Wow, for a second there I didn't see the _html at the end ... I was seeing it as a normal .html. That's very clever. Last time I was on Windows, I noticed spyware authors started to get (seemingly) smart by writing curious files in System32 that looked like system files. These scam artists are getting smarter, next thing you know they'll make spyware rootkits ... thats when things will get interesting.