I reran Malwarebytes (the 3rd run) as instructed. It reported "The scan completed successfully. No malicious items were detected." I have a copy of the happy details which I can post here if you still want to see them. I rescanned with Spybot and this time it gave me the bright green all-okay check mark and made no mention of virtumonde.sci. I retried the TrendMicro Housecall and it made its way through all the C and D files and I think through the grayware/spyware category when it came to a halt and the dreaded box appeared saying "An error occurred while trying to transfer data from the Internet. Do you want Trend Micro Housecall to try resendingÂ". I did retry several times but the box reappeared repeatedly. At the time, the progress tab on the left showed the program was "updating security check information". Trying to learn what I could, I clicked on the results tab and it showed ADWARE_MEMWATCHER (98 infections) but the program and computer were frozen there and I could only close the browser. I did have AdAware installed on my computer but uninstalled it in July 2008. I uninstalled using the Add/Remove feature, I uninstalled because of a thread in this forum related to compatibility issues between Spybot and AdAware. Anyway, I digress, but IÂm relating these events in the order they appeared. I came back to this forum to report and saw additional instructions about disabling TeaTimer, etc. In trying to find out how to do so, I was in Spybot and clicked on the recovery tab. There I found a backup for virtumonde.sci. The system wouldnÂt allow copy and paste of what it was saving in backup so I copied it manually (and hopefully without error). Browser helper object HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(AAAE832A-5FFF-4661-9C8F-369692D1DCB9) The above was listed 4 times for 1/4/09 9:57:00 AM 1/30/09 10:33:44 PM 1/31/09 5:07:20 PM 1/31/09 7:14:07 PM The following was also listed once: Class ID HKEY_CLASSES_ROOT\CLSID\(AAAE832A-5FFF-4661-9C8F-369692D1DCB9) 1/4/09 9:57:01 AM Should I still run the ATF Cleaner? Thanks so much for your help - June

I have the McAfee Security Suite which updates automatically. I checked in the Security Center, as you instructed, and it does show that the Firewall, Automatic Updates, and Virus Protection are all enabled and working. The McAfee Suite has been installed on this computer since Day 1 and Spybot followed close behind. This is the 1st time, however, that Spybot found it to be a problem. I get the idea that this "problem" is a warning that something else (McAfee in my case) is overriding Microsoft's attempts to protect this computer? If so, then I should do nothing (i.e. do NOT allow Spybot to "fix" it)?

1)MyWay Search Assistant for Dell Computers. This CLSID or Class id--> 4D25F921-B9FE-4682-BF72-8AB8210D6D75 tells us it's Myway search Assistant for Dell Computers. First, no big deal on that scan, The My way search assistant comes preinstalled on some Dells. Super AntiSpyware removed it cause it's classified as adware! "Adware applications, toolbars and browser extensions may serve advertisements even while you are not surfing the Internet." This application may serve various types of advertising, not limited to pop-up ads. This stuff below is all the things that Myway Search Assistant installs, First it installs the process Process DESRCAS.DLL This is the file path and location of the process: C:\PROGRAM FILES\MYWAYSA\SRCHASDE\1.BIN\DESRCAS.DLL And these are the registry entries that are made by Myway Search Assistant. Clsid or Class ID. HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75) HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75) HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\InprocServer32 HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\InprocServer32#ThreadingModel HKCR\CLSID\(4D25F921-B9FE-4682-BF72-8AB8210D6D75)\Programmable C:\PROGRAM FILES\MYWAYSA\SRCHASDE\1.BIN\DESRCAS.DLL HKU\S-1-5-21-2567871069-2602521732-2068354608-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(4D25F921-B9FE-4682-BF72-8AB8210D6D75) HKCR OR H_Key_Class_Root key. That's the registry key that the CLSID or class Id installed to. All removed now! Then adware tracking cookie Those are a fact of life on the internet get them from everywhere. They also have all been removed. This scan has nothing to do with the problem you describe!

Patti, this applies to members of any Yahoo Groups. I can't say it applies to their email accounts, but I wouldn't doubt if it does. You'll have to read their privacy statement in the email accounts to find out for certain. This is a portion of the privacy statement for their Groups, which obviously is little privacy at all. But it was not excerpted from the privacy statement of their email accounts or toolbar. The Privacy Act where the internet is concerned is still very fuzzy. I think they are required to tell people what they do in their privacy statement. I also think they are required to provide viewing of the privacy statement along with their terms of use at the time you sign up. Most of us don't read those, just assuming we will not violate familiar rules. They rely on us not reading them, but, it's a good idea to read them whenever joining a website or group, when creating email accounts, and when installing anything.