I will be rounding up flash drives and scanning them to make sure that wasn't the infection route. I suspect a drive-by attack on the IP address instead of a web attcak. Well, this was the longest the computer has remained clean in years. I will not fool with it for a while. I have a few low end computers sitting around collecting dust. Actually the replacement is a better computer than the infected one. I had been on part of that govt furlogh except I will not get back pay. I cleaned up and/or fixed a few computers so I have a line up. I may scan the infected C: drive when I get a chance maybe I will find something.