a newish trojan seems to be hitting the security forums today these are the entries we are seeing O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS\System32\iefeaturesversion.exe O4 - HKLM\..\Run: [iefeatures] C:\WINDOWS\System32\iefeatures.exe O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS\SYSTEM\INTERNETFEATURES.exe and then dowenloads a lot of other nasties http://es.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=57089&VName=TROJ_POPMON.A&VSect=O Added URL tags - Pieter