Have run updated Adaware, Spybot and AVG. My daughter got on a very malisious site and it downloaded Look2Me and a bunch of other sites that I can not remove. I get some removed but they keep coming back. Here is my hijack this and startdreck sLogfile of HijackThis v1.99.1
Scan saved at 7:06:19 PM, on 8/19/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\DFNDRFF_11A.EXE
C:\KYBRDFF_11A.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\LOGITECH\PROFILER\LWEMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS13
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wmtel.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F1 - win.ini: run=C:\WINDOWS\INETDATA\SERVICES.EXE
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [BearShare] "C:\PROGRAM FILES\BEARSHARE\BEARSHARE.EXE" /pause
O4 - HKLM\..\Run: [defender] C:\\DFNDRFF_11A.exe
O4 - HKLM\..\Run: [keyboard] C:\\KYBRDFF_11A.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SNM] C:\PROGRAM FILES\SPYNOMORE\SNM.EXE /startup
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwtest.exe" /detect /quiet /launch "C:\Program Files\Logitech\Profiler\lwemon.exe /noui"
O4 - HKCU\..\Run: [BitTorrent] "C:\PROGRAM FILES\BITTORRENT\BITTORRENT.EXE" –force_start_minimized
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 167.142.196.204,167.142.196.203
StartDreck (build 2.1.7 public stable) - 2006-08-19 @ 19:07:30 (GMT -05:00)
Platform: Windows ME (Win 4.90.3000 )
Internet Explorer: 5.50.4134.0100
Logged in as User1 at X4K3X2

»Registry
»Run Keys
»Current User
»Run
*MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
*Start WingMan Profiler="C:\Program Files\Logitech\Profiler\lwtest.exe" /detect /quiet /launch "C:\Program Files\Logitech\Profiler\lwemon.exe /noui"
*WPCycle.exe=
*BitTorrent="C:\PROGRAM FILES\BITTORRENT\BITTORRENT.EXE" –force_start_minimized
»RunOnce
»Default User
»Run
*MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
*Start WingMan Profiler="C:\Program Files\Logitech\Profiler\lwtest.exe" /detect /quiet /launch "C:\Program Files\Logitech\Profiler\lwemon.exe /noui"
*WPCycle.exe=
*BitTorrent="C:\PROGRAM FILES\BITTORRENT\BITTORRENT.EXE" –force_start_minimized
»RunOnce
»Local Machine
»Run
*AVG7_EMC=C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
*ScanRegistry=C:\WINDOWS\scanregw.exe /autorun
*TaskMonitor=C:\WINDOWS\taskmon.exe
*PCHealth=C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
*SystemTray=SysTray.Exe
*QuickTime Task="C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
*PE2CKFNT SE=C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
*LexStart=lexstart.exe
*LoadQM=loadqm.exe
*BearShare="C:\PROGRAM FILES\BEARSHARE\BEARSHARE.EXE" /pause
*defender=C:\\DFNDRFF_11A.exe
*keyboard=C:\\KYBRDFF_11A.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SNM=C:\PROGRAM FILES\SPYNOMORE\SNM.EXE /startup
»RunOnce
»RunServices
*RegisterDropHandler=C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
*StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE
*KB891711=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SchedulingAgent=mstask.exe
**StateMgr=C:\WINDOWS\System\Restore\StateMgr.exe
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»Browser Helper Objects (LM)
»Files
»System/Drivers
»Running Processes
+FFEF5F47=C:\WINDOWS\SYSTEM\KERNEL32.DLL
+FFFF17A7=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
+FFFFEF8F=C:\WINDOWS\SYSTEM\SPOOL32.EXE
+FFFF8173=C:\WINDOWS\SYSTEM\MPREXE.EXE
+FFFE1D9B=C:\WINDOWS\SYSTEM\STIMON.EXE
+FFFEDE07=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
+FFFE042B=C:\WINDOWS\SYSTEM\MSTASK.EXE
+FFFEC073=C:\WINDOWS\SYSTEM\LEXBCES.EXE
+FFFE9387=C:\WINDOWS\SYSTEM\RPCSS.EXE
+FFFDEA97=C:\WINDOWS\SYSTEM\LEXPPS.EXE
+FFFC7B0B=C:\WINDOWS\SYSTEM\mmtask.tsk
+FFFC769B=C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
+FFFCE92B=C:\WINDOWS\EXPLORER.EXE
+FFFCB57F=C:\WINDOWS\RUNDLL32.EXE
+FFFBFC03=C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
+FFFBA6FF=C:\WINDOWS\TASKMON.EXE
+FFFB977F=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
+FFFBA4E7=C:\WINDOWS\LOADQM.EXE
+FFFA528F=C:\DFNDRFF_11A.EXE
+FFFA198B=C:\KYBRDFF_11A.EXE
+FFFB549B=C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
+FFF92AC7=C:\WINDOWS\SYSTEM\DDHELP.EXE
+FFF92363=C:\WINDOWS\SYSTEM\WMIEXE.EXE
+FFF882D7=C:\PROGRAM FILES\LOGITECH\PROFILER\LWEMON.EXE
+FFFAAE4B=C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
+FFF63B73=C:\WINDOWS\SYSTEM\PSTORES.EXE
+FFF7865B=C:\MY DOCUMENTS\STARTDRECK\STARTDRECK.EXE
»Application specific

cans.