check registries for malicious software being loading RUN keys... go to the root of those files to see if you can find them "make sure you've selected to view everything in folder options" if you find them just copy them to floppy and send it to symantec... if you can't find them do an attrib command in command prompt in the root of where the files are being loaded to see if you can find them there.. so if there in system32 just type attrib -h in system32 and it will display all files hidden that windows won't display.. if you can't recover the file atleast copy the name and send it to symantec and delete the file off your computer "and note to disable system restore, and be in safe mode when you do your cleaning".