Normally i'm careful but basically i got: W32.Donk.C and it keeps putting C:\Windows\System32\cool.exe I have NOD32 - finds nothing and Xoftspy 4.22 - removes but back within minutes So i got XoftSPYSE4.29 - This removes it but its back in about 30 mins, i get a quick window flash up and goes, and then its back. According to the XoftSpy site: Description This application is a worm, a program that copies itself from computer to computer and, unlike a virus, can replace entire files. W32.Donk.C is a backdoor worm, which will allow a remote intruder to attack or control the user’s computer. The worm connects to certain IRC channels and awaits instructions from an intruder. It installs the file scchost.exe into the Windows System folder. Xoftspy normally removes stuff but this won't go, i've not noticed anything terrible yet, except the cool.exe runnong. Xoft site info about it Google didn't help much.