Am wondering if any further information is available on this. My SAS detected the same Adware.Vundo Variant within the registry and I have run the most updated SAS available along with Malwarebytes' Anti malware program. I have not like the previous poster manually deleted the item via regedit facility. Thanks - paramonks this maybe a tangent - but put it out there for thoughts also - a couple of days ago someone posted the python service from webshots as a potential FP. I have not seen any response whether it is or not, but I was using that version of webshots (which I did uninstal prior) to the latest upgrade of SAS yesterday. The more I've pondered about this supposed suspect item within the registry, I have become more certain that this has something to do with Webshots and is a FP. When selecting the option to remove the supposed rogue item a text box message from Webshots appeared with wording to the effect of "another application is trying to change your home page ? from Webshots. Do you wish to continue with ...... (can remember the exact wording here) then Yes or No boxes.