I am posting the HJT. The infection occurred in the Mozilla Firefox\plugins folder. This was most likely from a chat session with AdAware Alert and Error Killer. They have emailed me for an HJT and sent a link. I remembered to run the programs from your forum instead. I also had a keylogger virus, a repeating virus, which I had isolated to the Avast "chest" when I started because I was having trouble with CounterSpy anti-virus and had uninstalled a registered version. I was running SpywareGuard and several others, but Kerio Personal Firewall kept popping up balloons that interferred with my work. I deleted almost all antivirus and spyware programs before downloading AdAware Alert. The person on the chat line sent a registry entry and I wrote them up (bad recommendation for tech rep) for not alerting me and giving me notice that they were going to send a fix. Housecall would not run for me. And Smitfraud was interrupted by "Disk Cleanup" and a window about "Windows is running in safemode" do you want to continue or something like that. I don't think the wininet.dll file ran. It seemed like one of the 4 tools fixed the Kerio Firewall error: Windows Logon UI, Windows NT Logon Application; it won't allow me to log off and "End Now" is the only option. After rebooting, though, the problem came back. This might be related to the Error Killer problem because the Kerio balloon showed "Application is launching another application Windows Task Manager, Windows NT Logon Application". (I hope that is right.) The other error from AdWare Alert was because I opened 'My Computer', System Restore to delete a schedule task set up by AdWare Alert. Kerio would not allow the operation and opened 2 Generic Host Process files and 2 Image Mastering API files. Strangely, I typed "sendto" in "run" box and tried to use the right click to move, copy, create a shortcut, there were no options for these actions; however, when I clicked on the folder I wanted to copy (a Firefox plugin), it gave an error message that "windows cannot open PhotoStory3" for (?) 'type of file'. Very unusual!