Ran spybot search and destroy which did not recognise it. Ran msconfig and sure enough it is there. Still don't know what it does. It runs from c:\windows\system32\oatteoee.exe. An entry in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name - mfnzfhoekb Type - REG_SZ Data - C:\WINDOWS\System32\oatteoee.exe I'll try and disable it and see if I get any result. Thanks all.