hello. great info here. have found many answers just surfing the forums, but not this one. hijack this log found this: O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\popcorn72.exe rundll.dll,LoadMouseProfile looked in that folder, but popcorn72 is not there. any ideas? thanks. -s

It's a trojan.Try downloading killbox from this link http://www.short-media.com/download.php?dc=69 Boot into safe mode. Restart your computer, and begin tapping the F8 key on your keyboard. Continue to do so until the Windows Advanced Options menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again. Using the arrow keys on the keyboard, scroll to and select the Safe mode menu item, and then press Enter. Once in Safe Mode, please run Killbox. Click "Delete on Reboot". Paste the following into the top "Full Path of File to Delete" box. C:\WINDOWS\System32\popcorn72.exe Click the red-and-white "Delete File". Click "Yes" at the Delete on Reboot prompt. Click "Yes" at the Pending Operations prompt. Your PC should restart, if not, restart manually. Run this free online scan from Panda

If you think it is a trojan download Ewido Security Suite (not the beta version on the bottom left of the page) and set it up this way Ewido Setup Instructions then run it in Safe Mode Or use killbox at this link Killbox Boot into safe mode. Once in Safe Mode, please run Killbox. Click "Delete on Reboot". Paste the following into the top "Full Path of File to Delete" box. C:\WINDOWS\System32\mouse.exe (example) Click the red-and-white "Delete File". Click "Yes" at the Delete on Reboot prompt. Click "Yes" at the Pending Operations prompt. Your PC should restart, if not, restart manually.

Supermega, Please disregard response #2 as I posted to the wrong poster, my apoligies.

ok, thanks jabuck. tried using killbox in safe mode, but it says 'the file does not exist'. i went ahead and selected 'delete on reboot' and then ran hijack this again upon restart. popcorn72 is still there. wonder what the deal is. -s

supermega, Run run a HT scan,close all browsers and windows a except HT, place a check in the box to the left of the following and press "fix checked". O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\popcorn72.exe rundll.dll,LoadMouseProfile That will remove it from your HT log and the registry. Navigate to C:\WINDOWS\System32\popcorn72.exe and make sure it is not there, although it sounds as though it is gone. If you want post your HT log.

ok, well, it appears that it is gone. great support board, thanks a lot. i appreciate your assistance -s