Hello,
Do excuse the 2nd post, as I failed to immediately realize here was a specific section dedicated to virus and security

First, I found a thread that spoke of this unusual registry key entry, but in the responses, there was not explanation of what it could be.

I understand the WOW registry is part of WIN2K security, but it's the startup program file that has me confused.

The key entry is as follows:
Under WOW SetupPrograms, I have.

SetupProgramNames Reg_multi_sz install inst imposta ayarla felrak eviewset

Is this a valid entry or part of some Trojan file call?

Lastly,

On my home computer I found a poly-mophric Trojan loaded on my WIN2K unit that Pest Patrol at first labeled as the 'Orange and Green' and then described it as a back door 'TDE.exe' and displayed an executeable of BFT.exe . According to their library it could be used to capture screen shots, keyboard entry logging, password stealing etc. I deleted it, but I noted on one of the threads that some Trojans are capable of infecting the partition.

Does this mean that it can recreate itself after a reinstall of the OS? I basically rebuilt the unit and reformatted the drive using NTFS. Does anyone know what the originating program of this Trojan could be? Before I deleted it, I noted that it had created a folder under my 'Admin Document Setting' secition titled 'BFT' and had managed to stealthily create an admin account for itself. This is why I took the drastic measure of reformatting the HDD and reloaded WIN2K.

I then locked down the computer's security very tightly, installed ZA and Pest Patrol with security passwords on those applications. Any thoughts on this Trojan, how it may have been downloaded since I do have a Netopia Firewall installed. Is this some clever hacker tool or one of those spyware applications being sold on the market? I’m really confused, because the last person logged onto the PC showed it as being the Admin (which is me), but I hadn’t logged onto the unit in over 3 weeks and my kid was on it under her own ID which has privileges under the restrictive user group.

The way I setup the Winlog, the last successful login name appears on startup, so that part had me worried. Any info on its origination would be greatly appreciated.

One another thing, as a restricted user my kid is unable to use spell and grammar check in Office 97. Is there a method by which I leave the access as a restricted, whilst enabling the tools in Office 97?

Thanks,
JC