Hi, I just wanted to post these file names and solution as i tried to "Google" for them myself and there is no info available. Malware creates Files lmhrxmzk.dat , adslpdq.dll , ocsphrwwl in System32 and/or System32/drivers folders. Symptoms: Pop-up declaring presence of Trojan, hi-jacking of IE explorer pages, infections sent to msn messenger contacts. I removed the malware using the Simply super Trojan remover (linked to on this site) This leaves the Windows firewall/ICS service disabled, resulting in loss of internet connection. When trying to start the service the message "error 2001 driver is invalid". I tried everything to restore this service, none of the cmd instructions to reset the service worked, replacing the obvious files didn't work, re-installing SP2 (for win XP) didn't work ! Solution: Run system file checker Start - Run "sfc /scannow" Put XP CD in the drive for replacement files. Perhaps other programs can remove this problem and clear up the residule damage better than TR672 ? so get advice from the experienced folk at this forum. However if you have got your ICS service disabled, try SFC before re-formatting your drive. Hope this saves someone the many hours of frustration that it caused me ! Thanks TechSpot for helping me in the past, cheers, Tony.