I have several computers connected via LAN to a DSL modem. They all conect simultaneously w/ the same logon ID. One computer runs WinME. It seems infected with atrojan, but I cannot find out wich one. Symptoms: 1: despite all my efforts (remove, clean, delete, reboot scan, reinstall), zonealarm shut down after +- 1 min 2; when I connect to the net, there is activity even when no browser or email program is running 3: within the next minutes, I receive email on another computer, under the common logon ID, about undelivered email. I do not recognize the to or IP addresses. In some cases, the destinee's soft talks about the KLEZ virus 4: However, nor the virus scanner (AVG), manual searches or registry lookup's do not reveal any virus signature 5: When I monitor the activity, the minimum I get is about 30% CPU cycles, even when I do not touch anything Any solutions Thanks Marc

You could try scanning with Ad-Aware: http://download.com.com/3000-2094-10121984.html?tag=lst-0-2 It might just be some harmless but annoying spyware programs.

Ger, Thanks for the sugestion. I will do it again. However, I started in dos (boot disk), and emptied the cookies directory, temp directories, internet temp directory. It does not make any difference. Thanks Marc

There is also some normal hard drive activity in Windows Me related to file monitoring for System Restore. When the machine has been idle for a few minutes, the background monitoring starts. If you move the mouse when this happens, the hard drive activity stops. You might want to try one of the free online virus scans and see if it picks up something AVG missed. Here's one: http://housecall.antivirus.com/housecall/start_corp.asp

hello search for wink*.* if found you have the klez have a nice day

wawadave, I did a search for wink*.* and it returned a wink.class In folder com/ms/win32 this is on my xp laptop. Is the wink.class a virus? Can I remove that file?

wink.class is NOT a virus. I thought this too at first but if you look closely it is a file inside a .zip file in your java. C:\WINDOWS\JAVA\Packages\ABRXRX7T.ZIPcom/ms/win32/wink.zip There are also wina.class -> winz.class files. Kinda scarry. Thats not to say you dont have klez, that just means that wink.class is not klez. Also check for Yaha and Nimda viruses. Good luck!