Just found kernel32.exe and kdll.dll and zapped them. Thanks Lawrence. I made the mistake of opening the infected attachment. Sunday 25th. Spent hours looking for inetd.exe, kern32.exe and hksdll.dll (Badtrans.a) According to McAffe:- "This mass mailing worm attempts to send itself using Microsoft Outlook by replying to unread and read email messages. It also mails itself to email addresses found within files that exist on your system. It drops a keylogging trojan (detected as PWS-Hooker with the 4173 DATs, or greater) into the SYSTEM directory as KDLL.DLL. This trojan logs keystrokes for the purpose of stealing personal information (such as credit card and bank account numbers and passwords). This information is later emailed to the virus author(s)." I never could get Outlook to install - how do I know what my POP3 address is !! Thankyou Microsoft. Chris