At 14:28 16/11/2003, you wrote >In my attempts to track down this odd popup I've mentioned, I had >ZoneAlarm block this this morning: > >bundle.exe > >it is in the folder: > >C:\WINDOWS\Prefetch http://vil.nai.com/vil/content/v_99786.htm http://www.sophos.com/virusinfo/analyses/w32ororb.html http://vil.nai.com/vil/content/Print99786.htm Is this the baby? You got an un to date AV package, it should be picked up by it!!! >as an archive (.pf) which a bunch of other stuff. Then in > >C:\Documents and Settings\Owner\Local Settings\Temp > >is the bundle.exe file that seems to run on startup..anyone have any >idea? > >Tom