Bruenor

Thank you, Thank you, Thank you!! I've been pulling my hair out on a PC that kept poping up a malware notification, it kept downloading adware files into C:\windows\temp.. I've been scanning the with everthing I could think of in my normal malware toolbox, and I spotted the mshta.exe process pointing at funnyracoon.com using process explorer, but was not finding what was spawning the process.. I'd kill the mshta.exe process and it would respawn a few minutes later.. I did a google search for funnyracoonshow.com malware and your post came back as the ONLY hit.. (how many times do you only get a single hit from google ? ) Checking the scheduler as you suggested revealed all the jobs scheduled as you stated.. not a place I normally look, but I guess I'll have to check more often now. Thanks again.