Thank you for your help. I have followed your instructions for both VBG and Java. Here is the VBG Log file:

[01/20/2006, 16:26:30] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Peter\Desktop\VirtumundoBeGone.exe" )
[01/20/2006, 16:26:44] - Detected System Information:
[01/20/2006, 16:26:44] -  Windows Version: 5.1.2600, Service Pack 2
[01/20/2006, 16:26:44] -  Current Username: Peter (Admin)
[01/20/2006, 16:26:44] -  Windows is in NORMAL mode.
[01/20/2006, 16:26:44] - Searching for Browser Helper Objects:
[01/20/2006, 16:26:44] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[01/20/2006, 16:26:44] -  BHO 2: {2353FCBC-012D-487B-8BF3-865C0929FBEB} (ATLDistrib Object)
[01/20/2006, 16:26:44] - ALERT: Found ATLDistrib Object!
[01/20/2006, 16:26:44] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[01/20/2006, 16:26:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/20/2006, 16:26:44] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[01/20/2006, 16:26:44] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[01/20/2006, 16:26:44] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[01/20/2006, 16:26:44] -  BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[01/20/2006, 16:26:44] -  BHO 6: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[01/20/2006, 16:26:44] - Finished Searching Browser Helper Objects
[01/20/2006, 16:26:44] - *** Detected ATLDistrib Object
[01/20/2006, 16:26:44] - Trying to remove ATLDistrib Object...
[01/20/2006, 16:26:45] -    Terminating Process: IEXPLORE.EXE
[01/20/2006, 16:26:45] -    Terminating Process: RUNDLL32.EXE
[01/20/2006, 16:26:46] -    Disabling Automatic Shell Restart
[01/20/2006, 16:26:46] -    Terminating Process: EXPLORER.EXE
[01/20/2006, 16:26:46] -    Suspending the NT Session Manager System Service
[01/20/2006, 16:26:46] -    Terminating Windows NT Logon/Logoff Manager
[01/20/2006, 16:26:47] -    Re-enabling Automatic Shell Restart
[01/20/2006, 16:26:47] -   File to disable: C:\WINDOWS\system32\urqpp.dll
[01/20/2006, 16:26:47] -  Renaming C:\WINDOWS\system32\urqpp.dll -> C:\WINDOWS\system32\urqpp.dll.vir
[01/20/2006, 16:26:47] -  File successfully renamed!
[01/20/2006, 16:26:47] -   Removing HKLM\...\Browser Helper Objects\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
[01/20/2006, 16:26:47] -   Removing HKCR\CLSID\{2353FCBC-012D-487B-8BF3-865C0929FBEB}
[01/20/2006, 16:26:47] -   Adding Kill Bit for ActiveX for GUID: {2353FCBC-012D-487B-8BF3-865C0929FBEB}
[01/20/2006, 16:26:47] -   Deleting ATLEvents/MSEvents Registry entries
[01/20/2006, 16:26:47] -   Removing HKLM\...\Winlogon\Notify\urqpp
[01/20/2006, 16:26:47] - Searching for Browser Helper Objects:
[01/20/2006, 16:26:47] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[01/20/2006, 16:26:47] -  BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[01/20/2006, 16:26:47] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/20/2006, 16:26:48] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[01/20/2006, 16:26:48] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[01/20/2006, 16:26:48] -  BHO 3: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[01/20/2006, 16:26:48] -  BHO 4: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[01/20/2006, 16:26:48] -  BHO 5: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[01/20/2006, 16:26:48] - Finished Searching Browser Helper Objects
[01/20/2006, 16:26:48] - Finishing up...
[01/20/2006, 16:26:48] - A restart is needed.
[01/20/2006, 16:26:48] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[01/20/2006, 16:27:00] - Attempting to Restart via STOP error (Blue Screen!)

Here is the new HijackThis Log file:

Logfile of HijackThis v1.99.1
Scan saved at 4:34:14 PM, on 1/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\InternetSecurity\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\InternetSecurity\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\InternetSecurity\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\InternetSecurity\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Peter\Desktop\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\InternetSecurity\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\InternetSecurity\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\InternetSecurity\eTrust EZ Antivirus\ISafe.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\InternetSecurity\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Please let me know how to proceed.

Message Edited by x86 on 01-22-2006 01:58 AM

x86,

i'm offering this comment only because i was already in this thread first:

while it's bad to run the HJT.exe program itself from the Desktop, there's nothing wrong with having an HJT folder on the Desktop.

the reason we don't want to run the HJT.exe program from the desktop is because HJT generates log files, and backup files, in the folder from which it is run.  So if run from the Desktop, all these logs/backups will just "clutter-up" the user's desktop. And if the user simply deletes them from there, they'll lose the important backup information, which may be needed in case they have to "undo" [restore] some of the things they "FIX" incorrectly.

in contrast, by having an HJT folder on the desktop (with the HJT program being run from inside this folder),  all the logs/backups will be collected/organized into this folder.   and moreover, the desktop folder gives the user easy access to the HJT program and related files.