Hi Guys Thanks for the info.. Yes indeed, the majority of file complaints from hitman pro are exe or dll and the ones I checked with Kaspersky were reported as virus infected.. I didn't make close note of the names and the avast! software has fairly well locked the machine down now - it's already deleted one of my web browsers (SeaMonkey) and it prevents IE from starting up so not everything on the machine is usable any more Massively irritatingly is I can see there must be some DLLs that svchost is using that are infected, because the list of services running under this host process, though extensive, isnt anything out of the microsoft ordinary yet TCPView shows that this instance of svchost has hundreds of open TCP connections. Killing the host process makes the machine force reboot itself (the ntauthority shutdown advisory) One of the names I remembered was Win32.Ramnit.a (or some variation) , I don't remember the others (busy day at work on another laptop). HMP listed most things as virus, some as trojan, and it's picked up a few tracking cookies too.. So, the struggle I now have is that both HMP and avast! are taking the action of deleting all the files on the system that they encounter as infected.. I can't see the avast scan results yet, but it's counted 2800 infected objects so far.. Here's to hoping that most of those aren't EXE/DLLs or it's probably going to be faster to format and reinstall than recover from jsut about every major software item having to be reinstalled