> Oh - another clue - never happens when I'm logged out of XP 
> and never happens when I disable the network connection on 
> the machine.  I also don't normally run with Admin privileges.


The malware may be starting in your logon script.
http://www.windowsnetworking.com/articles_tutorials/wxpplogs.html

Again, autorun from sysinternals (a free utility) will list all possible
sources for the startup of any program. Finding and removing the entry for
the malware will stop it from gaining control of the system.
http://www.sysinternals.com/Utilities/Autoruns.html

Note that there are many strange looking things that DO need to start, and
you must be careful. Autoruns allows you to filter OUT Microsoft signed
programs, and it has a nice feature to google for the program name which
will generally allow you to see what it does and why.

Be sure to run it after booting in safemode so that they program will not be
able to re-install its self in the run list after you remove it.

---
James.
 


-- 
http://www.piclist.com PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist