In a message dated 2/1/05 7:26:42 PM Pacific Standard Time, Madrachod@xxxxxxx writes: C:\_RESTORE\TEMP\A0001696....... And it says something about FS15.CAB and it's in Start page-DU.DLL. Where that is, I haven't a clue. I STILL need to shut off the write protect in order to delete the Trojan From the BlackViper......... disable that restore point and wipe out the trojan..... It will be deleted won't it ? System Restore creates system snap shots or restore points for returning to at a later time. Every time you install a program or new driver, plus on a schedule, this service creates a "restore point" to roll back to if a problem occurs. This service would have been nice in the Win95 days due to plenty of problems occurring (new DirectX version every 15 minutes) but not required for the "much" more stable WinMe. This is the FIRST thing that I get rid of on a clean installation. If you use this and enjoy it, good for you. I never will. I feel it is faster and less hassle to just install clean. A rather GOOD (and possibly the only) reason to use this "feature" is to roll back your OS after installing an unknown program or testing software. For example: BETA software of any kind. NOTE: If you disable this service, your previous "restore points" will be deleted. If, for what ever reason, you do not want this to happen, do not disable this service.