the second file that is infected is

c:\WINDOWS\system32\mostat.exe

Thank you again for your help.