Hello pkraft,

Have you already gone through PP's Sticky? If you have not done so, then please do this first.

Next, download my own CleanupXP+ from this post (read post to familiarize yourself with the tool but it is pretty straight forward).

After following the PP's sticky, reboot in Safe Mode one last time to run CleanupXP+, after the standard cleaning process, press 2 when prompted for 'Remove a Folder' option and enter the following bold path as shown:
C:\WINDOWS\web

Then use option 1 for 'Remove a File' and enter the following:
WinStart001.EXE

to delete them if still existed, afterwards reboot in Normal mode and run another HijackThis, make sure IE is NOT running this time or any time you run the HJT scan as you had the last time:
C:\Program Files\Internet Explorer\IEXPLORE.EXE
!

If the following entry still remain you will have to use LSP-Fix to remedy it, you could also try to see if HJT can fix it:
O10 - Broken Internet access because of LSP provider 'rsvp32_2.dll' missing
But we will go over that if it is applicable.

Please, do not use MSConfig to modify any startup entries. If you indeed did so, please revert your changes back:
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

Have HJT Fix the following when you are in the Safe Mode:
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k

O8 - Extra context menu item: View Partial So&urce - C:\WINDOWS\web\source.htm
O9 - Extra button: (no name) - {438AFBA1-B0CB-11d2-9214-00104B3BCE5F} - C:\WINDOWS\web\tree.htm
O9 - Extra 'Tools' menuitem: &Document Tree - {438AFBA1-B0CB-11d2-9214-00104B3BCE5F} - C:\WINDOWS\web\tree.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users\Documents\Settings\bot.dll
O21 - SSODL: SxQHpRUcMid - {2C4A6A44-86E0-C0EE-91B7-B3C85FBB37F4} - C:\WINDOWS\system32\ud.dll
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe (file missing)
What do you know about the following entry??
O17 - HKLM\System\CCS\Services\Tcpip\..\{26FB5087-36E1-4C61-8781-35A69C01309A}: NameServer = 192.168.1.254

I am sorry I do not have much time to get in to details nor provide detailed instructions at this time but what I recommended should get you started in the right direction with some positive changes in your condition.

Please do no install/uninstall any programs or make any other changes during the disinfection process other than what is advised here, ok?

Either myself or one of the Spyware gurus will check in later on.