Last night, I visited a site to download a midi file (classical music of all things). Note that I didn't actually download anything, but saw a popup notification in the bottom right saying that my computer was infected with Spyware and I should click on the icon (a red X) to download a program to eradicate the Spyware.

Not knowing what to do, I hibernated and came back to it this morning. A friend pointed me to AdAware, which I downloaded and ran a scan.

Adaware found a randomly named .exe in \documents and settings\administrator and install.dat in \documents and settings\administrator\application data, and identified them as "SpyNo". Adaware however didn't seem to find winstall.exe in \ that I found created at the sametime. However, even with all that gone, as soon as I rebooted and waited a little while, all files were back in place and my spyware was back.

So I did a search for .dll and .exe files with a date of yesterday evening. I found ntoskrnl.dll in windows\system32, and a friend didn't believe this file should be there, so I deleted it and rebooted again. Once again, the three files were back (but not ntoskrnl.dll). So I looked again and found ntsystem.exe in \windows\system32, with a date of 9/8 at 10 AM but when I looked carefully found it was created yesterday at 8:40 (the time of the corruption). So I deleted that one and tried again, and after about 20 minutes I still seem to be OK. I think I finally stomped it.