Yes, it was a virus trying to scare you into buying bogus anti-virus software. If you had done that, you not only would have been ripped off for the purchase price, you might have had your credit card number stolen, and also gotten an even worse computer infection. AVG and Malwarebytes will hopefully quarantine this and allow you to delete it. If the problem recurs, start up your computer in Safe Mode and run your scans that way.

As our designated family historian & a genealogist, I've amassed about 70 pictures of 8 generations that are the foundation of our family's history. The oldest has a birth year of 1833. Some are hand enamelled in beautiful colors (Russia). It took many years to gather those pictures including letters to the US War Department. They sent me an 8"x10" picture of great-grandpa in his Civil War uniform that they had in their files along with all his regiment info. He fought with Grant at Shiloh, Vicksburg, Ft. Donelson, and a couple others eventually having his horse shot out from under him (happened often). Bad times for our country. I've gathered pictures from people I've never met living in Siberia, Germany, Scotland, Sweden, and all over the US. Those wonderful people who either knew or knew of my ancestors took the time to write a short note of any info they had about that person's life. It took us several years due to the expense but we've had them all archivally matted & framed. I attached notes on the person's life to the back of each picture. Also on the back I've noted which kid gets that original picture when I die. In the meantime, they hang on our "Rogue's Gallery" wall here in Mystic. Every time the kids and grands are here a few minutes are spent looking at the pictures & teaching the latest generation names & connections. We are a motley group. :) I've got a complicated system for filing thousands of photos, vital record documents, maps, letters, Rutgers University Library research, my own research from study & trips, cemetery excursions, etc. I've written & published (in 1992) an over 800 page book on Mom's genealogy & my photos are filed by reference numbers tied to that book. It was a physical impossibility to give each kid one of everything. So, I made each a large scrapbook from copies of items that seemed best suited to each. I gave them their scrapbooks on their wedding days. Of course, they also each have a copy of the book that contains hundreds of pictures. They each have a copy of my file system for after I'm gone & they have to decide what to do with the book's documentation. I have 37 of those humongeous Rubbermaid tubs stuffed with pictures, immigrations info, citizenship stuff, vital records, etc. The tubs are color coded for each surname. Photos of during the kids' childhood years...I took the easy way out. I presented them each a tub & said, "Have fun! Keep what you wish & you decide what to do with the rest." :) My second genealogy book, "Thunder on the Steppes" has come back from the second edit & I'm waiting for one last 4'x6' genealogical chart from Dr. Pleve in Saratov & then it's ready for publishing. I've been waiting on that darn chart for 10+ years. His wife prepares them in beautiful Russian caligraphy. I've received 6 and this last chart wraps up a huge project. /tricia (who really doesn't want to see more pictures!)

Ravencajun, Last night I did another scan, It was very slow. I use Charter's High speed internet Security Suiet. It comes with my internet service. This trojan is not listed in their definitions. To be honest I have run into it previously and thought if they didn't do anything with it, it must not be serious. It was the email that allerted me to a possible connection. I also get some notices that say something that is acting as a server wants access. I always click deny! The following is the report after last night's scan. I really apperciate your concern and helpfulness! _________________________________________ Scanning Report 25 August 2009 20:30:53 - 21:55:14 Computer name: D2JGNZB1 Scanning type: Scan target Target: C:\ -------------------------------------------------------------------------------- Result No malware found -------------------------------------------------------------------------------- Riskware found Downloader.Win32.Agent.q (Riskware) C:\14B5.tmp -------------------------------------------------------------------------------- Statistics Scanned: Files: 132306 Not scanned: 21 Result: Viruses: 0 Spyware: 0 Suspicious items: 0 Riskware: 1 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 Quarantined: 0 Failed: 0 Boot Sectors: Scanned: 2 Infected: 0 Suspicious items: 0 Disinfected: 0 Files not scanned: Cannot open file (click here for more info) C:\PAGEFILE.SYS Cannot open file (click here for more info) C:\WINDOWS\TEMP\AVP427.TMP Cannot open file (click here for more info) C:\WINDOWS\TEMP\AVP428.TMP Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SAM Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Scanning of C:\WINDOWS\Installer\149cc.msp\stream 574 was aborted [F-Secure AVP] Scanning of C:\Program Files\Charter High-Speed Security Suite\FSAUA\content\70Software_PSC800\34\program\inst\fsma_7.80-127260.windows.fip\fsma\x86-windows\ILAUNCHR.EXE was aborted [F-Secure AVP] Scanning of C:\i386\DRIVER.CAB was aborted [F-Secure AVP] Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\ANGUSHIRE MEDOWS.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\COMPUTER HELPS AND TIPS.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\INBOX.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\HAYJUDO50.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(2C545ACC-8A17-4851-B0AB-238D63125F07)\MICROSOFT\OUTLOOK EXPRESS\INBOX.DBX -------------------------------------------------------------------------------- Options Definitions version: Viruses: 2009-08-25_08 Spyware: 2009-08-25_08 Scanning Engines: F-Secure AVP: 7.00.171, 2009-08-25 F-Secure Hydra: 4.00.9271, 2009-08-25 Scanning options: Scan all files Scan inside archives Actions: Viruses: Ask after scan Spyware: Ask after scan -------------------------------------------------------------------------------- Error information "Cannot open file" error occurred: The "Cannot open file" error message means that the scanner was unable to open a file and that this file was not scanned. You can normally ignore this error message as there are many reasons for this message that do not imply a security threat, including: The file was a system file. System files are protected by the operation system by design. You can ignore this message in this case. You do not have permission to read the file. To scan the file, log in with a user account with sufficient permissions (for example the computer's administrator account) and rescan. The file was in use by an application when the scan was performed. To scan this file, close all applications and rescan. -------------------------------------------------------------------------------- Copyright 1998-2008 Product support : Send virus sample to F-Secure

Malwarebytes' Anti-Malware 1.41 Database version: 3082 Windows 5.1.2600 Service Pack 3 (Safe Mode) 11/26/2009 3:50:48 AM mbam-log-2009-11-26 (03-50-48).txt Scan type: Quick Scan Objects scanned: 106513 Time elapsed: 18 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 9 Registry Values Infected: 7 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\(c9c5deaf-0a1f-4660-8279-9edfad6fefe1) (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\(e4e3e0f8-cd30-4380-8ce9-b96904bdefca) (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\(fe8a736f-4124-4d9c-b4b1-3b12381efabe) (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(df780f87-ff2b-4df8-92d0-73db16a1543a) (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(df780f87-ff2b-4df8-92d0-73db16a1543a) (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\(df780f87-ff2b-4df8-92d0-73db16a1543a) (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\10331715 (Rogue.Multiple.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\13636423 (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38017019 (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37743428 (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\06495327 (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\54769940 (Rogue.Multiple) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Documents and Settings\All Users\Application Data\10331715 (Rogue.Multiple.H) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users\Application Data\10331715\10331715.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully. C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.Thanks Raven, I hope this is what you need, PK, in S. La.