check what configuration files have been changed. e.g. go into the windows dir and try 'dir /od' which sorts it out by the modification date. just note that some virii can probably make changes to files without affecting this date.