I lurked and read and used sdfix which found 2 dozen files that came in virtually at once when someone borrowed the computer to check her e-mail. at any rate - how clean does this look to you guys? thanks in advance. hijack this log first, then sdfix Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:28:15 PM, on 6/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\sy