Hi, I've been checking my netstat Code (markup): constantly, and it says : .... TCP 68.197.84.49:4211 87.161.196.210:2010 SYN_SENT (also known as) TCP Vaio:4099 p57A1C4D2.dip.t-dialin.net:2010 SYN_SENT .... They go to a .de domain ,t-mobile.de (has to have a t-mobile or similar) is the 'service provider' but there is another one somewhere, and I'm getting a bit paranoid ALSO, I've been paranoid about ... TCP Vaio:4097 ip-210-48-100-45.iconz.net.nz:http TIME_WAIT TCP Vaio:4046 69-45-86-93.wcg.net:http TIME_WAIT TCP Vaio:4274 no-dns-yet.intec.co.uk:http TIME_WAIT (also 85.91.228.132:80) ... .....also ALOT OF netbios ports have been opened(I closed them before but they MAGICALLY opened) AND THE WORST THING IS THAT THESE CONNECTIONS COME + GO RANDOMLY + the intec one SAYS Server not found(that explains no-dns-yet) ....what I'm thinking, it's some 22-year old guy with a bot net of low xx people and he apparently got to me.....M$ really screwed me this time.....oh well, I was planning to scrap my XP install for a linux anyway, it's easier to install linux and install vista later(got it for free from friend who works at M$, although he doesn't consider working at Novell), than to preform part MR. Security-Expert and part voodoo......... ANYWAY, can anyone help me a little here.....(don't get the wrong impression, I already my research on the hostnames+DNS)...please don't suggest a firewall, been there done that.... {my thoughts: another M$ virus adventure ....my 15th to date....(my computer has only been able to live because of acronis+has been tortured painfully )}