I have a user who has the sirefef virus. I have Forefront installed, it will catch it and remove it. But it comes back in a matter of minutes. I am running the scans you ask for in the preliminary removal steps and will post the logs as soon as I get them. This is on an XP laptop that I am remoted into using GoToAssist so I can't shut down the internet connections when running the scans, I hope this won't affect the scans too much. If it will I can get the user a temp and have this one sent back to me for cleaning. Just let me know.