NooNoo you are a godsend.

It must have been a variant of the sircam virus, because the only registry key I had to edit was HKEY_CLASSES_ROOT\exefile\shell\open\command and it had the winampw.exe in that key. I deleted that and followed the rest of the directions and the other two key were not present. I also had to change regedit.exe to regedit.com via safe mode command prompt first as well.

Thanx again NooNoo this is the 5th (I think) time you have saved my a$$. I wish I could afford to send ya something for Xmas ......maybe for valentines day <wink>

Peace,

--Dan