Pooh,

That is interesting.........

they will still be active in safe mode, because the primary dlls are infected.
Which primary .dlls? and what operating systems are you including?

Cheers