Made the videos. Near the end as running as admin, it was CRAWLING to grinding halt. I could not complete the HJT logs, because it would have taken an hour to do so! It was alot of work to get it to a decent speed so I could get the video file. It was a driveby exploit, so no ifs ands or buts about if the user "decided" to run it. Basically, as admin, the malware had to ability to: - Edit my hosts file - Use group policy to disable task manager, enforce various IE settings system wide, among other things It is XP Pro sans any service packs OR patches, nor any anti-virus or security "hacks". The limited account was much, much less severe. No crawling, and completely isolated from the rest of the system. It is also secure for IE, because driveby ActiveX exploits aren't possible. You can only get exploited by existing ActiveX plugins but even then it can do less damage. It's a 1.09MB rar file.. this forum won't let me upload it.