSTEM32\pav.sig: AsPack

————– HKLM Run Key —————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"BCMSMMSG"="BCMSMMSG.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"StorageGuard"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"DwlClient"="C:\\Program Files\\Common Files\\Dell\\EUSW\\Support.exe"
"LXSUPMON"="C:\\WINDOWS\\System32\\LXSUPMON.EXE RUN"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

Thanks again - and let me know what's next when you have a chance.
Regards,
Pete