Let's do it backwards from the usual method.  You have so many that it is easier to tell you what to keep:

 

Run HijackTHis and check the following then ADD TO IGNORE LIST.  These are the good guys! 

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com/
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [OEMRUNONCE] c:\windows\options\cabs\oemrun.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [Gateway Ink Monitor] C:\Program Files\Gateway\Gateway Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [GhostStartService] C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TypingSatellite] "C:\PROGRAM FILES\TYPINGMASTER\KBOOST.EXE"
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://gateway.yahoo.com

 

Now go to Hijackthis's Config and check the box:  Mark Everything Found For Fixing After Scan.  Then Back and run a new scan and then Fix Checked.  It will ask you if you are sure but do it anyway.

 

This will not get rid of everything but it will be a start.   Shutdown and reboot into Safe Mode.

 

 Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu.

 

 Run a  HijackThis scan and Fix Checked everything.  Then reboot into regular mode.

 

Run HijackThis, Misc Tools, Open Hosts Files Manager and Open in Notepad.

 

Delete everything except:

 

127.0.0.1       localhost

 

(Lines which start with # are comments and can be left in)

 

Save and exit.

 

Run another scan and put the log in your next reply.

 

 

 

You will still have the About Blank infection but let's see if we can get you back on line.

 

Ron

You got rid of more than I expected.

 

Run HijackTHis, Misc Tools, Open Process Manager then

 

find and highlight:

 

C:\WINDOWS\SYSTEM\LFGSNMDM.EXE

 

Then Kill Process. 

 

Then Start, Run, command, OK to bring up a DOS-type window.  Type:

 

attrib -r -h -s \WINDOWS\SYSTEM\LFGSNMDM.EXE  

del \WINDOWS\SYSTEM\LFGSNMDM.EXE

 

exit

 

 

Then reboot and run a new scan and see if it comes up again.

 

Then run a new HijackThis scan and try to get rid of the remainder.   Post the new scan as a reply.

 

You can also try right clicking on the Internet Explorer icon on the desktop and select Properties (or bring up Internet Explorer and select Tools, Internet options)  then select Security and Trusted Zone and then Sites and manually delete the entries.  If it says you need a password then let me know and I'll tell you how to get around it.

 

Finally let's see if lspfix.exe will fix your internet problem.

 

http://www.cexx.org/LSPFix.exe

 

Save it and Open it then click on I know what I am doing and then Finish.

 

Ron

 

 

 

 

 

internet access, since i did downloaded the latest description of Norton antivirus last week with this set up.

ok, since i didn't feel like driving back and forth to her place, and didn't want to log her pc tower to my house, i took the hard drive from her pc and placed it on one of my older pc (as a master drive). since it's ME, it automatically recognized the drivers, thus the online connection with symantec.

 

now back to your latest prescription. you said:

 

I don't see anything else that looks odd in the running processes.   I assume there is still something that runs at startup that HijackThis didn't find in its normal mode.  Try HijackThis, Misc Tools, Ignore list, Delete All and then on the Misc Tools page, check the two boxes next to Generate Startup List then press Generate Startup List.  The log will be too big to post so send it to me as an attachment.  rkinner AT att DOT net

 

IF you can it would be a good idea to get the latest version of AdAware and run it on your PC.

 

http://www.lavasoftusa.com/software/adaware/

 

The free version will do.

 

This may be trojanAgent.bi

 

http://www.sophos.com/virusinfo/analyses/trojagentbi.html

 

Do you have a folder called:

 

C:\windows\system\software

 

or C:\Windows\Test?

 

If so delete both of them.

 

Ron