tetonbob

Hi Barry -

It would be a good idea for me to review HijackThis logs from the other accounts on this machine. LOP infection usually places startup entries in all accounts on the machine, and while we appear to have removed the associated files and folders, there may be orphaned registry items in those two user accounts.

So, please log on to both Tammy and Shannen accounts, scan with HijackThis, and post the logs. Please label them accordingly.

Also, I'd like to see results from one more tool.

Download fl.zip
Extract the contents to a new folder on your Desktop.
Within the folder, locate & double-click fl.bat.
It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply