All of your logical drives will be administratively shared each time you start the computer. The shares that have a "$" at the end are hidden shares and don't show up in a network browse. I believe there is a procedure to disable these shares, but it requires you to bypass normal OS operation. This share was not caused by the Trojan, but is the normal operating mode of Windows OS. Peter ------------------ The NoSpin Group [log in to unmask] -----Original Message----- "This share was created for administrative purposes. The share will reappear when the Server service is stopped and restarted, or the computer is rebooted. Are you sure you want to stop sharing C$?" Jimmy DeLinco [log in to unmask] PCSOFT maintains many useful files for download visit our download web page at: http://freepctech.com/downloads.shtml