You ask, "Do I think I have one?" I don't know. Everything is working OK as far as I can see. But some time ago a pop-up appeared saying that I had encountered malware and that I should use "Ultimate Cleaner" to get rid of it. The pop-up looked like something from Microsoft, so I assumed it was a good service of the company. I then clicked "OK" for the cleanup. After a moment or two a new window popped up with around a hundred "infections" shown in a log. It suggested that I pay some $29 or so for the "Ultimate Cleaner" which would get rid of the bad stuff. I was immediately suspicious. After a bit of research I learned that Ultimate Cleaner is a malware scam. I don't know if my actions had allowed it into my computer or not, and I have not seen any visible problems. Second cause for concern: Yesterday, an alert appeared from Trend micro (my anti virus program) warning me of a trojan horse "ht----" something or other from the site I was viewing. I immediately killed the web page I was viewing and ran a scan on TrendMicro antivirus program which showed nothing. I doubt if this second occasion downloaded anything, but I wonder. RB

If Avg put them in the vault, then good! leave them there especially if you think there false positives. AVG could end up removing legit files. If that turns out TO BE THE CASE you can restore them FROM THE VAULT... Really need to know the name of the file and where it was!!!! SuperAntiSpyware will always pick up things that Malwarebytes might miss, that's why it's always best to run the 2 in conjunction. Run an ESET online scanner next.........

Would the Trojan Horse have been activated I wouldn't think so. If you would have clicked on base_getstarted.exe or maybe even QuickBooks, it may have tried to do something but AVG would have popped up a red flag asking whether you wanted to heal or move to virus vault. Since it is in the virus vault, that means it was removed from the program file and is harmless now. You can delete it from the virus vault now. Since you have that wonderful Grisoft AVG anti-virus program, you don't need to worry about Trojans. Might want to try the AVG Anti-Spyware program and see how many spy cookies and other spyware you have. AVG Anti-Spyware Free Edition The free version is good enough to do a scan.

The first time I ran the scan I had 48 infected files. Below are the results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 12:35:40 AM mbam-log-2008-10-31 (00-35-40).txt Scan type: Full Scan (C:\:) Objects scanned: 102474 Time elapsed: 2 hour(s), 39 minute(s), 50 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 38 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 10 Memory Processes Infected: C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"e4e3e0f8-cd30-4380-8ce9-b96904bdefca> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"fe8a736f-4124-4d9c-b4b1-3b12381efabe> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\"c9c5deaf-0a1f-4660-8279-9edfad6fefe1> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"1d4db7d2-6ec9-47a3-bd87-1e41684e07bb> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFinding (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WServing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\macidwe (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfs (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdxdowkc (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Outlook Express\wab.exe.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore"86FA0783-B9F2-4690-B09B-2E6C03E185B4>\RP113\A0017080.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\afisicx.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\noytcyr.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\roytctm.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\tdydowkc.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\wsldoekd.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully. /////////////////////////////////////////////////// So I quarantined them and re-booted and ran the scan again and it showed nothing infected but the same message window that said Resident Sheild Alert Threat name: Trojan Horse Agent.4.E was there above the results of the scan. Below is the logged in results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 1:34:54 PM mbam-log-2008-10-31 (13-34-54).txt Scan type: Full Scan (C:\:) Objects scanned: 102262 Time elapsed: 2 hour(s), 38 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Maybe this is the end of it. Maybe. Thanks so much.