Ok..im back on my computer for now...i think i have a solution This is what I did Disconnect from the Internet Download Process Explorer here http://www.sysinternals.com/Utilities/ProcessExplorer.html From another computer and save it to a disk (if you can get it with the infected computer it will still work), Disconnect after youget it thuogh) Run that and look for lsass.exe (if you have the same thing i did it will be running twice) Click View>Select Columns, Check "Command Line" One of the lsass.exe will be running from C:\WINDOWS..this is the bad one, the other will be wunning in C:\WINDOWS\System32 Miniamize Process Explorer, and browse to C:\WINDOWS Use the folder options to show hidden and system files Find lsass.exe, be sure you are not in the System32 folder It wont let you delete the file because it is in use by windows so you have to select it in process explorer and push delete, it will ask you if you want to kill the process, say yes. You have to work quickly because lsass.exe will start itself after a few seconds, so what you do is have both windows open, Process explorer and C:\windows, have lsass.exe selected Go to the Process Explorer and kill lsass.exe that is running from C:\WINDOWS, then move over to the C:\WINDOWS folder and delete lsass.exe before it has a chance to start again. Then delete sw.bat is.bat tb.exe xe.exe low.exe mmxateam.exe IELower.exe uspupdatesx.exe mc-110-12-000169.exe from C:\ Ive seen differant sets of files so there may be files here you dont have, and you may have others. After I did that I restarted and the files didnt come back, I connected to the internet gain and waited.....No files its been about an huor and ho problems yet, i hope that is all it was, but there may be more of this...ill post if i find out anymore