Kevin

i think its all gone: Malwarebytes' Anti-Malware 1.11 Database version: 611 Scan type: Full Scan (A:\|C:\|D:\|E:\|) Objects scanned: 96002 Time elapsed: 53 minute(s), 33 second(s) Memory Processes Infected: 2 Memory Modules Infected: 3 Registry Keys Infected: 36 Registry Values Infected: 5 Registry Data Items Infected: 1 Folders Infected: 2 Files Infected: 22 Memory Processes Infected: C:\WINDOWS\system32\lgnarelg.exe (Trojan.FakeAlert) -> Unloaded process successfully. C:\Documents and Settings\All Users\Application Data\nqfarqlq\nqdkpype.exe (Trojan.FakeAlert) -> Unloaded process succ

here: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:53:25 PM, on 04/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin