Task manager shows the typical results reported on many threads: multiple dllhost.exe host calls with owner com surrogate. Machine is unusable for the most part when logged into the infected account. Note: glad to donate to the cause when this is fixed (I have before-you guys rock!). However, can you answer a couple of questions up front? Why is this apparently limited to the single account (there are 5) on this machine? Does that have anything to do with the fact that I didn't give the infected account admin privileges when I set up the machine? Since then, as I work on the machine, I've given the account admin privileges. I hope that doesn't cause this to corrupt the other accounts, too. For the instructions you give me, should I just run this from the infected account? I presume so... Lastly, and more importantly: I want to prevent my father in law from having this happen. Just telling him not to click on "stuff" doesn't help much. Any idea what the prompt was like that caused him to do this? Some suggest on the net that this is a new trap from those that bundle this with upgrades Java, Silverlight and many other packages. I presume he MUST have clicked on some type of installer. do I tell tell him, moving forwards to watch for? What I have some choice words for these guys that write this crap-but forum rules say no swearing!