Actually I checked, and it was only in the startup...wasnt in the autoexec, or the registry....at least in the space traditionaly used. Should I be worried it was only found in one place...i mean does that mean it was WELL hidden, or that it hadnt been executed yet?