Hi John,

Along with what John Harvey said about the Run key also check the RunServices key.

Other places:
Autoexec.bat
Config.sys
Windows Startup Folder
Use SysEdit from a Run window and check the line in system.ini [boot] section:
shell=Explorer.exe
shouldn't contain other text following. Will be executed by explorer.

>Hi,
>My computer has been infected by trojan 5.L (msdirectx.sys).
>I tried :
>1. Boot PC to WINXP SP1 safe mode.
>2. Login as administrator
>3. Delete msdirectx.sys from \document and settings\users / \document and settings\administrator
>4. Delete msdirectx.sys entry from registry
>5. Turn off System Restore.
>6. Run AVG to scan whole computer.
>7. Reboot computer.
>
>However, the virus is still there. Any ideas?
>
>Thank you