I would advise you to run an additional scan below: if you have time.. as a double check.. Use the Kaspersky Lab Online Scanner download from here click Here In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.  Click on SCAN NOW]  Click Accept.  The program will then begin downloading the latest definition files.  Once the files have been downloaded locate the Scan Settings and have it scan My Computer.  The scan will take a while, so be patient and let it finish. When the scan is done, in the Scan is complete window, any infection is displayed. There is no option to clean/disinfect. It's just a check to see if any infection is there if there is we can send you to another forum. To obtain the report: Click on: Save Report As  Next, in the Save as prompt, Save in area, select: Desktop.  In the File name area use KScan, or something similar.  In Save as type: click the drop arrow and select: Text file [*.txt]  Then, click: ]Save /Kas-Savetxt.gif[/IMG] Copy and paste the Kaspersky Online Scanner Report in your next reply. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. __________________ .

Put the event viewer away an run the the scan below, Use the Kaspersky Lab Online Scanner download from here click here In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.  Click on SCAN NOW  Click Accept.  The program will then begin downloading the latest definition files.  Once the files have been downloaded locate the Scan Settingsand have it scan My Computer.  The scan will take a while, so be patient and let it finish. When the scan is done, in the Scan is complete window, any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on Save Report As  Next, in the Save as prompt, Save in area, select: Desktop.  In the File name area use KScan, or something similar.  In Save as type: click the drop arrow and select: Text file [*.txt]  Then, click: Save Copy and paste the Kaspersky Online Scanner Report in your next reply. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. __________________ .

This is the second Malwarebytes scan after I removed everything I could from the first scan results. Malwarebytes' Anti-Malware 1.35 Database version: 1939 Windows 5.1.2600 Service Pack 3 04/03/2009 11:04:36 PM mbam-log-2009-04-03 (23-04-36).txt Scan type: Full Scan (C:\:) Objects scanned: 119355 Time elapsed: 47 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 15 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 8 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP997\A0179839.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\acpi32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\amd64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\nicsk32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\fips32cup.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\i386si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

"Multi-platform attacks are rare, but they represent a considerable evolution to be considered. Multi-platform malware represents a great evolution for cyber crime because they provide the opportunity for an attacker to infect a greater number of machines. The mechanism is simple: Using a JAR, the malware is able to identify the OS and then download the right files to infect the targeted machine. After identifying the type of operating system a unit is running, a Java class file will download the appropriate malware, with the purpose to open a backdoor to allow remote access to the machine. This isn't the first multi-platform malware detected. In 2010 for example the Boonana malware was detected which also used a malicious Java applet to spread itself. Malware of this type will increase in number in coming months, and no platform is immune, so it is desirable that internet users are aware of the threat and take appropriate precautions. A backdoor trojan differs from a trojan in that it also opens a backdoor to your system. They're also sometimes call Remote Access Trojans (RAT). These are the most widespread and also the most dangerous type of trojan. They are so dangerous because the have the potential to allow remote adminstration of your system. As if a hacker were sitting at your keyboard, only worse. There's almost no limit to what they can do. Some common uses: 1 Use your system and Internet connection to send spam (yes, the majority of spam is now generated by infected systems). 2 Steal your online and offline passwords, credit card numbers, address, phone number, and other information stored on your computer that could be used for identity theft, or other financial fraud. 3 Log your activity, read email, view and download contents of documents, pictures, videos and other private data. 4 Use your computer and Internet connection, in conjunction with others to launch Distributed Denial of Service (DDoS) attacks. Modify system files, disable antivirus, delete files, change system settings, to cover tracks, or just to wreak havoc. Backdoor:W32/GetShell.A is the Windows-specific payload of Trojan-Downloader:Java/GetShell.A, a malicious Java applet that detects your OS and installs an appropriate type of backdoor Trojan. Backdoor:W32/GetShell.A is responsible for the same dangers that are common to most backdoor Trojans, including opening up your PC to unwanted control by third parties, disabling or reducing your computers security features and, potentially, downloading additional PC threats or stealing private information. Keep your Computer up dated, practice safe surfing habits as always.. Joe