like most said i found the logs under client managment >> security log
....dont know why i didnt see them before,,
the file downloaded was a executable . its no longer in the path that the log indicates
and a full scan didnt find anything.
i am runing a power eraser with rootkit and later symhelp
thanks