a cup could have been correct with the ANSI bomb, or it could be some other malware, so I am going to suggest that you go to the hijackthis forum,
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0 , and read the stickies at the top, and start a thread in there. I would also post a link in there pointing back to this thread, so whoever grabs the thread there knows what we did here.
