DatatType.library ================= Size difference: Version 45.4 = 27.780 Version 45.4/5 = 32.748 Version 45.4/5 = 4.968 bytes bigger then 45.4/5 On my machine I found the 45.4 version which was 32.748. It dates from februari 998 so this suggests that a lot of people have been victimised. There is also a 45.5 version, this betrayes itself since there has not yet been such a new version. Can only be used on 3.0+ machines (because of version check) Part of the code is encoded with simple encryption rtick is to find the encoded part and the encoding key to decode the stuff. It is not infected with some kind of link virus since a lot of changes inside could not have been done by a virus but have to be changed manually. There is too much changed too deeply. Trojan part seems to be added at end of first hunk. Bra to trojan part placed over "SUBA #$0014,A7" This might cause severe crashes since it should put the stack pointer back. This might be done in the trojan code but I haven`t found this yet. Deleting this file is adviced since a lot of stuff has been changed and a few things have been added. Some things have been manually added which would take a lot of time and effort to put back, easiest thing is to get the official library back and place it over the trojan one.