Thanx for the info Soulman ... I have a 24/7 IRC connection running anyway ... online gamer, lol. So it's not likely I would've noticed it based on that. Although, now you mention, I did also block some 6667 ports to the badpenguin (nice name eh? LMAO) a while back, so it likely cycles through the ports it uses as well. I have removed the svshost.exe file i found in system32 (well quarentined it) ... no ill effects found as yet. Are you thinking of svChost.exe, which is still there?