Ok Igor found more —C:\Documents and Settings \Dr. Many\Local Settings\Temporary Internet Files\Conten IE5\IDN3JNGA\wmvax[1].cab\WMVDS32.AX-----Looks like it could be mplayer spyware?