Greetings. If the following is too much off topic, please redirect me to the appropriate forum. First, the reason I arrived here. A user in the organization I work for had installed some unauthorized and unsupported software on his computer, as well as quite a bit of spyware. I uninstalled all the non-supported software, and cleaned up the spyware using Spybot S&D, Ad-Aware, and Microsoft (Giant) AntiSpyware Beta. A subsequent scan with Hijack This revealed a suspect process starting from the registry (WinXP SP2) and listed as O4 - HKLM\..\Run: [KavSvc] C:\WINNT\system32\i*****.exe (the exact file name I have written down at work, but it's probably not important as it appears to be randomly named). Everytime the computer is rebooted, Microsoft AntiSpyware reports this file as being blocked, as well as another file identified as C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rikn.exe. I have seen pretty much this exact same problem reported on another forum without a resolution. The executables were similar but not identical, but the same KavSvc service is mentioned. The first executable runs as a process, and killing the process and deleating the registry entry do no good as they are simply regenerated. Niether file is visible from Windows. In Recovery Console, the first file is visible and can be deleted from the System32 folder. However, the rikn.exe file is inaccessible. The parent folders have all been assigned the Read Only attribute, and attempts to change this from the Recovery Console are denied access. Now, I said all that to ask you this. The only references I find to KavSvc all point to Kaspersky AV. But this resembles a technique used by VX2 to hide and regenerate itself. So which do you think it is, a VX2 infestation or leftover files from Kaspersky? Since I really didn't pay much attention to the actual program names I was uninstalling, I can't say for sure that KAV was actually on the machine, and a scan with ADS Spy found no ADSs running. I have run mwav and Killbot with no success. My next step is to try Ultimate Boot CD to try and get to the rikn.exe file and delete it. The last time I delt with VX2, all the bad files were in the System32 folder, so this is a little different, and believe me, if this is actually a KAV leftover, I would stay miles away from Kaspersky! I would be grateful for any input you might have.