Hi, I tried to restore these files that my mbam also detected (same files as CCy3686) so I could send them to you guys for inspection. Only the file in my System32 removed itself from mbam's quarantine list when I tried to restore it. However, it does not show up in my C:\WINDOWS\System32 directory. In fact, the entire InstallShield dir is missing from the System32 directory. I thought this was because it was hidden, but when I adjusted my Folders View in the Control Panel to show hidden files and folders, the InstallShield dir still did not show up. Now, I am in a situation where I have tried to restore the file, C:\WINDOWS\System32\InstallShield\_isdel.exe, but it does not show up in explorer, nor does the InstallShield dir itself even show up. This file also is no longer listed in my quarantine list in mbam. What should I do now? I could run another full scan with mbam to see if the file somehow gets detected again, but unfortunately, I do not have the same database anymore. Before getting to this forum, I updated my signatures database this morning. The signatures database I used when these files were detected as "Trojan.Zbot" is Database version: v2012.11.01.07. The signature database I have now is Database version: v2012.11.02.08. I don't know if this file is actually a trojan or not, and now it seems that I can neither send you a copy of it for inspection, nor can I find it on my hard drive after the failed restore. Again, given my situation, please advise me on what I should do next. I will refrain from doing anything more until I here your advice. Thanks in advance.