I have windows XP service pack 2 32bit system. I was downloading a torrent Immediately a file called TornTV requested to be downloaded. I clicked Close, it installed it anyway. Next I knew I had a virus thus I went to MajorGeeks.com and followed all of the steps. After I downloaded a program to remove disk emulation software (Defogger.exe) I disabled disk emulation software and it asked me to restart the computer. After the computer restarted a window appeared when Windows XP was loading which states: "This copy of windows is not activated" Next I cleaned the temporary files using CCleaner on every profile from this computer I proced to follow the steps and downloaded all of the tools (Rogue,Malwarebytes,TDSS,Hitman,MG) I then loaded the page detailing about WindowsXP removal steps I first ran RogueKilller, saved the log. Next I ran Malwarebytes, ran the scan, removed the files, restarted, then ran it again 2 more times each time saving the log after removing the malicious programs. After the 3rd time, Malwarebytes did not request to restart however it continued to find a malicious program. Next I scanned with TDSSKiller and had no results. Next I scanned with HitmanPro which had 3 results, clicked ignore on all and saved the logs. After running MGtools, an error screen popped up: Please help us improve HijackThis by reporting this error Click Yes to submit Error Details: An Unexpected error has occured at procedure: modRegistry_IniGetString(sFile==system.ini,sSection==boot, sValue==Shell) Error #5 - Invalid procedure call or argument WindowsVersion: Windows NT 5.01.2600 MSIE version: 8.0.6001.18702 HijackThis version: 2.0.4 I disabled AVG and then MGtools finished without errors. Finally, I ran the scans from each program again starting with Rogueskiller, then Malwarebytes, TDSS, Hitman and MGtools. (Let me know if you want the old reports as well) Below are my attached reports.